Cybersecurity Engineer Jobs

About The Position

Requirements

• Deep Linux systems-security experience on multi-user or HPC infrastructure, including kernel and OS hardening, privileged access, host isolation, and host-based detection.
• Fluency with Terraform and CI/CD systems such as GitHub Actions or GitLab CI, including writing infrastructure as code that enforces a security model.
• Experience securing cloud-native environments in AWS, GCP, and/or neoclouds, including ephemeral, high-compute workloads.
• Hands-on experience operating and securing an HPC scheduler; the cluster uses SLURM.
• Ability to threat-model against sophisticated adversaries and build robust systems.
• Pragmatic experience or capability in software supply-chain security and the risks of AI-driven, agent-assisted development.
• Ability to explain security trade-offs to researchers and leadership and identify safe ways to enable work.
• Experience designing sandboxing and least-privilege execution for agent-driven or automated workloads.

Nice To Haves

• Experience with model registries such as MLflow or Weights & Biases; container and dependency scanners such as Snyk or Trivy; policy-as-code such as OPA; supply-chain tools such as Sigstore or cosign; or SBOM generators.
• Experience handling model weights and classifying sensitive or dual-use research artefacts.
• A background combining infrastructure engineering and security.
• Genuine interest in MATS’s mission and motivation by its work; AI safety expertise is not required.
• Experience with strongly segmented or air-gapped model-weight handling, hardware security modules, or FIPS-validated cryptographic controls.
• Experience conducting continuous threat hunting or red-team exercises against cloud and cluster infrastructure, or designing compartmentalized research environments with separately credentialed boundaries.
• Kubernetes experience.

Responsibilities

• Harden DevSecOps and CI/CD pipelines with automated scanning, verification, compliance, and security-policy checks, including workflows for agents to test changes before production.
• Implement compliance as code to audit and enforce security configurations across AWS, GCP, neocloud environments, and Terraform infrastructure.
• Establish and harden the research-code source-control environment, including secret, dependency, and code scanning, branch protections, and short-lived CI-issued cloud credentials.
• Secure the software supply chain through code and dependency provenance, signing, SBOM generation, scanning, and vulnerability management.
• Define security models for research agents, including sandboxing, isolation, and least-privilege access to cluster resources, sensitive intellectual property, and credentials.
• Own security architecture across cloud providers and the research cluster, including zero-trust network segmentation, role-based access control, FIDO, cluster identity, cohort access lifecycle, and policy as code where appropriate.
• Design the security of MATS’s unified model and compute access layer across providers.
• Harden Linux operating systems and nodes across the SLURM cluster, including kernel and CVE patching, sudoers/PAM privileged-access controls, multi-tenant isolation, and host-based detection.
• Develop and maintain data-handling and classification protocols for pre-publication research and potentially sensitive model weights, including storage, access, and transfer controls.
• Design end-to-end security controls for research-data infrastructure, including classification and provenance, shared-dataset access controls, privacy and consent handling, and secure adoption of tools built with research partners.
• Implement audit-log ingestion to SIEM, anomaly detection for identity and workload behavior, and egress monitoring across the cluster and unified access layer.
• Partner with AI labs on security audits and help meet frontier model providers’ requirements for sensitive partnerships.
• Lead cluster-side incident response, maintain cluster-specific playbooks, coordinate with the IT Security Engineer on cross-cutting incidents, conduct tabletop exercises, and work with the external incident-response retainer firm.
• Explain security trade-offs to researchers and leadership and enable research to proceed safely.

Benefits

• In-office catered lunches and dinners on workdays.
• Paid work trips, including staff retreats, business trips, and relevant conferences.
• Funding and support for professional development.
• Flexible PTO for Berkeley-based employees.
• Flexibility for hybrid work; fully remote work is not available.
• Medical, dental, vision, and life insurance.
• Pension scheme for London-based candidates, or Roth and Traditional 401(k) plans for Berkeley-based candidates.
• Visa sponsorship for exceptional candidates where feasible.