Cybersecurity Engineer (Research Infrastructure)

MATS Research • Berkeley, CA

44d • £155,000 - £220,000 • Hybrid

About The Position

The Cybersecurity Engineer will define and implement security for MATS’s research pipeline, compute cluster, cloud environments, CI/CD systems, automated research agents, and model artefacts. The role focuses primarily on research and infrastructure security, though initial responsibilities may also span IT security until another engineer joins. The goal is to enable fast-paced research while protecting against data leakage, supply-chain compromise, model exfiltration, and lateral movement.

The engineer will harden DevSecOps workflows and infrastructure as code; secure the software supply chain; define sandboxing and least-privilege models for research agents; and own security architecture across cloud providers and the SLURM research cluster. The role also covers research data and model-weight protection, monitoring and detection, and incident response for cluster, CI/CD, and model-artefact incidents. The engineer will work with researchers, compute teams, engineers, AI labs, and external incident-response partners to build security controls that support research and frontier-lab partnerships.

The position is based primarily in person at the Berkeley or London office, with hybrid arrangements possible for exceptional candidates. The schedule is 40 hours per week.

Requirements

• Deep Linux systems-security experience on multi-user or HPC infrastructure, including kernel and OS hardening, privileged access, host isolation, and host-based detection.
• Fluency with Terraform and CI/CD systems such as GitHub Actions or GitLab CI, including writing infrastructure as code that enforces a security model.
• Experience securing cloud-native environments in AWS, GCP, and/or neoclouds, including ephemeral, high-compute workloads.
• Hands-on experience operating and securing an HPC scheduler; the cluster uses SLURM.
• Ability to threat-model against sophisticated adversaries and build robust systems.
• Pragmatic experience or capability in software supply-chain security and the risks of AI-driven, agent-assisted development.
• Ability to explain security trade-offs to researchers and leadership and identify safe ways to enable work.
• Experience designing sandboxing and least-privilege execution for agent-driven or automated workloads.

Nice To Haves

• Experience with model registries such as MLflow or Weights & Biases; container and dependency scanners such as Snyk or Trivy; policy-as-code such as OPA; supply-chain tools such as Sigstore or cosign; or SBOM generators.
• Experience handling model weights and classifying sensitive or dual-use research artefacts.
• A background combining infrastructure engineering and security.
• Genuine interest in MATS’s mission and motivation by its work; AI safety expertise is not required.
• Experience with strongly segmented or air-gapped model-weight handling, hardware security modules, or FIPS-validated cryptographic controls.
• Experience conducting continuous threat hunting or red-team exercises against cloud and cluster infrastructure, or designing compartmentalized research environments with separately credentialed boundaries.
• Kubernetes experience.

Responsibilities

• Harden DevSecOps and CI/CD pipelines with automated scanning, verification, compliance, and security-policy checks, including workflows for agents to test changes before production.
• Implement compliance as code to audit and enforce security configurations across AWS, GCP, neocloud environments, and Terraform infrastructure.
• Establish and harden the research-code source-control environment, including secret, dependency, and code scanning, branch protections, and short-lived CI-issued cloud credentials.
• Secure the software supply chain through code and dependency provenance, signing, SBOM generation, scanning, and vulnerability management.
• Define security models for research agents, including sandboxing, isolation, and least-privilege access to cluster resources, sensitive intellectual property, and credentials.
• Own security architecture across cloud providers and the research cluster, including zero-trust network segmentation, role-based access control, FIDO, cluster identity, cohort access lifecycle, and policy as code where appropriate.
• Design the security of MATS’s unified model and compute access layer across providers.
• Harden Linux operating systems and nodes across the SLURM cluster, including kernel and CVE patching, sudoers/PAM privileged-access controls, multi-tenant isolation, and host-based detection.
• Develop and maintain data-handling and classification protocols for pre-publication research and potentially sensitive model weights, including storage, access, and transfer controls.
• Design end-to-end security controls for research-data infrastructure, including classification and provenance, shared-dataset access controls, privacy and consent handling, and secure adoption of tools built with research partners.
• Implement audit-log ingestion to SIEM, anomaly detection for identity and workload behavior, and egress monitoring across the cluster and unified access layer.
• Partner with AI labs on security audits and help meet frontier model providers’ requirements for sensitive partnerships.
• Lead cluster-side incident response, maintain cluster-specific playbooks, coordinate with the IT Security Engineer on cross-cutting incidents, conduct tabletop exercises, and work with the external incident-response retainer firm.
• Explain security trade-offs to researchers and leadership and enable research to proceed safely.

Benefits

• In-office catered lunches and dinners on workdays.
• Paid work trips, including staff retreats, business trips, and relevant conferences.
• Funding and support for professional development.
• Flexible PTO for Berkeley-based employees.
• Flexibility for hybrid work; fully remote work is not available.
• Medical, dental, vision, and life insurance.
• Pension scheme for London-based candidates, or Roth and Traditional 401(k) plans for Berkeley-based candidates.
• Visa sponsorship for exceptional candidates where feasible.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed