Systems Security Engineer
Blacksmith · New York City
About this role
**About Blacksmith** Blacksmith builds infrastructure to run CI workloads really fast. Our first product helps companies run GitHub Actions substantially faster and cheaper by operating our own global fleet of bare-metal machines instead of renting generic cloud VMs. Today, we orchestrate tens of millions of Firecracker VMs each week, running CI for 10,000+ companies. We operate thousands of bare-metal machines across multiple regions, schedule 300k+ vCPUs concurrently, and manage a petabyte-scale Ceph cluster. We’ve raised $125M (Seed to Series C) and are intentionally building a small, exceptional team. --- **Role: Systems Security Engineer** We’re looking for a **Systems Security Engineer** to build and operate security controls at Blacksmith. This is a **hands-on engineering** role focused primarily on our **bare-metal fleet**, with responsibility extending to our **AWS control plane**, **application services**, and the broader organization. You’ll work with systems engineers to harden production systems, strengthen workload isolation, and investigate/remediate security issues. You’ll partner with our Security Lead to translate security priorities into engineering work. --- **What you’ll be doing** - Identify, prioritize, and remediate security risks across our bare-metal fleet, AWS control plane, application services, and the broader organization. - Strengthen tenant isolation, host hardening, network boundaries, and access controls across the platform. - Build and operate automated security controls for secure configuration, vulnerability remediation, intrusion detection, and response—validating effectiveness without compromising production reliability or performance. - Investigate and respond to security incidents, driving remediation through to completion. - Partner with engineering and IT to establish secure defaults and practical security standards across systems and workflows, balancing security, reliability, and usability. --- **You’re a good fit if you have** - Strong **Linux systems** experience (debug production issues across kernel, networking, and storage stack). - Practical security fundamentals: **least privilege**, **defense in depth**, and **threat modeling**—turning risks into technical solutions. - Experience with virtualization and Linux isolation primitives (e.g., **Firecracker, KVM, namespaces, cgroups**) and understanding security boundaries/tradeoffs. - Understanding of storage access controls, tenant isolation, and secure data deletion. - Experience using **eBPF** for runtime security monitoring (process/file/network activity to detect suspicious behavior). - Experience securing **production AWS** environments (especially **IAM**, networking, and audit logging). - Ability to write and debug production code in **Go, Rust, C, C++**, or similar; automate security changes via configuration management and infrastructure as code. - Comfort with agent-driven development: directing coding agents, reviewing changes, and validating correctness and security. - Track record turning ambiguous problems into practical engineering solutions; owning rollout through production and communicating tradeoffs to engineers, leadership, and non-technical partners. **Backgrounds welcome:** security engineering, systems engineering, and SRE. --- **Bonus (nice to have)** - Found/reported CVEs, done container/VM escape research, or competed in CTFs. - Secured multi-tenant infrastructure running untrusted workloads (CI runner
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.