Software Engineer, Security

Exa•San Francisco, CA

10d•$180,000 - $350,000•Onsite

About The Position

Exa is hiring a Security Engineer to build protective safeguards for its systems, which process web-scale data, index hundreds of billions of pages, train foundational models on terabytes of data, and serve enterprise customers through its endpoints. The role is critical to keeping Exa secure while maintaining shipping velocity. This is an in-person opportunity in San Francisco. Exa is willing to sponsor international candidates, including those eligible for STEM OPT, OPT, H1B, O1, and E3.

Requirements

Hands-on experience building and maintaining secure infrastructure.
Knowledge of cloud security fundamentals, including multi-account AWS permissions and architectures, IAM design, and secure CI/CD pipelines.
Fluency in secrets management, key management, and certificate lifecycles, including rotation, revocation, and automation.
Experience owning compliance efforts such as HIPPA or SOC2.
Comfort with security hardening and operational details such as VPNs and development servers.
Vigilance about vulnerabilities, potential attacks, and abuse, and attention to secure operation when adopting new technologies.

Responsibilities

Build and maintain secure infrastructure.
Support cloud security, including multi-account AWS permissions and architectures, IAM design, and secure CI/CD pipelines.
Manage secrets, keys, and certificate lifecycles, including rotation, revocation, and automation.
Own compliance efforts such as HIPPA or SOC2.
Harden engineering systems and support secure operations, including VPNs and development servers.
Monitor for vulnerabilities, potential attacks, and abuse, and consider secure operation when introducing new technologies, including OS-level technologies and AI coding agents.
Build a secrets management and rotation system for distributed services, training jobs, and GPU clusters without reducing developer velocity.
Build monitoring and alerting for anomalous behavior across APIs, internal services, and customer usage.
Create security incident response playbooks and lead incident handling from detection through post-mortem.