Senior Security Engineer

This is a fully remote position, open to applicants in United States, +1 more country.

📋 Description

• Take charge of the security architecture for the bare-metal GPU fleet, Sonic Inference Pods, managed Kubernetes clusters, and cross-pod control plane.

• Develop and execute strategies for host hardening, immutable images, signed build pipelines, boot integrity, identity management, secrets, and access controls.

• Design and validate multi-tenant isolation across network, Kubernetes, host, and GPU layers, while producing evidence that demonstrates this isolation.

• Strengthen the managed Kubernetes offering through cluster hardening, admission control, RBAC, image supply-chain controls, and providing auditable customer handover.

• Establish fleet-wide logging, detection, alerting, and audit trails from firmware to API, integrated with dashboards and on-call systems.

• Lead security assessments and threat modeling for new pods, sites, servers, and platform features.

• Oversee infrastructure incident response, which includes investigation, containment, recovery, and post-incident analysis.

• Manage vulnerability across firmware, kernels, drivers, GPU stack, and container images across thousands of nodes.

• Address enterprise customer security due diligence with engineering evidence and collaborate with the CISO on SOC 2 and ISO 27001 infrastructure controls.

• Design sovereign and on-premise deployments, ensuring data residency, in-country key management, and both physical and remote-access controls.

• Leverage AI agents to automate evidence collection, log triage, configuration audits, and runbooks.

• Work closely with the CISO, inference engine, platform, hardware, and site-deployment teams.

⛳️ Requirements

• 8+ years of experience in security or infrastructure engineering, particularly with securing production infrastructure at a company that operates its own hardware at scale.

• Proven history of building and deploying security controls across a fleet rather than merely auditing them.

• Extensive, up-to-date, practical knowledge of Linux security: kernel hardening, namespaces and cgroups, seccomp, eBPF, secure and measured boot, TPM-based attestation, and process activity analysis tools.

• Strong expertise in Kubernetes security: RBAC, admission control and policy engines, network policy, runtime security, image signing, SBOMs, and container escape risks.

• Knowledge in network security for physical hardware: segmentation, VLAN or VXLAN isolation, firewalls, out-of-band management networks, BMC, IPMI, and switch management planes.

• Experience with identity, secrets, and PKI at scale, including the use of short-lived credentials, workload identity, hardware-backed keys, and eliminating standing access.

• Proficiency in Python or Go and capability to create tools, scanners, and automation scripts.

• Regularly utilize AI for scripting, log analysis, code review, documentation, and incident triage.

• Exhibit clear communication skills and a practical approach to risk assessment.

• Willingness to travel to sites in the US and Europe as required.

• Nice to have: security for GPU clusters, experience with NVIDIA driver and fabric manager stack, GPU multi-tenancy, confidential GPU computing, model-weight protection, firmware and hardware security, InfiniBand or RoCE, SOC 2 or ISO 27001, offensive security, sovereign or regulated deployments, and physical data-center or edge-site security.

🏝️ Benefits

• Meaningful stock options.

• Remote-first work arrangement.

• In-person meetings held twice a year.

• Core hours designated for collaboration and calls, with a flexible schedule outside of those hours.

• Generous paid time off, including vacation, sick days, and public holidays.

• Paid maternity, paternity, and caregiver leave.

• Company retreats held twice a year in inspiring locations.