Systems Security Engineer

Blacksmith operates a global platform orchestrating millions of Firecracker VMs and bare-metal machines for CI workloads. As a Systems Security Engineer, you will build and operate security controls across the bare-metal fleet, AWS control plane, and application services, working hands-on with systems engineers to harden production systems and investigate security incidents.

* Identify, prioritize and remediate security risks across bare-metal fleet, AWS control plane, application services and the broader organization * Strengthen tenant isolation, host hardening, network boundaries and access controls across the platform * Build and operate automated security controls for secure configuration, vulnerability remediation, intrusion detection and response * Investigate and respond to security incidents, driving remediation through to completion * Partner with engineering and IT to establish secure defaults and practical security standards across systems and workflows

* Strong Linux systems experience with ability to debug production issues across kernel, networking and storage stack * Practical understanding of security fundamentals including least privilege, defense in depth and threat modeling * Experience with virtualization and Linux isolation primitives such as Firecracker, KVM, namespaces and cgroups * Understanding of storage access controls, tenant isolation and secure data deletion * Ability to write and debug production code in Go, Rust, C, C++ or similar languages * Experience securing production AWS environments, particularly IAM, networking and audit logging * Understanding of eBPF for runtime security monitoring to detect suspicious behavior

* CVE discovery/reporting, container/VM escape research, or CTF competition experience * Experience securing multi-tenant infrastructure running untrusted workloads such as CI runners or agent sandboxes * Built or extended eBPF-based detection tooling for runtime telemetry and actionable alerts * Experience securing software delivery pipelines including build isolation, artifact signing and image provenance * Operated or secured distributed storage systems such as Ceph or MinIO in production * Secured macOS infrastructure running untrusted workloads