Principal Engineer, Security Architecture - DGX Cloud

NVIDIA DGX Cloud is an AI Factory designed to power the next generation of AI and industrial-scale breakthroughs. As a Principal Engineer for Security Architecture, within our Security Engineering organization, you will own a core security domain of the AI factory: the architecture, the paved road that delivers it, and much of the code underneath. You will hold the security design bar across DGX Cloud from inside the teams doing the building, and this is a founding seat on a new team.

Security Engineering is a new organization at DGX Cloud, accountable for the security outcome of the platform, and Security Architecture is the function inside it that holds the design bar. Security here is fleet horizontal and stack vertical, so your work will cross every DGX Cloud engineering organization: you will embed with the teams building GPU clusters, control planes, and services, join their designs as a participant rather than an approver, and leave behind systems in which an entire class of risk is no longer possible. There is no architecture review board here and no approval queue. You are a senior IC with deep security domain knowledge, and the security bar holds because you helped set it and then helped ship it.

What You Will Be Doing:
-
Own a Security Domain End to End: Take architectural ownership of a core domain of DGX Cloud security, from the design through the system running in production. That could be tenant and GPU workload isolation, workload identity, infrastructure and network, supply-chain provenance, hardened baselines and patching, or deploy-time policy and admission control.

-
Embed with the Teams Building It: Join the design early, write the code, and help land it. The posture is not "you did this wrong." It is "here are the considerations we need to meet, I will help, let's go to work."

-
Build Paved Roads, Not Gates: Engineer the secure path into the platform so that it is also the easy path. You are measured by whether teams take that path by default, not by the number of requirements you have written down.

-
Engineer Classes of Risk Out of Existence: Finding a vulnerability is 4% of the work; building the system where it cannot happen again is the other 96%. When teams keep missing the same requirement, the paved road is wrong, and fixing the road is our job rather than theirs.

-
Threat Model and Attack the Design: Run deep-dive threat models across the substrate, the orchestration layer, and the tenancy boundary, then go after your own designs offensively and feed what you find back into the baselines, the guardrails, and the detections.

-
Carry the Bar into Execution: Turn the DGX Cloud security bar into reference architectures, requirements, and golden paths teams can build against. Raise gaps early, in the design, with the work to close them attached.

-
Multi-Functional Collaboration: Partner with DGX Cloud platform, production engineering, and network security teams, and with NVIDIA's central security organization, to make the secure path real in CI/CD and in the hardware lifecycle. We operate horizontally across vertically organized teams, with influence rather than authority.

What We Need to See:
-
Security and Infrastructure Engineering: Experience (typically 15+ years) across software engineering, SRE, infrastructure, and security engineering. You build systemic solutions rather than performing manual operations or "tool administration."

-
Production-Grade Coding: A strong software engineering background with the ability to write clean, maintainable, and well-tested code. You should be comfortable building and operating production services at scale.

-
Emerging Technology: You work with what is new rather than waiting for it to settle. Today that means writing and reviewing AI-generated code at the volume it now arrives, putting AI-assisted analysis to work in your own security engineering, and building for agents that act inside the systems you own. Tomorrow it wil