Sr. Staff Security Engineer, Platform Security

Nscale•Houston, NY

2d•Remote

About The Position

About the Role We are hiring a Senior Staff Security Engineer as a founding member of Nscale's Platform Security program. Your job is to go deep on how our IaaS platform is actually built — not how the diagrams say it is built — and to perform the security reviews that tell leadership and customers where it holds, where it doesn't, and what it will take to close the gap. The scope is the infrastructure layer: the GPU compute platform, storage, virtual networking, and Kubernetes. Across each of these you'll map the architecture, define what secure looks like, review designs and implementations against that standard, test isolation boundaries, and produce assurance evidence. The estate spans bare-metal GPU infrastructure, Slurm/HPC scheduling, and Kubernetes. This is a hands-on assurance role. You will spend most of your time inside the platform — reading configuration, tracing data and control paths, breaking isolation assumptions, and working alongside platform, SRE, and infrastructure engineering to land fixes. You will have done this before, at a cloud services provider, where the platform was the product.

Requirements

12+ years in security engineering, platform/infrastructure engineering, or security architecture, with a deep platform security focus.
Experience at a cloud services provider — you have secured or assessed IaaS services where the platform was the product and tenants were untrusted by default.
Deep understanding of multi-tenant isolation across bare metal, hypervisors, container boundaries, and network segmentation — including what it takes to prove separation rather than assert it.
Hands-on knowledge of GPU or accelerator infrastructure: passthrough and partitioning, firmware and BMC management, and the failure modes of hardware reuse between tenants.
Strong grasp of storage security in a multi-tenant setting: encryption and key management, access-path control, and data lifecycle across snapshots, backups, and reuse.
Working knowledge of virtual networking: overlay/underlay design, segmentation, and management-plane separation.
Deep knowledge of Kubernetes and container internals, including runtimes, namespaces and cgroups, escape paths, admission control, and workload identity.
Proven ability to influence engineering organisations you don't manage, set standards, win arguments through evidence, and drive remediation without formal authority.
Comfortable operating with ambiguity and a founding-team mandate, creating the evidence base as you build the program.

Nice To Haves

Experience securing or assessing Slurm/HPC environments is a strong plus.

Responsibilities

Perform deep-dive security reviews of Nscale's IaaS services, one service at a time, producing a documented architecture, threat model, findings, and remediation plan for each.
Define the security requirements baseline for each service and review designs and implementations against it.
Prioritise findings by exploitability in our environment.
Advise leadership on what is known, verified, accepted, and required to close platform security gaps.
Review the bare-metal and virtualised GPU compute stack: host provisioning, hypervisor and GPU passthrough or partitioning, firmware and BMC management, and tenant reprovisioning.
Verify that a tenant cannot reach, persist on, or learn from hardware after their lease ends.
Assess the out-of-band management plane and its separation from tenant-reachable networks.
Review block, object, and file storage services for tenant data separation, encryption at rest and in transit, key management, and access-path control.
Verify snapshot, backup, and volume lifecycle handling — including secure deletion and reuse — across tenants.
Review the virtual network layer: overlay and underlay design, tenant segmentation, east-west controls, and the boundary between tenant networks and the management plane.
Test that segmentation holds under realistic tenant behaviour, not only under the design assumptions.
Review multi-tenant Kubernetes: admission control, workload identity, runtime and node hardening, network policy, and container escape paths.
Review Slurm/HPC scheduling for isolation between jobs and tenants, privilege boundaries, and node reuse.
Drive testing of isolation boundaries and gather evidence that demonstrates customer workloads are separated.
Partner with platform, SRE, and infrastructure engineering to land fixes and secure-by-default patterns.
Influence teams you don't manage without becoming their ticket queue.
Track control coverage and remediation trends so "secure" is a number, not a word.