Identity & Trust Infrastructure - SSE

Senior Software Engineer, Identity & Trust
Infrastructure @ SimSpace

About the Role
You'll build the identity and trust infrastructure that brings SimSpace's internet-simulation platform
to life for the humans and automated systems operating inside it. The role owns interconnected
systems: a unified persona-registration API, a Range Domain Controller management service for
Active Directory, and a home-grown PKI / certificate-authority stack that lets in-range clients trust
the simulated internet at the TLS layer.
SimSpace is an AI Proving Ground for cybersecurity — a live-fire cyber range and simulation
platform trusted by allied governments, militaries, and Fortune 50 enterprises. Founded in 2015
by experts from U.S. Cyber Command and MIT Lincoln Laboratory, SimSpace lets organizations
train, test, and validate their defenses (and now their AI tools) in a safe, realistic environment,
with a new platform reaching general availability in August 2026.
Key Responsibilities
Design and build the unified persona-registration API — accept a persona definition and fan
out to provision AD accounts, group memberships, and OUs, plus accounts across all
simulated internet services, handling partial failures idempotently with a consistent status
model.
Build and maintain the Range Domain Controller management service: AD users, group
memberships, OUs, domain policy, and subdomain configuration for simulated
organizations.

Design and operate the PKI: stand up a root + intermediate CA hierarchy, build certificate-
issuance pipelines, and own how Windows and Linux in-range clients are configured to trust

the platform CA chain.
Own the GreySpace user API: account create / delete / elevate / demote across the
simulated-service catalog, keeping AD identity and service accounts consistent per
persona.
Define and enforce the persona data model across all identity backends and own the
eventual-consistency and reconciliation model when backends diverge.
Partner with the user-emulation team so the persona API meets their orchestration needs
and persona-complexity requirements.
Contribute to design reviews and the platform's trust, authentication, and security model.
Required Qualifications

Strong bilingual proficiency in English and Spanish across written, virtual, and in-person
interactions.
Deep Active Directory expertise: user/group provisioning, OU design, Group Policy,
Kerberos, and domain/subdomain configuration.
Experience automating AD programmatically and building robust APIs over stateful,
sometimes-slow directory operations.
Knowledge of AWS, GCP, and/or Azure identity management.
Solid PKI knowledge: CA hierarchy model, certificate lifecycle, CSR signing, and configuring
client trust stores on Windows and Linux.
Strong REST API design instincts — idempotency, partial-failure handling, and eventual
consistency across heterogeneous backends.
Familiarity with enterprise identity providers / SSO as a consumer and integrator.
Experience managing certificates at operational scale (programmatic issuance, expiration,
trust-anchor distribution).
Nice to Have
Familiarity with email authentication (SPF, DKIM, DMARC).
Experience in cybersecurity or red-team infrastructure, where identity and trust are
themselves a target or a tool.
Our Tech Stack
TypeScript, React, Postgres, Kotlin, Kubernetes, Spring Boot
Location & Work Setup
Remote-first, based in Costa Rica. SimSpace operates remote-first with no designated office;
occasional in-region team gatherings (roughly once every few months) may occur, and any
required travel is reimbursed. You'll collaborate with SimSpace's distributed teams (40+ U.S.
states and Costa Rica), so reliable overlap with U.S. time zones and strong English
communication are expected.
Engagement begins through an Employer of Record (EOR) and is planned to convert to
SimSpace's local Costa Rica entity (anticipated around August–September 2026), at which point
you become a full-time SimSpace employee.
Compensation & Benefits
Base salary. Competitive, level-based for a Senior Software Engineer (level 3) [exact USD
range and payment currency to be confirmed with SimSpace], with annual performance

bonuses tied to company and individual performance, plus eligibility for the corporate bonus
plan.
Equity. Stock options at hire, with annual performance-based grants.
Health & insurance. Company-paid private medical and life insurance premiums;
comprehensive medical, dental, and vision benefits.
Statutory. 13th-month payment (aguinaldo) per Costa Rican law.
Mental health. Company-paid counseling and coaching for you and your family via Spring
Health.
Parental leave. Paid leave plans.
Referral rewards. $1,500–$3,500 for every qualified referral hire.
Continuous learning. LinkedIn Learning membership.
Connection. Monthly SocialSpace community reimbursements for time with teammates.