[Hiring] AI-Native Detection and Triage Engineer @Fly.io

Role Description

Fly's Head of Security covers application security, trust boundaries, and the compliance program. A vulnerability researcher spends their time breaking our own hypervisor and kernel stack. A Platform Security Engineer, hiring in parallel with this role, will own isolation on the hosts. The seat we are adding will own the signal: from the fleet and from the code, through one triage pipeline, to a fixed root cause. That will be you.

Two sources will feed that pipeline:

• Signal from the running platform: eBPF sensors on every host, the SIEM they land in, and the detections that fire on it.
• The code: agents that review every merged PR, dependency and image scanning across our repositories, and a full local replica of the platform where we scan, fuzz, and test the whole stack.

AI-native means two things here:

• You will build with coding agents as a matter of course.
• The pipeline itself will be agentic: agents will safely triage, correlate, and enrich findings before a human sees them.

What You'll Be Doing

• Signal from the fleet:
  • Own what the sensors watch, their lifecycle across our kernel versions, and their path into the pipeline.
  • Own detection coverage for scenarios such as:
    • Spotting a compromised host and lateral movement.
    • Noticing control-plane access patterns.
    • Operator access to customer machines.
    • Secrets access and abuse of AI workloads.
• Signal from the code:
  • Own agents that review every merged PR for security issues.
  • Own dependency, image, and SBOM scanning across the codebase.
  • Help build out our local replica of the platform: QEMU/KVM Fly hosts running nested Firecracker.
  • Help build CI and fuzzing/testing harness.
• The triage pipeline:
  • Own one prioritized inbox over SIEM alerts, scan findings, vulnerabilities, failing checks, and inbound disclosures.
  • Build agents that triage, deduplicate, correlate, and enrich findings.
• Running things to ground:
  • Funnel alerts and scan results to the teams that own the code or the hosts.
  • Work with teams to a root cause if needed.
  • Ensure fixes land and detections/scanners confirm it.
• Hunting and incidents:
  • Hunt on a cadence, not just when something is on fire.
  • Lead detection and triage side of the response during incidents.
  • Own the detection side of our forensics playbook.

Qualifications

• Experience building detection or security-scanning pipelines against real systems.
• Ability to read Linux auth, audit, and kernel logs.
• Familiarity with eBPF-based telemetry in production.
• Experience putting security tooling into CI.
• Experience with fuzzers or test harnesses.
• Experience building agent or LLM tooling against operational data.
• Experience in incident response and explaining hunts.
• Ability to run findings to ground across teams.
• Strong asynchronous writing skills.

Requirements

• This isn't a SOC analyst role.
• Not a "prompt engineer" role.
• Not a scanner-operator role.

Benefits

• Salary range: $180,000 - $225,000 a year.

Company Description

We're building a public cloud that runs on our own hardware all over the world. Customers hand us containers; we convert them into micro-VMs under hardware virtualization, each with its own kernel, on thousands of bare-metal hosts we operate ourselves.