5-7 years of experience in systems security engineering or related fields.
Strong Linux systems experience with debugging capabilities across kernel, networking, and storage.
Practical understanding of security fundamentals like least privilege and defense in depth.
Experience with virtualization technologies and Linux isolation primitives.
Familiarity with eBPF for runtime security monitoring.
Proven ability to secure AWS environments, focusing on IAM and networking.
Proficiency in programming languages such as Go, Rust, C, or C++.
Responsibilities
Identify and remediate security risks across bare-metal and AWS environments.
Strengthen tenant isolation and access controls across the platform.
Build and operate automated security controls for configuration and vulnerability management.
Investigate and respond to security incidents, ensuring thorough remediation.
Collaborate with engineering and IT to establish secure defaults and standards.
Benefits
Medical, Vision, and Dental insurance.
401K match.
Unlimited PTO.
Annual offsite events.
Early-exercise stock options.
12 weeks fully paid parental leave (US).
Full Job Description
The role at Blacksmith
We are looking for a Systems Security Engineer to build and operate security controls at Blacksmith. Your primary focus will be our bare-metal fleet, with responsibility extending to our AWS control plane, application services and the broader organization.
This is a hands-on engineering role. You'll work alongside our systems engineers to harden production systems, strengthen workload isolation, and investigate and remediate security issues. You'll partner with our Security Lead to translate security priorities into engineering work.
What you'll be doing
Identify, prioritize and remediate security risks across our bare-metal fleet, AWS control plane, application services and the broader organization.
Strengthen tenant isolation, host hardening, network boundaries and access controls across our platform.
Build and operate automated security controls for secure configuration, vulnerability remediation, intrusion detection and response, validating their effectiveness without compromising production reliability or performance.
Investigate and respond to security incidents, driving remediation through to completion.
Partner with engineering and IT to establish secure defaults and practical security standards across systems and workflows, balancing security, reliability and usability.
You're a good fit if you have
Strong Linux systems experience, with the ability to debug production issues across the kernel, networking and storage stack.
A practical understanding of security fundamentals, including least privilege, defense in depth and threat modeling, and the ability to translate risks into technical solutions.
Experience with virtualization and Linux isolation primitives, such as Firecracker, KVM, namespaces and cgroups, and an understanding of their security boundaries and tradeoffs.
An understanding of storage access controls, tenant isolation and secure data deletion.
An understanding of how to use eBPF for runtime security monitoring, including observing process, file and network activity to detect suspicious behavior.
Experience securing production AWS environments, particularly IAM, networking and audit logging.
The ability to write and debug production code in Go, Rust, C, C++ or similar, and automate security changes through configuration management and infrastructure as code.
Strong comfort with agent-driven development and debugging, including directing coding agents, reviewing their changes and validating correctness and security.
A track record of turning ambiguous problems into practical engineering solutions, owning implementation through production rollout, and explaining technical tradeoffs to engineers, leadership and non-technical partners.
We welcome candidates from security engineering, systems engineering and SRE backgrounds. You should bring strong systems fundamentals and a demonstrated interest in securing the infrastructure you operate.
Bonus
You've found or reported CVEs, done container or VM escape research, or competed in CTFs.
You've secured multi-tenant infrastructure running untrusted workloads, such as CI runners, cloud compute or agent sandboxes.
You've built or extended eBPF-based detection tooling, turning runtime telemetry into actionable alerts and investigations.
You've secured software delivery pipelines, including build isolation, artifact signing, image provenance or secrets handling.
You've operated or secured distributed storage systems such as Ceph or MinIO in production.
