MTS - Security Engineer

Ironsite AI•San Francisco, CA

3h•$230,000 - $280,000•Onsite

About The Position

Ironsite is hiring its first Security Engineer to own security across the company’s wearable camera fleet and jobsite networks, petabyte-scale video and ML systems, cloud infrastructure, customer platform, and AI agents. The role protects sensitive first-person footage of workers and critical infrastructure construction sites, while enforcing the commitment that raw video never leaves the system. The Security Engineer will build and operate security capabilities across the software supply chain, incident response, devices and firmware, privacy architecture, networks, cloud and ML platforms, applications, and AI agents. This includes maintaining a decision-ready software bill of materials from silicon through models; assessing real exposure and coordinating rapid remediation; securing devices that may be offline for days; and establishing controls for identity, access, deployment provenance, tenant isolation, and production data. The position requires practical security engineering across multiple technical domains, applied cryptography and PKI, sound threat modeling, and incident response experience. The engineer will build adopted guardrails into CI and infrastructure as code and help a small team keep pace with vulnerabilities through automation, including agent-assisted security practices. The role is based on-site in the San Francisco Bay Area.

Requirements

Hands-on experience with supply chain security, including SBOMs such as CycloneDX and ML-BOM/CBOM, reachability-aware vulnerability management, build and deploy provenance, dependency firewalls, and upstream incident response.
Security engineering depth in at least two of the following: embedded/IoT, networks, cloud, and application security.
Applied cryptography and PKI experience, including device identity, key management, certificate lifecycles, trust stores, and responding to CA compromise.
Strong threat-modeling judgment and real incident response experience, including distinguishing false positives from breaches under pressure.
A record of building security controls that engineers adopt, such as CI and infrastructure-as-code guardrails rather than ticket-based processes.
Typically 4 or more years of experience, including 1–2 years at a senior level.
A computer science or related degree, or equivalent experience.

Nice To Haves

Production experience with artifact attestations and trusted publishing, such as in-toto, Sigstore/cosign, or GitHub attestations; VEX; and CI/CD hardening including OIDC, pinned actions, and runner egress control.
Experience using AI agents for defensive security tasks such as triage, code review, or vulnerability discovery, and securing agents through permissions, sandboxing, and prompt-injection defenses.
End-to-end hardware security experience, including secure boot, secure elements, and OTA updates.
Privacy engineering experience involving video or biometric data.
Offensive security or hardware security experience.
Experience running compliance programs such as SOC 2, ISO 27001, or GDPR as engineering work rather than paperwork.

Responsibilities

Own security across the wearable camera fleet, jobsite networks, firmware, cloud, ML systems, customer platform, and AI agents.
Maintain a living software bill of materials spanning firmware, edge devices, cloud, ML, and laptops, and manage vendor risk.
Assess the impact of upstream compromises across containers, CI runners, hosts, devices, and engineer laptops; coordinate fixes for cloud systems and devices that may be offline.
Secure devices and firmware through measures such as secure boot, signed over-the-air updates, hardware-backed identity, and encryption.
Enforce worker anonymization and the no-raw-video guarantee through system design and audits.
Secure jobsite and overlay networks, cloud and ML platforms, and access to video, model weights, and production data using zero-trust and least-privilege controls.
Build auditable infrastructure as code and detection and triage capabilities across the device fleet and cloud.
Secure API tenant isolation and authorization, and harden AI agents and automation that access code, tooling, or production systems.
Develop vulnerability-management automation that prioritizes deployed and reachable components and supports patching offline devices.
Threat-model cameras in uncontrolled physical environments and build effective alerting and revocation processes.
Integrate security guardrails into CI and infrastructure as code, and make agent-assisted code review and penetration testing part of the software delivery process.