Want to know if this job is worth applying to?
Área Metropolitana de San José, Costa Rica
Remote only
SimSpace serves as an AI Proving Ground where organizations can confidently train, test, and outmaneuver adversaries in any environment. Trusted by allied governments, militaries, enterprises, and research institutions worldwide, SimSpace enables adaptive, AI-ready defenses that stay ahead of evolving threats. Founded in 2015 by experts from U.S. Cyber Command and MIT Lincoln Laboratory, the platform unifies training, testing, and validation in a realistic, live-fire simulation—helping teams evaluate security investments, optimize performance, and compress cyber readiness cycles from months to days.
Why join SimSpace? We are an organization that is focused on building our culture and mindfully enhancing our atmosphere every day which is why we have collaborated on an integral value system. Our governing philosophy of being Human Centered is deeply embedded within our value system. We apply this philosophy to every one of our internal team members, external clients, and their customers.
How Do We Work? We believe that people are at the center of everything we do. SimSpace fosters a culture of continuous learning, curiosity, and professional growth. That belief shows up in action: in-house training, internal and external learning platforms, cyber conferences, industry events, and dedicated time for skill development. Our people are empowered to shape their careers - and it shows. Year over year, SimSpace consistently outperforms industry benchmarks in internal mobility, promotions, and total rewards growth.
Who Thrives Here? We are a team of innovators, protectors, and problem-solvers. We believe diversity of thought and experience fuels better solutions, and we’re committed to building teams that reflect the communities we serve. Whether you’re remote or office-based, you’ll collaborate with talented colleagues across departments and time zones, united by the mission to create a safer digital world.
We invite you to apply today!
We are looking for a Senior Software Engineer to build the identity and trust infrastructure that brings SimSpace's internet simulation platform to life for the humans and automated systems operating within it.
This role owns interconnected systems: a unified persona registration API that provisions fully realized digital identities across both in-range Active Directory environments and simulated internet services; a Range Domain Controller management service that configures AD domains, users, and group policy on top of deployed range infrastructure; and a PKI and certificate authority stack that ensures in-range clients trust the simulated internet at the TLS layer.
This is a security-infrastructure role with significant API design responsibility, the right candidate understands identity systems deeply, can build robust APIs that handle partial failure gracefully, and knows how to stand up and operate a home-grown certificate authority.
A unified persona registration API: the single interface through which user emulation and scenario orchestration services provision fully realized range personas, creating AD accounts, configuring group memberships and privilege levels, and registering accounts across all configured simulated internet services in a single, idempotent operation
A Range Domain Controller management service: the API layer that configures Active Directory domains, organizational units, users, and group policy on the DC infrastructure deployed by the range orchestration team, this team owns everything above the baseline VM configuration
A PKI and certificate authority infrastructure: root CAs, intermediate CAs, certificate issuance pipelines, and the mechanisms by which in-range clients are configured to trust certificates issued for simulated internet domains
The GreySpace user API: account lifecycle management across the heterogeneous set of simulated internet services, including web platforms, FTP servers, SSH services, and mail infrastructure.
Design and build the unified persona registration API — the interface that accepts a persona definition and fans out to provision an account in real and simulated cloud services, configure group memberships and OUs, and create accounts on all relevant simulated internet services, handling partial failures idempotently and providing a consistent status model to callers
Build and maintain the Range Domain Controller management service: the API layer that drives AD configuration, creating users, assigning group memberships, configuring OUs and domain policies, and managing subdomain configuration for simulated organizations
Design and operate the PKI infrastructure: stand up a root CA and intermediate CA hierarchy, build certificate issuance pipelines that generate and sign certificates at domain provisioning time, and own the mechanism by which in-range clients on both Windows and Linux are configured to trust the platform CA chain
Own the GreySpace user API: account creation, deletion, elevation, and demotion across the full service catalog, ensuring consistency between in-range AD identity and internet-facing service accounts for each persona
Define and enforce the data model for range personas across all identity backends, AD schema, SSO federation, and per-service account state, and own the eventual consistency and reconciliation model when backends diverge
Collaborate with the user emulation team to ensure the persona registration API meets their orchestration requirements and supports the full range of persona complexity their scenarios require
Participate in design reviews and contribute to the broader platform architecture, particularly on topics of trust, authentication, and the security model for the internet simulation platform
Strong bilingual proficiency in English and Spanish skills required across written, virtual, and in-person interactions
Deep understanding of Active Directory: user and group provisioning, organizational unit design, Group Policy, Kerberos authentication, and domain and subdomain configuration
Experience automating AD configuration programmatically and building robust APIs on top of AD operations that handle the realities of a stateful, sometimes-slow directory service
Knowledge of AWS, GCP, and/or Azure identity management
Solid PKI knowledge: you understand the CA hierarchy model, certificate lifecycle management, CSR signing workflows, and how to configure client trust stores on both Windows and Linux
Strong REST API design instincts, particularly around idempotency, partial failure handling, and eventual consistency across heterogeneous backends, this API will be called by automated orchestration systems that cannot tolerate silent failures
Familiarity with enterprise identity providers and SSO systems as a consumer and integrator, the platform uses an existing SSO layer and this role needs to federate correctly with it without owning it
Experience with certificate management at operational scale, issuing certificates programmatically, managing expiration, and distributing trust anchors across a fleet
Familiarity with email authentication (SPF, DKIM, DMARC) is a plus, the email delivery model for the platform intersects with the domain and identity configuration this role owns
Experience in cybersecurity, red team infrastructure, or environments where identity and trust infrastructure is itself a target or a tool is a strong plus
We’re proud to offer a competitive and comprehensive package designed to support your well-being, growth, and success:
Compensation. Base monthly pay range: 1,500,000 CRC - 2,500,000 CRC reflecting our confidence in your expertise and impact, with the opportunity for annual bonuses tied to company performance and individual contributions.
• Health & Wellness. Private medical, dental, vision, and life benefits.
• Mental Health Support. Access to company-paid counseling, coaching, and resources for you and your family through Spring Health.
• Parental Leave. Paid leave plans to support you and your loved ones during life’s most important moments.
• Ownership Opportunities. Equity stock options at hire, with annual performance-based grants—become an invested stakeholder in our shared success.
• Continuous Learning. Access a LinkedIn Learning membership to prioritize your personal and professional development.
• Social Connections. Monthly reimbursements for meaningful connections with teammates through our SocialSpace Community.
SimSpace is an Equal Opportunity Employer:
In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification document form upon hire.
SimSpace is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, pregnancy, genetic information, disability, status as a protected veteran, or any other protected category under applicable federal, state, and local laws. We are committed to providing an inclusive and welcoming environment for all members of our staff, clients, volunteers, subcontractors, vendors, and clients.
Research shows that women and people from underrepresented groups only apply to jobs if they meet all of the qualifications. However, no one ever meets 100% of the qualifications. SimSpace encourages you to break that statistic and to apply. We look forward to your application!
We also consider qualified applicants regardless of criminal histories, in accordance with applicable law. We are committed to providing reasonable accommodations for qualified individuals with disabilities in our job application procedures. If you need assistance or accommodation due to a disability, please contact careers@simspace.com.
SimSpace does not accept unsolicited resumes from employment agencies.
Actual compensation for the position is based on a variety of factors, including, but not limited to affordability, skills, qualifications and experience, and may vary from the range.
