{"id":4044524,"url":"https://alion.io/job/ironsite-mts-security-engineer","title":"MTS - Security Engineer","company":{"id":4409697,"name":"Ironsite","domain":"ironsite.ai","url":"https://alion.io/company/ironsite-2","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Gem","truth_index":{"grade":"B","score":75,"open_postings":5,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":230000,"max":280000,"currency":"USD","period":"year","gross":null,"usd_annual":280000},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CVE","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"PKI","optional":false},{"name":"SBOM","optional":false},{"name":"Zero Trust","optional":false},{"name":"CI/CD","optional":true},{"name":"Cosign","optional":true},{"name":"GDPR","optional":true},{"name":"GitHub","optional":true},{"name":"ISO 27001","optional":true},{"name":"Sigstore","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-10-26T19:06:28Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T23:24:07Z","board_verified":true,"closed_at":null,"days_open":15,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":15},"description":"About Ironsite\nIronsite is building the intelligence layer for the physical world. We design our own wearable hardware, deploy it alongside craft workers, and transform a shift's footage into a next-morning report. Our internal team and purpose-built models label the data overnight and deliver actionable insights to superintendents by 5 AM.\nWe are accelerating the speed, efficiency, and predictability of construction, especially for complex, mission-critical infrastructure projects, including data centers, LNG facilities, sports stadiums, hospitals, and other large-scale developments, by training AI models on egocentric construction footage and labor productivity data. We are built with a pro-worker philosophy at our core: we believe technology should empower the workforce, not replace it. We're working to give craft workers and project leaders better visibility into what's happening on-site, while creating a system where the reality of construction and the chaos of each day are finally available to the people running the project.\nIronsite is deployed across several of the largest active construction projects in the country. To date, we've captured more than 100,000 hours of construction footage across seven states, now process thousands of hours of site activity every day, and maintain a worker opt-out rate below two percent. This is enabled by a workforce-first architecture that anonymizes devices, captures no audio, and never releases raw video.\nIronsite is backed by leading investors (8VC, South Park Commons, Saga Ventures) and prominent operators across technology and construction, including Eric Schmidt, Jeff Dean, Jeff Rothschild, Mark Leslie, Scott Wu, Eric Glyman, Karim Atiyeh, Russell Kaplan, and others, alongside over a dozen construction industry operators who have joined us as partners in building this.\nLonger term, we believe Ironsite is the foundation for what construction becomes in the next decade. The systems we're building will be the operating system for how the physical world gets built. We see a future where craft workers are more valued, more visible, and better paid for the skill they bring, and where the industry finally has the intelligence layer that makes autonomous construction possible. Both start with the same foundation.\nThe Role\nWe're hiring our first Security Engineer to own security from every angle: a wearable camera fleet and the jobsite networks it runs on, petabyte-scale video and ML systems, the cloud they live in, the platform our customers log into, and the AI agents our engineers now build with every day.\nAI agents now find and exploit vulnerabilities faster than vendors can patch. A model wrote a working remote-root exploit for the Linux kernel this fall, and the CVE stream across libraries, runtimes, kernels, CAs, and vendors has become a firehose. Knowing exactly what we run, everywhere, and responding methodically is the core of the job. Alongside it, you'll protect first-person video of thousands of workers, the sites of critical infrastructure under construction, and our promise that raw video never leaves.\nSome of the Things You’ll Work On\n Software supply chain security. A living SBOM across firmware, edge, cloud, ML, and laptops. Package firewalls in front of every install (we run Socket today). Minimal, continuously rebuilt base images, and build attestations verified at deploy time, so everything in prod traces back to reviewed code. Plus vendor risk.\nUpstream incident response. When a CA, runtime, library, kernel, or vendor is compromised, you'll work out the blast radius in hours. That means every container, CI runner, host, device, and engineer laptop. Then you ship the fix to cloud and to an often-offline device fleet.\nDevice and firmware security. Secure boot, signed OTA, hardware-backed identity, and encryption, so a lost device is a dead brick, not a data source.\nPrivacy by architecture. Worker anonymization and the no-raw-video guarantee enforced by systems, with audits that prove it.