{"id":199699,"url":"https://alion.io/job/firmus-technologies-senior-security-engineer-platform-engineering","title":"Senior Security Engineer, AI Platform and Infrastructure","company":{"id":63306,"name":"Firmus Technologies","domain":"firmus.ai","url":"https://alion.io/company/firmus-technologies","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":87,"open_postings":3,"ghost_share":0,"stale_share":0.333,"repost_share":0,"time_to_fill_p50_days":81,"computed_at":"2026-10-25T05:49:26Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sydney, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":85000,"max_usd":195000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2225},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CVSS","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"SRE","optional":false},{"name":"STRIDE","optional":false}],"status":"live","first_seen_at":"2026-09-04T05:34:25Z","employer_posted_date":"2026-09-28","last_verified_at":"2026-10-25T13:15:49Z","board_verified":true,"closed_at":null,"days_open":51,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":51},"description":"Firmus Technologies\nFirmus Technologies is a global leaderpioneering the development and operation of efficient AI infrastructure across Asia Pacific. \nFounded in Australia in 2019, our mission is to create the most efficient AI infrastructure by combining cutting-edge technology with a steadfast commitment to sustainability. \nAt Firmus, we are unique in our approach. We design, build, and operatea new class of digital infrastructure - the AI Factory. Through our model-to-grid technology approach, we have pushed the boundaries of multi-generational liquid cooling systems, energy management, AI software orchestration, and construction. For our customers, this approach allows us to make every watt count and deliver low-cost AI tokens globally. \nFirmus AI Cloud\nOur large-scale GPU cloud platform, Firmus AI Cloud, is purpose-built to deliver energy-efficient AI compute at scale to customers. \nIt empowers developers, enterprises, educational institutions, and government users to train and deploy AI models with unmatched efficiency and cost savings. With an ever-growing suite of services and applications, we are committed to delivering a cloud experience that is market-leading, proprietary, and built to scale. \nROLE SUMMARY \nFirmus Technologies is seeking a Senior Security Engineer, AI Platform and Infrastructure for our Engineering and Technology team. Customers provision GPU compute through API and console, software engineers build against it, our infrastructure engineers build the bare metal, virtualisation layer and Kubernetes clusters behind it, and our operators run the platform through the same control plane. You own both layers of Firmus AI Cloud: the platform control plane that engineering teams built, and the bare-metal infrastructure it runs on. Automation is how you scale that ownership. \nKEYRESPONSIBILITIES \nAutomation and secure delivery \nOwn the security controls in platform delivery pipelines, infrastructure-as-code, hardware lifecycle, and Kubernetes deployment. Ship them as paved roads that engineering teams and delivery partners inherit. \nBuild the systems that do the repeatable work: posture management, configuration validation, firmware and attestation checks, bulletin-driven fleet upgrades, evidence collection, and infrastructure risk detection. \nWrite and review code, infrastructure-as-code, and policy-as-code that enforce security outcomes at scale. \nSecurity architecture and standards \nSet the standard for platform identity, workload identity, privileged access, and secrets: short-lived credentials, federation, least-privilege access to infrastructure APIs and Kubernetes, and audit trails for administrative and control-plane actions. \nDefine the security baseline for Kubernetes and the container workloads the platform admits: control-plane isolation from worker and tenant networks, admission controls, policy-as-code, network policy, encrypted cluster secrets, no privileged containers or host mounts, least-privilege service accounts, and only trusted, pinned images. \nLead threat modelling and secure design review for infrastructure, platform, and shared-service changes. Define what an attacker can do and what must be true before it ships. \nDesign isolation in layers, so a single misconfiguration or outdated component cannot yield cross-tenant data access or code execution. Cover cluster, host, network, storage, control plane, and telemetry rather than relying on containers, namespaces, or dashboard filters alone. \nSeparate the infrastructure management plane from tenant workloads: out-of-band and BMC access, device and attached-NIC management, and shared network device administration. \nDefine how the platform is exposed and protected: default-deny at the edge, private endpoints for administrative and cluster APIs, enforcement placed in the path so volumetric and application-layer attacks are blocked or mitigated before it reaches services, encryption in transit and at rest, and automated certificate lifecycle. \nSet the standard for hardware roots of trust, remote attestation, secure and measured boot, firmware lifecycle, and sanitisation of GPU, host, attached device, and storage state before hardware is reassigned. Apply those controls across sites. \nAssurance and vulnerability management \nOwn