[Hiring] Platform Security Engineer @Fly.io

Role Description

We have a security team covering application security, trust boundaries and auth, vulnerability research against our own hypervisor stack, corporate security, compliance, and disclosure. This role focuses on working alongside the platform team hacking on the platform itself.

• Keep the guest in the VM.
• Harden the per-workload boundary on every host.
• Plan for the worst.
• Limit the blast radius for when the next horrible KVM guest-to-host escape drops.

You will report to the Head of Security, coordinating with the Platform team.

What You'll Be Doing

• Isolation and sandboxing: Own syscall filtering, process-level confinement, network confinement, and violation telemetry across both VMMs and host services.
• Host network isolation: Manage host communication rules, health checks, and killswitches.
• Blast radius and control-plane trust: Own the trust model between hosts and the control plane, including host identification and authorization for operations.
• The kernel: Manage patching cadence, SLA, and live kernel patching.
• Agent workloads: Design isolation for agent workloads, including VMM confinement and worker-side controls.
• When it breaks: Lead technical investigations on host issues and strengthen forensics playbook.

Qualifications

• Shipped non-trivial Linux kernel, KVM or hypervisor, or BPF security work in production.
• Production experience with seccomp filters, jailer or sandbox configuration, or VM isolation hardening.
• One anchoring domain (kernel and sandboxing, or host networking) with credible reach into the others.
• Experience running hardware virtualization on hardware you didn't control.
• Previous platform-security specialist experience on a security team.
• Comfortable being the technical authority on low-level work.
• Strong asynchronous writing skills.

Other Important Things to Know

• You will be the depth in kernel, syscalls, BPF, or network isolation.
• Much of the work lives in systems other teams own.
• The scope is real and the structure is thin; you will manage your own scope.
• We are on call, and our stuff is global.

Our Process for Hiring

• This is a senior, fully-remote, full-time position.
• Competitive equity grants with a long exercise window.
• Health care benefits and flexible vacation time.
• Hardware and phone allowances.
• Hiring process includes a short written application, a work sample, a phone screen, a live workday, and a final conversation with our CEO.

Salary

$180,000 - $225,000 a year