Senior Infrastructure Security Engineer

fal • San Francisco, CA

1d

About The Position

fal is hiring a Senior Infrastructure Security Engineer to secure the foundation of its compute platform. The role owns security below the application layer, including the Linux kernel, hypervisors and workload-isolation sandboxes, GPU drivers and firmware, and the hosts running them. The engineer will harden the stack, strengthen isolation against untrusted code, and help make GPU compute safe at scale. Proficiency in building with and using AI is central to the role.

Requirements

• Use LLMs, agents, and AI coding tools daily to review code, build tooling, and accelerate vulnerability research.
• At least 5 years in systems or security engineering, with deep hands-on work in the Linux kernel, hypervisors, or device drivers.
• Fluency in kernel C and comfort with Rust, Go, or Python for tooling.
• Strong understanding of virtualization internals, including KVM, VFIO, IOMMU/DMA protection, and tradeoffs between containers, sandboxes, and microVMs.
• Experience shipping hardening that runs in production at fleet scale.
• Experience finding, triaging, or fixing real vulnerabilities in low-level code, with the ability to explain the exploit path.
• Ability to communicate risk clearly to audiences ranging from kernel engineers to executives.

Nice To Haves

• NVIDIA GPU stack experience, including open kernel modules, GSP firmware, MIG, vGPU, or GPU confidential computing.
• Broader confidential computing experience, including AMD SEV-SNP, Intel TDX, or attestation.
• Published CVEs, talks, or write-ups on kernel or hypervisor security.
• Prior work at a GPU cloud, hyperscaler, or chip vendor.

Responsibilities

• Build and maintain the threat model for running code on shared GPU hosts, from containers and microVMs down to PCIe, IOMMU, and GPU passthrough.
• Design and verify GPU memory and device-state scrubbing between tenants.
• Help roll out hardware-backed isolation where appropriate, including confidential computing and attestation.
• Harden kernel builds and host images through configuration minimization, LSMs, seccomp, namespace and cgroup policy, and secure and measured boot.
• Reduce the attack surface in GPU drivers, CUDA runtimes, NVLink/NVSwitch fabrics, BMC, and firmware.
• Assess and triage vulnerabilities in the kernel, hypervisors, GPU drivers, and firmware; evaluate exploitability and environmental impact, set severity, and drive fixes or mitigations.
• Track vendor bulletins and upstream disclosures, and run kernel and driver patching that keeps pace without disrupting the fleet.
• Conduct vulnerability research on components the company depends on.
• Contribute to the host and isolation security roadmap and evaluate tooling.
• Partner with Detection & Response on telemetry and act as the escalation point for host, kernel, and driver incidents.
• Review designs from Infrastructure, Platform, and ML teams and help make the secure path the default.
• Work with GPU vendors, cloud providers, and upstream maintainers on disclosure and fixes.

Benefits

• Visa sponsorship and relocation assistance to San Francisco.
• Health, dental, and vision insurance in the U.S.
• Regular team events and offsites.
• Equity and a comprehensive benefits package.
• Interesting and challenging work.
• Learning and growth opportunities.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed