Systems Security Engineer
Blacksmith1 day ago
Base Salary
$225k - $300k/yr
Responsibilities
- Identify, prioritize, and remediate security risks across the bare-metal fleet, AWS control plane, application services, and broader organization.
- Strengthen tenant isolation, host hardening, network boundaries, and access controls.
- Build and operate automated controls for secure configuration, vulnerability remediation, intrusion detection, and response.
- Investigate security incidents and drive remediation through completion.
- Partner with engineering and IT to establish secure defaults and practical security standards while balancing security, reliability, and usability.
Requirements
- Strong Linux systems experience, including debugging production issues across the kernel, networking, and storage stack.
- Practical understanding of least privilege, defense in depth, threat modeling, and translating risks into technical solutions.
- Experience with Firecracker, KVM, namespaces, cgroups, and Linux isolation and virtualization security boundaries.
- Understanding of storage access controls, tenant isolation, and secure data deletion.
- Understanding of eBPF for runtime security monitoring of process, file, and network activity.
- Experience securing production AWS environments, especially IAM, networking, and audit logging.
- Ability to write and debug production code in Go, Rust, C, C++, or similar languages, and automate security changes through configuration management and infrastructure as code.
- Comfort with agent-driven development and debugging, including directing coding agents, reviewing changes, and validating correctness and security.
- Ability to own ambiguous engineering problems through implementation and production rollout and explain technical tradeoffs to technical and non-technical partners.
- Candidates may come from security engineering, systems engineering, or SRE backgrounds and should have strong systems fundamentals and demonstrated interest in infrastructure security.
- Bonus qualifications include CVE research, container or VM escape research, CTF participation, securing multi-tenant infrastructure, building eBPF detection tooling, securing software delivery pipelines, operating Ceph or MinIO, and securing macOS infrastructure.
Benefits
- Medical, vision, and dental insurance.
- Competitive base salary and equity.
- 401(k) match.
- Unlimited paid time off.
- Annual offsite.
- Early-exercise stock options.
- 12 weeks of fully paid parental leave in the US.
About Blacksmith
The fastest way to run your GitHub Actions, all at half the cost. Trusted by Ashby, Supabase, VEED, and 1000+ others.