Principal Security Engineer

The security systems you build will determine whether millions of Americans can safely access college aid. You’ll architect the defenses protecting studentaid.gov — the system handling $120 billion in federal aid and the most sensitive financial data of 20 million families each year.

You’ll design and build the security infrastructure that handles:

Authentication and authorization for millions of users accessing SSNs, tax returns, and financial data

Threat detection and incident response for a system under constant attack

Security compliance meeting FISMA, FedRAMP, and federal requirements without slowing teams down

Vulnerability management across hundreds of services, libraries, and dependencies

Security architecture reviews for features shipping to millions of users weekly

This is a hands-on technical leadership role — you won’t code every day, but when it matters, you’ll dive in to unblock teams and de-risk critical changes. The specific tech stack doesn’t matter — we need engineers who can work with and improve whatever technology serves the mission. Tasks may include:

Design and build security infrastructure replacing legacy authentication systems

Set technical standards for secure coding and threat modeling across teams

Make architectural decisions about identity, secrets, and encryption

Lead incident response for security events affecting millions of users

Review PRs across multiple codebases, spotting failure modes and simplifying changes

Unblock teams by writing code when the mission demands it

We’re looking for engineers who’ve built at scale in complex environments — typically Staff+ at a strong engineering organization, with experience in most of the following:

Built or operated systems serving millions of users in production

Led cross-team technical initiatives over multiple quarters

Migrated or decomposed legacy systems while keeping critical workflows available

Stayed hands-on with code — you can still read a diff, trace a request, and ship a fix

Prioritized outcomes over process — you know when to push back on bureaucracy that slows delivery without adding value

Our interview process is fully remote, consisting of 3-5 conversations that assess work experience, fit, and technical skills.