Principal Security Engineer

About the Role

You'll focus on hands-on design and implementation of security related software, to shift security left in our development processes. This includes embedding automated controls such as SBOMs and vulnerability scanning into CI / CD pipelines; maintaining and updating our internal shared libraries and infrastructure for authentication, authorization, and logging; and assisting with monitoring tools for operational services. Where needed, you'll help align systems with NIST 800-171 / CMMC requirements, collaborating closely with the Principal Security Engineer, AWS infra team, dev tooling team, chief software engineer, and cybersecurity / GRC group.

You'll work in a lean, impact-focused environment—prioritizing deliverables like secure code and architecture with bureaucracy handled by the TPM / GRC org as much as possible. Occasional engagement in security discussions with government entities may be involved, under the principal security engineer's guidance.

~80-90% hands-on work, with the remainder on collaboration and learning.

Key Responsibilities :

• I mplement Security Controls in SDLC : Assist in integrating security automation into pipelines (e.g., GitHub Actions / ArgoCD for SAST / DAST / SCA, SBOM generation, and vulnerability scanning).
• Support Shared Libraries and Infra : Contribute to evolving standard libraries / infra for authn / authz, logging, and other runtime security features, including testing and updates.
• Contribute to CMMC Compliance : Hands-on support for implementing controls (e.g., encryption, secure configurations, monitoring) to meet / exceed CMMC Level 2 requirements in AC, IA, SC, and SI families, building on our ISO 27001 foundation.
• Assist with Reviews and Models : Participate in security architecture reviews, code audits, and threat modeling; help identify and remediate issues like API vulnerabilities or supply chain risks.
• Team Collaboration : Engage in code reviews, pair programming sessions, and tooling development to advance secure practices; provide peer support within the security engineering team.

Required Qualifications :

Preferred Skills :

Bonus

Spire operates a hybrid work model, and this position will require you to work a minimum of three days per week in the office.

Access to US export-controlled software and / or technology may be for this role. If needed, Spire will arrange the necessary licenses—this is not something candidates need to have before applying. #LI-DC1