\n Network, cloud, and ML platform security. Zero-trust jobsite and overlay networks, and least-privilege, keyless access (workload identity, short-lived credentials, MFA-gated admin) to video, model weights, and production data. Infrastructure as code you can audit. Detection and triage across the fleet and cloud that tells a routine deploy from an intruder fast.\nApplication and agent security. Tenant isolation and authorization across our API. Hardening the AI agents and automation that read our code, run our tooling, and touch production. Making agent-assisted code review and pentesting a standard part of how we ship.\nTechnical Challenges You'll Solve\n CVE volume that outpaces humans. MTTE (mean time to exploit) is going negative. Build the automation, much of it agent-driven, that lets a small team keep up: triage against what's actually deployed and reachable, not just what's installed, and patch devices that stay offline for days.\nOne SBOM from silicon to models. Chip SDKs, embedded Linux, kernels, container images, cloud services, CI, ML frameworks, and weights, all in one accurate, decision-ready graph.\nPhysical access is a given. Thousands of cameras in uncontrolled environments need a threat model, alerting, and revocation that hold anyway.\nThe seams. The real risk lives where hardware, firmware, network, cloud, ML, and agents meet: a field device on the same overlay network as production, an agent with shell access, an internal tool deployed straight from a laptop. You'll see all of them.\nWhat We're Looking For\nHands-on supply chain security: SBOMs that drive decisions (CycloneDX, including ML-BOM/CBOM), reachability-aware vulnerability management at scale, build and deploy provenance verified at deploy time, dependency firewalls, and upstream incident response.\nSecurity engineering depth in at least two of embedded/IoT, networks, cloud, and application security.\nApplied cryptography and PKI: device identity, key management, certificate lifecycles and trust stores (and what to do when a CA is compromised).\nStrong threat-modeling judgment and real incident response experience, including telling a false positive from a breach under pressure.\nA record of building security into systems engineers actually adopt: guardrails in CI and infrastructure as code, not tickets.\nTypically 4+ years of experience, 1-2 at a senior level; CS or related degree, or equivalent experience.\nPreferred Qualifications\nArtifact attestations and trusted publishing in production (in-toto, Sigstore/cosign, GitHub attestations), VEX to cut noise, and CI/CD hardening (OIDC, pinned actions, runner egress control).\nUsing AI agents defensively for triage, code review, or vuln discovery, and securing the agents themselves (permissions, sandboxing, prompt injection).\nSecuring hardware end to end: secure boot, secure elements, OTA.\nPrivacy engineering for video or biometric data.\nOffensive or hardware security experience.\nCompliance programs (SOC 2, ISO 27001, GDPR, etc.) run as engineering rather than paperwork.\nLocation, Compensation, & Perks\nSan Francisco Bay Area (on-site)\nBase salary: $230k-$280k per year, commensurate with experience\nMeaningful early-stage team equity.\nAbility to purchase xPU or devices for development\nFull benefits including health, dental, vision, and 401(k) with 6% match\nDaily catered lunch\nOffice in San Francisco, next to Oracle Park and the Caltrain\nFinal compensation is determined by experience, location, and level.\nCompensation\nThe base pay range for this role is $230,000 - $280,000 per year.","description_format":"text","description_chars":7577,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Computer Vision","Industrial AI","Construction Management Software"],"lifecycle":[{"event":"open","at":"2026-11-10T23:24:07Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 3","filings_12m":3,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":302500,"route":null,"cap_exempt":false,"checked_at":"2026-11-10T11:34:35+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":76,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.841,"p_room":0.9,"age_days":15,"expected_fill_days":30,"reasons":["conf:1","win:mid"],"computed_at":"2026-11-11T01:05:55Z"},"pay":{"stated_usd_annual":280000,"is_top_pay":true},"html_url":"https://alion.io/job/ironsite-mts-security-engineer","json_url":"https://alion.io/job/ironsite-mts-security-engineer.json","meta":{"generated_at":"2026-11-11T01:05:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4409697},"rest":"https://alion.io/mcp/rest/get_company?id=4409697"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fironsite-mts-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fironsite-mts-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fironsite-mts-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ironsite-mts-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fironsite-mts-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4044524}},{"tool":"search_jobs","arguments":{"company":"ironsite.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4044524},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}