Systems Security Engineer

Responsibilities

• Identify, prioritize, and remediate security risks across the bare-metal fleet, AWS control plane, application services, and broader organization.
• Strengthen tenant isolation, host hardening, network boundaries, and access controls.
• Build and operate automated controls for secure configuration, vulnerability remediation, intrusion detection, and response.
• Investigate security incidents and drive remediation through completion.
• Partner with engineering and IT to establish secure defaults and practical security standards while balancing security, reliability, and usability.

Requirements

• Strong Linux systems experience, including debugging production issues across the kernel, networking, and storage stack.
• Practical understanding of least privilege, defense in depth, threat modeling, and translating risks into technical solutions.
• Experience with Firecracker, KVM, namespaces, cgroups, and Linux isolation and virtualization security boundaries.
• Understanding of storage access controls, tenant isolation, and secure data deletion.
• Understanding of eBPF for runtime security monitoring of process, file, and network activity.
• Experience securing production AWS environments, especially IAM, networking, and audit logging.
• Ability to write and debug production code in Go, Rust, C, C++, or similar languages, and automate security changes through configuration management and infrastructure as code.
• Comfort with agent-driven development and debugging, including directing coding agents, reviewing changes, and validating correctness and security.
• Ability to own ambiguous engineering problems through implementation and production rollout and explain technical tradeoffs to technical and non-technical partners.
• Candidates may come from security engineering, systems engineering, or SRE backgrounds and should have strong systems fundamentals and demonstrated interest in infrastructure security.
• Bonus qualifications include CVE research, container or VM escape research, CTF participation, securing multi-tenant infrastructure, building eBPF detection tooling, securing software delivery pipelines, operating Ceph or MinIO, and securing macOS infrastructure.

Benefits

• Medical, vision, and dental insurance.
• Competitive base salary and equity.
• 401(k) match.
• Unlimited paid time off.
• Annual offsite.
• Early-exercise stock options.
• 12 weeks of fully paid parental leave in the US.