Senior Security Engineer

Runware

2d • Remote

About The Position

Runware is hiring a hands-on senior individual-contributor to own security across its AI supercomputer: the bare-metal GPU fleet, Sonic Inference Pods, managed Kubernetes clusters, and the control plane connecting deployments in the US and Europe. The engineer will design security controls, implement their initial versions, and establish standards across every pod, working directly with the CISO and inference, platform, hardware, and site teams.

The role includes threat-modeling new deployments, hardening GPU node images, verifying customer workload isolation, and leading infrastructure incident response. The goal is to secure customer models, data, and infrastructure without slowing down engineering or customers. The role also supports enterprise security reviews and sovereign and on-premise deployments.

Requirements

• At least 8 years in security or infrastructure engineering, including several years securing production infrastructure at a company operating its own hardware at scale.
• Demonstrated experience building and deploying security controls, such as hardening standards, access models, or detection pipelines, across a fleet.
• Current, hands-on Linux security expertise, including kernel hardening, namespaces and cgroups, seccomp, eBPF, secure and measured boot, TPM-based attestation, and process investigation tooling.
• Strong Kubernetes security expertise, including RBAC, admission control and policy engines, network policy, runtime security, image signing, SBOMs, and container escape risks.
• Network security experience on physical hardware, including segmentation, VLAN or VXLAN isolation, firewalls, out-of-band management networks, and BMC, IPMI, and switch-management risks.
• Experience with identity, secrets, and PKI at scale, including short-lived credentials, workload identity, hardware-backed keys, and removing standing access.
• Fluency in Python or Go and ability to write security tooling, scanners, and automation.
• Daily use of AI to accelerate work such as scripting, log analysis, code review, documentation, and incident triage, with a clear view of how these tools can change small-team security operations.
• Clear communication skills and a pragmatic approach to risk.
• Ability to travel to sites in the US and Europe as needed.

Nice To Haves

• Experience securing GPU clusters for AI training or inference, including NVIDIA drivers and fabric manager, GPU multi-tenancy, confidential GPU computing, and protection of model weights at rest and in flight.
• Firmware and hardware security experience, including UEFI, BMC and NIC firmware lifecycle, Redfish, hardware roots of trust, and server supply-chain attestation.
• Hands-on experience with InfiniBand or RoCE fabrics and RDMA security.
• Experience delivering SOC 2 or ISO 27001 in production, including compliance tooling and evidence automation.
• Offensive security experience, such as red teaming, penetration testing, or infrastructure vulnerability research.
• Experience with sovereign, air-gapped, or regulated deployments, including cross-jurisdiction data residency.
• Physical security experience for data centres or edge sites, including access control, tamper evidence, and remote-hands procedures.

Responsibilities

• Own fleet security architecture, including bare-metal host hardening, immutable images, signed builds, boot integrity, and identity, secrets, and access controls for humans and services.
• Design and verify multi-tenant isolation across network, Kubernetes, host, and GPU layers, and produce evidence demonstrating that isolation.
• Secure managed Kubernetes clusters through hardening, admission control, RBAC, image supply-chain controls, and auditable customer handover.
• Build fleet-wide logging, detection, alerting, and audit trails from firmware through APIs, integrated with dashboards and on-call processes.
• Lead security reviews and threat models for pods, sites, servers, and platform features.
• Lead infrastructure incident investigation, containment, recovery, and post-incident learning as part of the on-call rotation.
• Manage vulnerabilities across firmware, kernel, drivers, GPU stack, and container images, maintaining a defensible patch cadence.
• Provide engineering evidence for enterprise customer security reviews and partner with the CISO on infrastructure-related SOC 2 and ISO 27001 controls.
• Design security for sovereign and on-premise deployments, including data residency, in-country key management, and physical and remote-access controls.
• Use AI-based agents to automate evidence collection, log triage, configuration audits, and runbooks.

Benefits

• Meaningful stock options.
• Remote-first work arrangement, with in-person meetings twice a year.
• Core hours for collaboration and calls, with flexibility to set the schedule outside those hours.
• Real downtime following fast and intense release cycles.
• Generous paid time off, including vacation, sick days, and public holidays.
• Paid maternity, paternity, and caregiver leave.
• Twice-yearly company retreats in inspiring locations.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed