Staff Security Engineer, Vulnerability & Exposure Management
At Fluidstack, we're building the future of AI infrastructure. We believe powerful AI can expand human freedom, but only if it's built and aligned with humanity's best interests. This future hinges on one critical factor: whoever deploys frontier compute infrastructure fastest will shape its destiny. We are singularly focused on delivering 10 to 100s of gigawatts of compute faster than anyone else, rethinking every layer of the stack from power acquisition and data center design to hardware and software operations.
This isn't just about speed and scale; it's about securing the foundation of civilization-scale AI. If you're driven by a mission that truly matters and want to be at the forefront of this monumental challenge, we want to hear from you.
Our Operating Principles
We're a team built on conviction and velocity. Here’s how we operate: Be a Barrel: We empower full autonomy. Own initiatives end-to-end, expand your scope without being asked, and operate without needing permission. The Security Team: Protecting the Frontier of AI Joining Fluidstack's Security Team means tackling challenges unlike any other. You won't be maintaining an inherited system; you'll be building a greenfield security program from the ground up, protecting the most valuable and targeted artifacts in technology. Securing AI's Most Prized Assets: The model weights training on our infrastructure are the crown jewels of technology. A breach here isn't just a leak; it's the frontier of AI walking out the door. You’ll be standing up the compute to hold them faster than anyone ever has. The Opportunity: Staff Security Engineer, Vulnerability & Exposure Management As a Staff Security Engineer focusing on Vulnerability & Exposure Management, you will architect and implement the systems that identify, assess, and remediate risks across our rapidly expanding infrastructure. This is an engineering-heavy role where you'll get your hands dirty building, fixing, and automating at an unprecedented scale. Own Exposure & Vulnerability Management: Take full ownership of this critical function across our entire estate: external attack surface, cloud environments, Kubernetes clusters, corporate endpoints (macOS, Windows, Linux), network infrastructure, and our bare-metal fleet. What We're Looking Fo We are seeking exceptional individuals who thrive on complex challenges and possess a deep engineering mindset for security. While the following outlines our ideal candidate, we always make space for remarkable talent. If you don't fit this role exactly, tell us where you would. You have architected and built vulnerability management as an engineering problem, focusing on pipelines, automation, and integrations over manual spreadsheet triage. Bonus Points Experience with External Attack Surface Management (EASM) platforms. We are committed to pay equity and transparency.
Insane Urgency: We push everything forward at maximum velocity. The stakes are too high for anything less.
Reason from First Principles: Challenge every assumption. We demand zero-analogy thinking, embrace data over ego, and believe the best idea always wins.
Love of the Game: The frontier of AI is the most fascinating problem of our time. We commit long hours and high intensity to push that frontier forward.
Build Something That Matters: If you're going to dedicate your time, invest it in work that profoundly impacts the world.
Build a World-Class Security Program from Scratch: This is a rare opportunity to design, implement, and own an entire security program end-to-end, from bare metal to the boardroom, as we scale across continents.
Your Threat Surface is Measured in Gigawatts: Our customers are building the most consequential technology in human history. Being responsible for the physical and logical security of that work elevates everything else.
Deep Dive into Corporate Fleet Security: Extend your reach to OS and application patch posture, managing both first-party and third-party software, and ensuring consistent baselines across corporate devices.
Combat Shadow IT & Unmanaged Software: Identify, assess, and drive remediation or removal of unmanaged applications, SaaS, package-level software (npm, PyPI, Homebrew), and browser/IDE extensions.
Engineer Intelligent Remediation Workflows: Build sophisticated asset inventory, orchestrate advanced scanners, and implement deduplication and prioritization logic based on real-world exploitation and reachability, not just raw CVSS scores.
Integrate Security Seamlessly: Engineer remediation directly into existing development workflows, ensuring findings become owned tickets, fixes leverage existing pipelines, and closure is automatically verified.
Be a Hands-On Remediator: Don't just flag issues – fix them. Write patch PRs, harden base images, refine IaC modules, and ship config changes directly alongside engineering teams.
Extend Beyond Standard Playbooks: Develop and implement security assessments for unique components like BMC and device firmware, GPU drivers, host images at fleet scale, and the long tail of data center equipment where enterprise playbooks fall short.
Manage Pen Test & External Findings: Act as the intake for pen test findings and external reports, providing honest reporting on what's reachable, exploited in the wild, and formally accepted.
You write production-quality automation (Python or similar) and have successfully integrated scanners, asset systems, and ticketing into coherent, automated workflows.
You have implemented and run vulnerability prioritization that withstands real-world conditions, utilizing KEV, EPSS, reachability, and sound judgment to contextualize all three.
You possess hands-on experience fixing vulnerabilities within existing codebases or infrastructure, with a track record of merged pull requests driven by quality, not just security mandates.
You have successfully driven remediation at scale across diverse teams that don't directly report to you, maintaining credible SLAs without compromising relationships.
You can tackle non-traditional technology classes (e.g., firmware, GPU stacks, data center equipment) and develop defensible assessment approaches independently, rather than relying solely on vendor solutions.
You have experience running vulnerability and exposure coverage on corporate endpoints and third-party software, including managing the long tail of shadow apps, packages, and browser extensions.
Deep expertise in firmware or BMC security.
Familiarity with CSPM/KSPM tooling.
Experience in exploit development or reachability validation.
Proficiency with Endpoint Management and Patching tooling (MDM, EDR), software inventory, and assessing extension/supply chain risk.
Fluidstack is an Equal Employment Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability and protected veterans’ status, or any other characteristic protected by law. Fluidstack will consider for employment qualified applicants with arrest and conviction records pursuant to applicable law.
You will receive a confirmation email once your application has successfully been accepted. If there is an error with your submission and you did not receive a confirmation email, please email [email protected] with your resume/CV, the role you've applied for, and the date you submitted your application-- someone from our recruiting team will be in touch.