Security Engineer, Exposure and Vulnerability Management

About the Role

We're building civilization-scale infrastructure for AI, and we need a Security Engineer to secure the frontier of AI. The model weights training on our infrastructure are the most valuable and most targeted artifacts in technology. A breach isn't a leak; it's the frontier walking out the door. You'll own exposure and vulnerability management across our estate, from external attack surface to bare-metal fleet, and build the engineering that makes it work.

Responsibilities

• Own exposure and vulnerability management across the estate: external attack surface, cloud and Kubernetes, corporate endpoints, network infrastructure, and the bare-metal fleet.
• Extend exposure and vulnerability management across the corporate fleet (macOS, Windows, Linux): OS and application patch posture, first-party and third-party software, and drift from approved baselines.
• Cover software outside our managed and approved catalogs: unmanaged apps and SaaS, package-level software on endpoints (npm, PyPI, Homebrew), and browser and IDE extensions.
• Build the engineering that makes it work: asset inventory, scanner orchestration, deduplication, and prioritization based on reachability and real-world exploitation.
• Engineer remediation into existing team workflows, ensuring findings become owned tickets, fixes ride existing pipelines, and closure verifies automatically.
• Remediate vulnerabilities alongside system-owning teams: write patch PRs, harden base images, fix IaC modules, and ship config changes.
• Extend the program to areas beyond enterprise playbooks: BMC and device firmware, GPU drivers, host images at fleet scale, and data center equipment.
• Run intake for pen test findings and external reports, reporting exposure honestly: reachable vulnerabilities, wild exploitation, and accepted risks.

Qualifications

• Experience building vulnerability management as an engineering problem: pipelines, automation, and integrations instead of spreadsheet triage.
• Proficiency in writing production-quality automation (Python or similar) and integrating scanners, asset systems, and ticketing into coherent systems.
• Proven ability to prioritize vulnerabilities using KEV, EPSS, reachability, and judgment to overrule standard metrics.
• Hands-on experience fixing vulnerabilities in external codebases or infrastructure, with merged pull requests based on quality, not security demands.
• Track record of driving remediation at scale through non-reporting teams while maintaining SLAs and relationships.
• Ability to assess unconventional technologies like firmware, GPU stacks, or data center equipment without relying on vendor solutions.
• Experience managing vulnerability and exposure coverage on corporate endpoints and third-party software, including shadow apps, packages, and extensions.

Skills

• Bonus: External attack surface management platforms, firmware/BMC security, CSPM/KSPM tooling, exploit development, endpoint management (MDM, EDR), software inventory, and supply chain risk.

Pay

Compensation Range: $224K - $275K

Fluidstack is committed to pay equity and transparency. We are an Equal Employment Opportunity Employer and consider qualified applicants regardless of race, color, religion, sex, national origin, sexual orientation, gender identity, disability, protected veteran status, or other characteristics protected by law. We will consider qualified applicants with arrest and conviction records per applicable law.