platform and infrastructure security posture: what is covered, what is open, what is accepted with a named owner and an expiry, and what is overdue. \nPrioritise fixes on exploitability and exposure alongside CVSS, hold them to the Firmus vulnerability SLAs, and drive remediation with the teams that own the platform components, so issues close at the source. \nExtend SOC 2 Type 2 and ISO 27001 into the infrastructure lifecycle as platforms and sites grow. Evidence that a control ran should be a query, not a spreadsheet exercise. \nEnablement and escalation \nCoach engineers so secure infrastructure decisions get made without waiting for you. \nProvide platform and infrastructure security expertise during incidents and convert recurring failure modes into controls, guardrails, standards, or automation. \nGive engineering leadership a straight read on infrastructure risk and operational security readiness. Join customer conversations when the question is platform and infrastructure security. \nSKILLS AND EXPERIENCE \nBachelor's degree in computer science or a related technical field. \n7+ years in infrastructure security, platform security, cloud security, site reliability engineering, or platform engineering with a strong security focus. \nHas secured production bare-metal and on-premises infrastructure used by multiple teams or customers, including Linux hosts, out-of-band management, and the hardware lifecycle from commissioning through sanitisation and reassignment. \nDeep, practical knowledge of Kubernetes and container security for a multi-tenant platform: control-plane isolation, admission controls, policy-as-code, network policy, cluster secrets, container privilege and host-access restrictions, and admitting only trusted images. Has threat modelled production infrastructure using STRIDE or an equivalent method. \nHas run platform and workload identity in production: federation, short-lived credentials, privileged access management, secrets platforms, and least-privilege access to infrastructure APIs. \nHas designed and tested isolation so a container or VM escape, an outdated GPU or container toolkit, or a shared control plane cannot become a cross-tenant incident. \nUnderstands hardware roots of trust, secure and measured boot, signed firmware, and remote attestation, and can specify how out-of-band and device management interfaces stay separated from tenant workloads. \nHas secured public network exposure and platform cryptography: default-deny edge controls, private endpoints for administrative APIs, encryption in transit and at rest, and automated certificate lifecycle. \nWrites production-quality code in at least one of Python or Go and has replaced manual security work with automation that engineers trusted and kept on. \nHas kept production host, container runtime, GPU, and firmware software current against published security bulletins. \nHas worked under SOC 2 Type 2 or ISO 27001 and can produce evidence that a control ran. \nWilling to join incident response for platform and infrastructure security. \nWilling to travel overseas occasionally when the role requires it. \nClear and effective written and verbal communication in English. \nBonus Points \nExperience securing AI infrastructure platforms, GPU clusters, or large-scale compute environments, including RoCE fabrics or automated hardware sanitisation. \nExperience securing large scale hypervisors and the boundaries between guests, hosts, and assigned devices, including dedicated GPU-node architectures. \nExperience with NVIDIA BlueField DPUs and DOCA or equivalent DPU platform software, including restricted host mode and device attestation. \nExperience with GPU confidential computing, remote attestation, or attestation-gated workload identity. \nSecurity certifications such as CISSP, Certified Kubernetes Security Specialist (CKS), or equivalent. \nLOCATION \nSingaporeor Australia","description_format":"text","description_chars":8185,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Data Centers & Colocation","Cloud Platforms (IaaS & PaaS)","AI Compute & Inference"],"lifecycle":[{"event":"open","at":"2026-09-04T07:54:25Z"}],"visa":[],"liveness":{"score":76,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.841,"p_room":0.9,"age_days":51,"expected_fill_days":81,"reasons":["conf:0","velocity","win:mid"],"computed_at":"2026-10-25T05:49:26Z"},"pay":null,"html_url":"https://alion.io/job/firmus-technologies-senior-security-engineer-platform-engineering","json_url":"https://alion.io/job/firmus-technologies-senior-security-engineer-platform-engineering.json","meta":{"generated_at":"2026-10-25T14:31:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":20941,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":63306},"rest":"https://alion.io/mcp/rest/get_company?id=63306"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffirmus-technologies-senior-security-engineer-platform-engineering"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffirmus-technologies-senior-security-engineer-platform-engineering"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffirmus-technologies-senior-security-engineer-platform-engineering"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/firmus-technologies-senior-security-engineer-platform-engineering\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffirmus-technologies-senior-security-engineer-platform-engineering"}]}