Systems Security Engineer

Blacksmith•New York, NY

6d•$225,000 - $300,000

About The Position

Blacksmith is seeking a hands-on Systems Security Engineer to build and operate security controls across its infrastructure. The primary focus is the bare-metal fleet, with responsibility also extending to the AWS control plane, application services, and the broader organization. The engineer will work alongside systems engineers to harden production systems, strengthen workload isolation, and investigate and remediate security issues, partnering with the Security Lead to turn security priorities into engineering work. Blacksmith operates a global fleet of bare-metal machines, orchestrates Firecracker VMs, and is extending its CI infrastructure to agent sandboxes and a background coding agent. The role requires balancing security with production reliability, performance, and usability, and owning practical security improvements through implementation and rollout.

Requirements

Strong Linux systems experience, including the ability to debug production issues across the kernel, networking, and storage stack.
Practical understanding of security fundamentals, including least privilege, defense in depth, and threat modeling, and the ability to translate risks into technical solutions.
Experience with virtualization and Linux isolation primitives, such as Firecracker, KVM, namespaces, and cgroups, and understanding of their security boundaries and tradeoffs.
Understanding of storage access controls, tenant isolation, and secure data deletion.
Understanding of using eBPF for runtime security monitoring, including observing process, file, and network activity to detect suspicious behavior.
Experience securing production AWS environments, particularly IAM, networking, and audit logging.
Ability to write and debug production code in Go, Rust, C, C++, or similar, and automate security changes through configuration management and infrastructure as code.
Strong comfort with agent-driven development and debugging, including directing coding agents, reviewing their changes, and validating correctness and security.
Track record of turning ambiguous problems into practical engineering solutions, owning implementation through production rollout, and explaining technical tradeoffs to engineers, leadership, and non-technical partners.
Strong systems fundamentals and demonstrated interest in securing the infrastructure operated.

Nice To Haves

Found or reported CVEs, conducted container or VM escape research, or competed in CTFs.
Secured multi-tenant infrastructure running untrusted workloads, such as CI runners, cloud compute, or agent sandboxes.
Built or extended eBPF-based detection tooling, turning runtime telemetry into actionable alerts and investigations.
Secured software delivery pipelines, including build isolation, artifact signing, image provenance, or secrets handling.
Operated or secured distributed storage systems such as Ceph or MinIO in production.
Secured macOS infrastructure running untrusted workloads.

Responsibilities

Identify, prioritize, and remediate security risks across the bare-metal fleet, AWS control plane, application services, and the broader organization.
Strengthen tenant isolation, host hardening, network boundaries, and access controls across the platform.
Build and operate automated security controls for secure configuration, vulnerability remediation, intrusion detection, and response, validating their effectiveness without compromising production reliability or performance.
Investigate and respond to security incidents, driving remediation through to completion.
Partner with engineering and IT to establish secure defaults and practical security standards across systems and workflows, balancing security, reliability, and usability.
Work alongside systems engineers to harden production systems and strengthen workload isolation.
Partner with the Security Lead to translate security priorities into engineering work.