Principal Engineer, Security Architecture - DGX Cloud

NVIDIA is hiring a Principal Engineer for Security Architecture within DGX Cloud’s Security Engineering organization. The role owns security architecture end to end, embeds with engineering teams to design and build secure platform systems, and develops threat models, reference architectures, and paved roads across the AI cloud platform.

Responsibilities:

• Own a Security Domain End to End: Take architectural ownership of a core domain of DGX Cloud security, from the design through the system running in production. That could be tenant and GPU workload isolation, workload identity, infrastructure and network, supply-chain provenance, hardened baselines and patching, or deploy-time policy and admission control
• Embed with the Teams Building It: Join the design early, write the code, and help land it. The posture is not "you did this wrong." It is "here are the considerations we need to meet, I will help, let's go to work."
• Build Paved Roads, Not Gates: Engineer the secure path into the platform so that it is also the easy path. You are measured by whether teams take that path by default, not by the number of requirements you have written down
• Engineer Classes of Risk Out of Existence: Finding a vulnerability is 4% of the work; building the system where it cannot happen again is the other 96%. When teams keep missing the same requirement, the paved road is wrong, and fixing the road is our job rather than theirs
• Threat Model and Attack the Design: Run deep-dive threat models across the substrate, the orchestration layer, and the tenancy boundary, then go after your own designs offensively and feed what you find back into the baselines, the guardrails, and the detections
• Carry the Bar into Execution: Turn the DGX Cloud security bar into reference architectures, requirements, and golden paths teams can build against. Raise gaps early, in the design, with the work to close them attached
• Multi-Functional Collaboration: Partner with DGX Cloud platform, production engineering, and network security teams, and with NVIDIA's central security organization, to make the secure path real in CI/CD and in the hardware lifecycle. We operate horizontally across vertically organized teams, with influence rather than authority

Requirements:

• Experience (typically 15+ years) across software engineering, SRE, infrastructure, and security engineering
• A strong software engineering background with the ability to write clean, maintainable, and well-tested code
• You should be comfortable building and operating production services at scale
• You work with what is new rather than waiting for it to settle
• Today that means writing and reviewing AI-generated code at the volume it now arrives, putting AI-assisted analysis to work in your own security engineering, and building for agents that act inside the systems you own
• Designs you own that actually got built and run, in areas like multi-tenant isolation, identity and access, policy enforcement, vulnerability management, or detection engineering
• You stayed on to operate them
• Proven ability to build threat models for complex distributed systems, identify the architectural gaps rather than only the bugs, and engineer the solutions that close them
• Cloud-native architecture, container orchestration (Kubernetes), and hands-on Linux systems security including kernel-level primitives (eBPF, AppArmor, or SELinux)
• Experience landing designs through teams you do not own, in environments where credibility and relationships, not org charts, determine whether the work ships
• Bachelor's degree in Computer Science, Engineering, or a related technical field (or equivalent experience) with 15+ yrs of relevant experience
• Experience securing high-performance computing environments, RDMA-based networks, large GPU fleets, or GPU-specific security challenges
• Expertise in workload identity frameworks (e.g., SPIFFE/SPIRE), hardware root of trust (TPM/HSM) integration, or confidential computing
• Real exploitation, red team, or security research experience that you have converted into engineering: the controls, guardrails, and detections that closed what you found for good
• Notable contributions to security-focused open-source projects or a track record of engineering-focused security research