Systems Security Engineer

Description

The company runs CI workloads for GitHub Actions users, faster and cheaper than generic cloud VMs, by owning and operating its own global fleet of bare-metal machines.

It orchestrates tens of millions of Firecracker VMs each week for more than 10,000 companies, with tens of millions in ARR and 20x growth so far in 2026.

The fleet spans thousands of bare-metal machines across multiple regions, regularly schedules 300k+ vCPUs at once, and includes a petabyte-scale Ceph cluster the company manages itself.

The company has raised $125M from Seed to Series C, led by Sequoia, Google Ventures (GV) and Peak XV Partners, and is keeping the team small and high-caliber.

The company is extending this CI infrastructure into a wider platform that runs agent sandboxes at scale and builds its own background coding agent.

Responsibilities

• Protect the bare-metal fleet first, then the AWS control plane, application services and the wider organization, by finding, ranking and fixing security risks.
• Work with systems engineers on hands-on hardening of production systems, tighter workload isolation, and investigation and fixes for security issues.
• Work with the Security Lead to turn security priorities into concrete engineering tasks.
• Make tenant isolation, host hardening, network boundaries and access controls stronger across the platform.
• Build and run automated controls for secure configuration, vulnerability fixes, and intrusion detection and response, and check they work without hurting production reliability or performance.
• Lead security incidents from investigation through to completed remediation.
• Work with engineering and IT to set secure defaults and workable standards for systems and daily workflows, weighing security against reliability and ease of use.

Requirements

• Solid Linux skills, including debugging production problems across the kernel, networking and storage.
• Working knowledge of security basics such as least privilege, defense in depth and threat modeling, and the ability to turn risks into technical fixes.
• Hands-on experience with virtualization and Linux isolation tools such as Firecracker, KVM, namespaces and cgroups, including their security limits and trade-offs.
• Understanding of storage access control, tenant isolation and secure data deletion.
• Understanding of eBPF for runtime security monitoring, watching process, file and network activity to spot suspicious behavior.
• Experience securing production AWS environments, especially IAM, networking and audit logging.
• Ability to write and debug production code in Go, Rust, C, C++ or similar, and to automate security changes with configuration management and infrastructure as code.
• Comfort directing coding agents, reviewing their changes, and checking that their output is correct and secure.
• A record of turning unclear problems into working engineering solutions, taking them through to production, and explaining trade-offs to engineers, leaders and non-technical colleagues.
• Candidates from security engineering, systems engineering or SRE backgrounds are welcome. Strong systems fundamentals and a real interest in securing the infrastructure you run are essential.
• Optional: CVE discovery or reporting, container or VM escape research, or CTF competition.
• Optional: experience securing multi-tenant infrastructure that runs untrusted workloads, such as CI runners, cloud compute or agent sandboxes.
• Optional: experience building or extending eBPF-based detection tooling that turns runtime telemetry into actionable alerts and investigations.
• Optional: experience securing software delivery pipelines, including build isolation, artifact signing, image provenance or secrets handling.
• Optional: experience operating or securing distributed storage such as Ceph or MinIO in production.
• Optional: experience securing macOS infrastructure that runs untrusted workloads.

Conditions

Medical, vision and dental insurance.

Competitive base salary plus equity.

401(k) with company match.

Unlimited paid time off.

Annual company offsite.

Early-exercise stock options.

12 weeks of fully paid parental leave in the US.

Benefits

• Medical, vision and dental insurance.
• Competitive base salary plus equity.
• 401(k) with company match.
• Unlimited paid time off.
• Annual company offsite.
• Early-exercise stock options.
• 12 weeks of fully paid parental leave in the US.