{"id":3556168,"url":"https://alion.io/job/blacksmith-systems-security-engineer","title":"Systems Security Engineer","company":{"id":19767,"name":"Blacksmith","domain":"blacksmith.sh","url":"https://alion.io/company/blacksmith-sh","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":88,"open_postings":18,"ghost_share":0.111,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":147,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":225000,"max":300000,"currency":"USD","period":"year","gross":null,"usd_annual":300000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"C++","optional":false},{"name":"Defense in Depth","optional":false},{"name":"eBPF","optional":false},{"name":"GitHub Actions","optional":false},{"name":"IAM","optional":false},{"name":"KVM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"MinIO","optional":false},{"name":"Rust","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zapier","optional":false}],"status":"live","first_seen_at":"2026-10-30T23:39:50Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-04T09:02:35Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":4},"description":"About Blacksmith\nWe started by building infrastructure to run CI workloads really fast. Our first product helps companies run GitHub Actions substantially faster and cheaper by owning and operating our own global fleet of bare-metal machines rather than renting generic cloud VMs.\n\nToday, we orchestrate tens of millions of Firecracker VMs each week, running CI for 10,000+ companies and tens of millions in ARR. We’ve grown 20x so far in 2026.\n\nWe operate thousands of bare-metal machines across multiple regions, regularly schedule 300k+ vCPUs concurrently, and run a petabyte-scale Ceph cluster that we manage ourselves.\n\nWe’ve raised $125M from Seed to Series C, led by Sequoia, Google Ventures (GV) & Peak XV Partners, and we’re intentionally building a small, but exceptional team.\n\nBlacksmith was founded by a team with deep systems and scaling experience, including building search/ads infrastructure at Faire, and operating large distributed systems at Cockroach Labs. Our GTM is led by Jon Boyer, formerly Head of Sales at Zapier.\n\nWe're now extending the same CI infrastructure into a broader platform: running agent sandboxes at scale and building our own background coding agent on top of it.\n\nThe role at Blacksmith\nWe are looking for a Systems Security Engineer to build and operate security controls at Blacksmith. Your primary focus will be our bare-metal fleet, with responsibility extending to our AWS control plane, application services and the broader organization.\nThis is a hands-on engineering role. You'll work alongside our systems engineers to harden production systems, strengthen workload isolation, and investigate and remediate security issues. You'll partner with our Security Lead to translate security priorities into engineering work.\nWhat you’ll be doing\nIdentify, prioritize and remediate security risks across our bare-metal fleet, AWS control plane, application services and the broader organization.\n\nStrengthen tenant isolation, host hardening, network boundaries and access controls across our platform.\n\nBuild and operate automated security controls for secure configuration, vulnerability remediation, intrusion detection and response, validating their effectiveness without compromising production reliability or performance.\n\nInvestigate and respond to security incidents, driving remediation through to completion.\n\nPartner with engineering and IT to establish secure defaults and practical security standards across systems and workflows, balancing security, reliability and usability.\n\nYou’re a good fit if you have\nStrong Linux systems experience, with the ability to debug production issues across the kernel, networking and storage stack.\n\nA practical understanding of security fundamentals, including least privilege, defense in depth and threat modeling, and the ability to translate risks into technical solutions.\n\nExperience with virtualization and Linux isolation primitives, such as Firecracker, KVM, namespaces and cgroups, and an understanding of their security boundaries and tradeoffs.\n\nAn understanding of storage access controls, tenant isolation and secure data deletion.\n\nAn understanding of how to use eBPF for runtime security monitoring, including observing process, file and network activity to detect suspicious behavior.\n\nExperience securing production AWS environments, particularly IAM, networking and audit logging.\n\nThe ability to write and debug production code in Go, Rust, C, C++ or similar, and automate security changes through configuration management and infrastructure as code.\n\nStrong comfort with agent-driven development and debugging, including directing coding agents, reviewing their changes and validating correctness and security.\n\nA track record of turning ambiguous problems into practical engineering solutions, owning implementation through production rollout, and explaining technical tradeoffs to engineers, leadership and non-technical partners.\n\nWe welcome candidates from security engineering, systems engineering and SRE backgrounds. You should bring strong systems fundamentals and a demonstrated interest in securing the infrastructure you operate.\nBonus\nYou've found or reported CVEs, done container or VM escape research, or competed in CTFs.\n\nYou've secured multi-tenant infrastructure running untrusted workloads, such as CI runners, cloud compute or agent sandboxes.\n\nYou've built or extended eBPF-based detection tooling, turning runtime telemetry into actionable alerts and investigations.\n\nYou've secured software delivery pipelines, including build isolation, artifact signing, image provenance or secrets handling.\n\nYou've operated or secured distributed storage systems such as Ceph or MinIO in production.\n\nYou've secured macOS infrastructure running untrusted workloads.\n\nCompensation and benefits\nMedical, Vision, and Dental insurance.\n\nCompetitive base + equity.\n\n401K match.\n\nUnlimited PTO.\n\nAnnual offsite.\n\nEarly-exercise stock options.\n\n12 weeks fully paid parental leave (US).","description_format":"text","description_chars":5001,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Dental insurance","Equity","Parental leave","Stock options","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["DevOps & Platform Engineering","Cloud Platforms (IaaS & PaaS)"],"lifecycle":[{"event":"open","at":"2026-10-31T00:53:34Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":4,"expected_fill_days":147,"reasons":["conf:1","win:early"],"computed_at":"2026-11-04T06:34:25Z"},"pay":{"stated_usd_annual":300000,"is_top_pay":true},"html_url":"https://alion.io/job/blacksmith-systems-security-engineer","json_url":"https://alion.io/job/blacksmith-systems-security-engineer.json","meta":{"generated_at":"2026-11-04T09:38:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14987,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":19767},"rest":"https://alion.io/mcp/rest/get_company?id=19767"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fblacksmith-systems-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fblacksmith-systems-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fblacksmith-systems-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/blacksmith-systems-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fblacksmith-systems-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3556168}},{"tool":"search_jobs","arguments":{"company":"blacksmith.sh","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3556168},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}