Security Engineer, Exposure and Vulnerability Management
Fluidstack · San Francisco, CA
About this role
## About Fluidstack We exist to make humanity more free. Powerful AI will be the biggest lever for human choice—but only if models are aligned with what humanity actually wants. Fluidstack builds **civilization-scale AI compute infrastructure**, designing, acquiring, and operating data centers with speed and scale as key differentiators. ## Security Team (Why this matters) - **Secure the frontier of AI:** model weights training on our infrastructure are among the most valuable and targeted artifacts in technology. - **Build the security program from scratch:** own it end-to-end, from bare metal to boardroom, as we scale across continents. - **Threat surface measured in gigawatts:** customers run the most consequential technology in human history—your work protects the physical and logical security of that effort. ## Role Scope — Exposure & Vulnerability Management You will own exposure and vulnerability management across the estate, including: - **External attack surface** - **Cloud and Kubernetes** - **Corporate endpoints** - **Network infrastructure** - **Bare-metal fleet** You’ll also extend coverage across the corporate fleet: - **macOS, Windows, Linux** - OS and application patch posture - First-party and third-party software - Drift from approved baselines Additional coverage areas: - Software outside managed/approved catalogs (unmanaged apps and SaaS) - Package-level software on endpoints (e.g., **npm, PyPI, Homebrew**) - **Browser and IDE extensions** You’ll build the engineering that makes it work: - Asset inventory - Scanner orchestration - Deduplication and prioritization - Prioritization grounded in **reachability and real-world exploitation** (not just raw CVSS) You’ll engineer remediation into existing workflows: - Findings land as owned tickets - Fixes ride existing pipelines - Closure verifies automatically You’ll remediate alongside system owners: - Write patch PRs - Harden base images - Fix IaC modules - Ship configuration changes (not just request them) You’ll extend the program beyond where enterprise playbooks run out: - **BMC and device firmware** - **GPU drivers** - Host images at fleet scale - Long tail of data center equipment You’ll also: - Run intake for **pen test findings** and external reports - Report exposure honestly (what’s reachable, what’s exploited in the wild, what’s accepted and by whom) ## What We’re Looking For - Built vulnerability management as an **engineering problem** (pipelines, automation, integrations—not spreadsheet triage) - Production-quality automation (Python or similar) integrating scanners, asset systems, and ticketing - Prioritization that survives reality using **KEV, EPSS, reachability**, and sound judgment - You’ve fixed vulnerabilities in real code/infrastructure and your PRs merged because they were good - Driven remediation at scale through teams that don’t report to you while keeping SLAs credible - Ability to stand up defensible assessment approaches for complex tech areas (e.g., firmware/GPU/data center equipment) - Experience covering corporate endpoints and third-party software, including the unmanaged “long tail” (shadow apps, packages, extensions) **Bonus** - External attack surface management platforms - Firmware/BMC security depth - CSPM/KSPM tooling - Exploit development or reachability validation - Endpoint management/patching tooling (MDM, EDR) - Software inventory and extension/supply chain risk ## How We Operate - **Be a barrel:** full autonomy, own
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.