DDN is seeking a highly experienced Sr. Staff Security Architect to lead the design and implementation of end-to-end security architecture across distributed storage platforms, including S3-compatible systems, POSIX-compliant file systems, and KV cache–based data services. This is an architecture role focused on working closely with engineering teams across the data path, control plane, and ecosystem/protocol domains to ensure security is deeply embedded across all layers of the platform. You will collaborate with protocol teams, storage engineers, and platform architects to define secure-by-design systems that support high-performance, multi-tenant, and AI-driven workloads. The ideal candidate brings deep expertise in distributed systems security, cryptography, identity frameworks, and storage architectures, with a strong ability to influence engineering design and guide implementation at scale.
Lead the design and implementation of end-to-end security architecture for distributed storage platforms, including S3-compatible systems, POSIX-compliant file systems, and KV cache–based data services.
Partner closely with Data Path engineering teams to ensure secure, high-performance data movement across storage tiers, including encryption, integrity validation, and secure I/O handling.
Lead threat modeling, security reviews, and Secure Software Development Lifecycle (SSDLC) practices across the platform.
Define identity and access management (IAM) integrating enterprise identity providers such as LDAP, Active Directory, OIDC, and Keycloak, supporting SSO, MFA, and federation.
Architect fine-grained authorization models using RBAC and ABAC across tenants, datasets, and resources.
Design multi-tenant isolation mechanisms across namespaces, policies, encryption boundaries, and resource quotas, enforcing least privilege and segregation of duties.
Collaborate with Control Plane teams to define secure APIs, authentication and authorization workflows, policy enforcement, and tenant lifecycle management.
Work with Protocol and Ecosystem teams to secure S3 and POSIX/NFS interfaces, including request signing, session management, and endpoint security.
Define and enforce encryption strategies for data at rest and in transit, including tenant-specific keys and dataset-level encryption policies. .
Drive observability and monitoring strategies to detect anomalous behavior, abnormal access patterns, and potential data exfiltration across the platform.
Provide technical leadership and mentorship across cross-functional engineering teams, guiding secure design and implementation practices.
Bachelor’s or Master’s degree in Computer Science, Engineering, or a related field.
12+ years of experience in security architecture, infrastructure security, or distributed systems.
Proven experience designing security for large-scale distributed systems or storage platforms.
Strong understanding of data path vs. control plane architectures and their security implications.
Deep expertise in encryption technologies, key management systems, and cryptographic frameworks.
Experience integrating with external KMS solutions using KMIP or similar protocols.
Strong knowledge of identity and access management (IAM), including RBAC, ABAC, SSO, MFA, and federation.
Experience working with enterprise identity providers such as LDAP, Active Directory, and OIDC.
Familiarity with secure API design, TLS 1.3, mutual TLS, and request signing mechanisms (e.g., SigV4).
Experience designing multi-tenant systems with strong isolation and policy enforcement.
Knowledge of logging, auditing, and SIEM integration for security monitoring and compliance.
Ability to collaborate effectively with protocol, storage, and platform engineering teams.
Experience working with S3, POSIX/NFS, or similar storage protocols from a security architecture perspective.
Familiarity with KV cache systems, memory tiering, or AI/ML data infrastructure security considerations.
Hands-on experience with BYOK models and tenant-scoped key management.
Experience implementing ABAC using metadata, tags, and classification attributes.
Background in zero trust architecture and distributed system security design.
Experience with secure deletion techniques, including cryptographic erasure.
Knowledge of compliance frameworks such as SOC 2, ISO 27001, NIST, or FedRAMP.
Experience designing security for high-performance, low-latency distributed systems.
Familiarity with anomaly detection, security analytics, and alerting systems.
Defining and driving security architecture across data path, control plane, and protocol layers of distributed storage systems
Partnering with engineering teams to embed security into S3, POSIX, and KV cache data services
Building scalable encryption, identity, and access control frameworks for multi-tenant environments
Strengthening tenant isolation, auditability, and compliance across the platform
Ensuring secure integration across ecosystem components and external services
Leading cross-team security initiatives that influence system design, implementation, and long-term platform evolution
Skills Required
- Bachelor’s or Master’s degree in Computer Science, Engineering, or a related field
- 12+ years of experience in security architecture, infrastructure security, or distributed systems
- Experience designing security for large-scale distributed systems or storage platforms
- Strong understanding of data path and control plane architectures and their security implications
- Expertise in encryption technologies, key management systems, and cryptographic frameworks
- Experience integrating external KMS solutions using KMIP or similar protocols
- Knowledge of IAM, including RBAC, ABAC, SSO, MFA, and federation
- Experience with LDAP, Active Directory, and OIDC
- Familiarity with secure API design, TLS 1.3, mutual TLS, and request signing such as SigV4
- Experience designing multi-tenant systems with strong isolation and policy enforcement
- Knowledge of logging, auditing, and SIEM integration for security monitoring and compliance
- Ability to collaborate with protocol, storage, and platform engineering teams
- Experience with S3, POSIX/NFS, or similar storage protocols from a security architecture perspective
- Familiarity with KV cache systems, memory tiering, or AI/ML data infrastructure security
- Hands-on experience with BYOK and tenant-scoped key management
- Experience implementing ABAC using metadata, tags, and classification attributes
- Background in zero trust architecture and distributed system security
- Experience with secure deletion and cryptographic erasure
- Knowledge of SOC 2, ISO 27001, NIST, or FedRAMP
- Experience designing security for high-performance, low-latency distributed systems
- Familiarity with anomaly detection, security analytics, and alerting systems
What We Do
DDN is the world’s largest private data storage company and the leading provider of intelligent technology and infrastructure solutions for Enterprise At Scale, AI and analytics, HPC, government and academia customers. Through its DDN and Tintri divisions, the company delivers AI, Data Management software and hardware solutions, and unified analytics frameworks to solve complex business challenges for data-intensive, global organizations. DDN provides its enterprise customers with the most flexible, efficient and reliable data storage solutions for on-premises and multi-cloud environments at any scale. Over the last two decades, DDN has established itself as the data management provider of choice for over 11,000 enterprises, government, and public-sector customers, including many of the world’s leading financial services firms, life science organizations, manufacturing and energy companies, research facilities, and web and cloud service providers.
