22 hours ago
Base Salary
$180k - $250k/yr
Responsibilities
- Build and maintain threat models for shared GPU hosts, including containers, microVMs, PCIe, IOMMU, and GPU passthrough.
- Design and verify GPU memory and device-state scrubbing between tenants and help deploy confidential computing and attestation.
- Harden kernel builds and host images using configuration minimization, LSMs, seccomp, namespaces, cgroups, secure boot, and measured boot.
- Reduce attack surfaces in GPU drivers, CUDA runtimes, NVLink/NVSwitch fabrics, BMCs, and firmware.
- Assess, triage, and research vulnerabilities in kernels, hypervisors, GPU drivers, and firmware; determine exploitability and drive fixes or mitigations.
- Track vendor and upstream disclosures and manage kernel and driver patching across the fleet.
- Contribute to the host and isolation security roadmap, partner on telemetry and incident escalation, review infrastructure and ML designs, and coordinate with vendors and upstream maintainers.
Requirements
- 5+ years of systems or security engineering experience with deep hands-on work in the Linux kernel, hypervisors, or device drivers.
- Fluency in C for kernel development and comfort with Rust, Go, or Python for tooling.
- Strong understanding of KVM, VFIO, IOMMU/DMA protection, virtualization, containers, sandboxes, and microVMs.
- Experience shipping infrastructure hardening in production at fleet scale.
- Demonstrated ability to find, triage, or fix vulnerabilities in low-level code and explain exploit paths.
- Daily practical use of LLMs, agents, and AI coding tools for code review, tooling, and vulnerability research.
- NVIDIA GPU stack experience, including areas such as open kernel modules, GSP firmware, MIG, vGPU, or GPU confidential computing.
- Knowledge of confidential computing, including AMD SEV-SNP, Intel TDX, and attestation.
- Published CVEs, talks, or write-ups on kernel or hypervisor security are valued; GPU cloud, hyperscaler, or chip-vendor experience is also valued.
- Ability to communicate security risk clearly to kernel engineers and executives.
Benefits
- Visa sponsorship is offered, with relocation assistance to San Francisco.
- Health, dental, and vision insurance are provided in the US.
- Regular team events and offsites.
- Learning and growth opportunities.
- Compensation includes $180,000-$250,000 base salary plus equity and a comprehensive benefits package.
About fal
Fal builds a generative media platform that gives developers a unified API to run state-of-the-art image, video, and audio models. It provides serverless GPUs, high-performance inference, and dedicated compute clusters so teams can customize, deploy, and scale models in production. The company is privately held and headquartered in San Francisco, serving both startups and enterprises through a commercial API and managed infrastructure.