Senior Security Engineer

Runware is hiring a Senior Security Engineer to own and build security for its AI supercomputer, including its bare-metal GPU fleet, inference pods, managed Kubernetes clusters, and control plane. The role designs and implements security controls, manages threat modeling and incident response, and supports enterprise security reviews and compliance.

Responsibilities:

• Own the security architecture of the fleet: host hardening for bare-metal GPU nodes, immutable images and a signed build pipeline, boot integrity, and the identity, secrets and access model for humans and services across every pod
• Secure multi-tenancy on shared infrastructure. Design and verify isolation between customer workloads at the network, Kubernetes, host and GPU layers, and produce the evidence that proves it holds
• Secure the managed Kubernetes offering: cluster hardening, admission control, RBAC, supply-chain controls for images, and a clean, auditable handover of clusters to customers
• Build security visibility across the fleet: logging, detection, alerting and audit trails from firmware to API, wired into the fleet dashboards and on-call so that an anomaly on one node in one pod is seen within minutes
• Lead security reviews and threat models for new pods, sites, servers and platform features, with a focus on real-world risk rather than checklists
• Run incident response for the infrastructure: investigation, containment, recovery and post-incident learning, as part of the on-call rotation
• Own vulnerability management for the fleet: firmware, kernel, drivers, GPU stack and container images across thousands of nodes, with a patch cadence you can defend to a customer
• Answer enterprise customers' security due diligence with engineering evidence, and partner with the CISO on the SOC 2 and ISO 27001 controls that touch the infrastructure
• Design for sovereign and on-premise deployments: data residency, in-country key management, and physical and remote-access controls for a pod sitting on a customer's site
• Use AI to accelerate the work: automate evidence collection, log triage, configuration audits and runbooks with LLM-based agents, so that a very small team can secure a very large fleet

Requirements:

• 8+ years in security or infrastructure engineering, with several of those securing production infrastructure at a company that runs its own hardware at scale
• A track record of building security controls, not just auditing them. You have taken a hardening standard, an access model or a detection pipeline from design to running across a fleet, and you know what breaks between the two
• Deep, current, hands-on Linux security expertise: kernel hardening, namespaces and cgroups, seccomp, eBPF, secure and measured boot, TPM-based attestation, and the tooling to see exactly what a process did
• Strong Kubernetes security: RBAC, admission control and policy engines, network policy, runtime security, image signing and SBOMs, and the ways a container escapes
• Fluent in network security on real hardware: segmentation and VLAN or VXLAN isolation, firewalls, out-of-band management networks, and the risks that live in BMC, IPMI and switch management planes
• Experience with identity, secrets and PKI at scale: short-lived credentials, workload identity, hardware-backed keys, and removing standing access without slowing engineers down
• Fluent in Python or Go, and comfortable writing the tooling, scanners and automation yourself rather than waiting for someone else
• You use AI to accelerate your own output every day, for scripting, log analysis, code review, documentation and incident triage, and you have a clear view of how a small security team armed with these tools should operate differently
• A clear communicator who can explain the same trade-off to an engineer, a customer's CISO and a founder in one afternoon, and who assesses risk pragmatically rather than by the book
• Experience securing GPU clusters for AI training or inference: the NVIDIA driver and fabric manager stack, GPU multi-tenancy (MIG, time-slicing, per-tenant isolation), confidential computing on GPUs, and protecting model weights at rest and in flight
• Firmware and hardware security: UEFI, BMC and NIC firmware lifecycle, Redfish, hardware root of trust and supply-chain attestation for servers arriving at a site
• Hands-on experience with InfiniBand or RoCE fabrics and the security model of RDMA
• Delivering SOC 2 or ISO 27001 in a production environment, and compliance tooling and evidence automation
• Offensive experience: red teaming, penetration testing or vulnerability research against infrastructure
• Experience with sovereign, air-gapped or regulated deployments, including data residency across jurisdictions
• Physical security of data centres or edge sites: access control, tamper evidence and remote-hands procedures