Systems Security Engineer

The role

You will build and operate security controls for a bare-metal fleet, AWS control plane, and application services. You will work with systems engineers to harden production systems, strengthen workload isolation, and investigate security issues.

What you will do

• Identify, prioritize and remediate security risks across the bare-metal fleet, AWS control plane, application services and the broader organization.
• Strengthen tenant isolation, host hardening, network boundaries and access controls.
• Build and operate automated security controls for configuration, vulnerability remediation, intrusion detection and response.
• Investigate and respond to security incidents.
• Partner with engineering and IT to establish secure defaults and practical security standards.

Required qualifications

• Strong Linux systems experience to debug production issues across the kernel, networking and storage stack.
• Practical understanding of security fundamentals including least privilege, defense in depth and threat modeling.
• Experience with virtualization and Linux isolation primitives such as Firecracker, KVM, namespaces and cgroups.
• Understanding of storage access controls, tenant isolation and secure data deletion.
• Understanding of how to use eBPF for runtime security monitoring.
• Experience securing production AWS environments, particularly IAM, networking and audit logging.
• Ability to write and debug production code in Go, Rust, C, C++ or similar.
• Ability to automate security changes through configuration management and infrastructure as code.
• Strong comfort with agent-driven development and debugging.
• Track record of turning ambiguous problems into practical engineering solutions and owning implementation through production rollout.

Nice to have

• Found or reported CVEs, done container or VM escape research, or competed in CTFs.
• Secured multi-tenant infrastructure running untrusted workloads.
• Built or extended eBPF-based detection tooling.
• Secured software delivery pipelines.
• Operated or secured distributed storage systems such as Ceph or MinIO in production.
• Secured macOS infrastructure running untrusted workloads.

Benefits

• Medical, Vision, and Dental insurance.
• Competitive base + equity.
• 401K match.
• Unlimited PTO.
• Annual offsite.
• Early-exercise stock options.
• 12 weeks fully paid parental leave (US).

About the company

Blacksmith builds infrastructure to run CI workloads using a global fleet of bare-metal machines. They orchestrate tens of millions of Firecracker VMs each week for over 10,000 companies.