AI-Native Detection and Triage Engineer

About this role

Own Fly.io’s security detection and triage pipeline across fleet telemetry and code-scanning signals. Build agentic tools to prioritize and investigate findings, and drive issues through root-cause analysis, remediation, and verification.

About the company

Fly.io is a public cloud that runs customer containers as hardware-isolated microVMs on bare-metal hosts around the world.

The team

Security

Stack

What you'll do

• Own eBPF sensor coverage, lifecycle, and telemetry pipeline across hosts.
• Build and maintain code-review agents, dependency, image, and SBOM scanning, and CI security checks.
• Develop a local platform replica and harnesses for fuzzing and full-stack security testing.
• Unify alerts, scan findings, vulnerabilities, and disclosures in a prioritized triage workflow.
• Build agents to triage, deduplicate, correlate, and enrich findings safely.
• Drive findings across teams through root cause, remediation, and confirmation.
• Run regular hunts and lead detection-side incident response and forensics.

What we're looking for

• Production experience building detection or security-scanning pipelines.
• Ability to interpret Linux authentication, audit, and kernel logs and review Go, Rust, or Elixir code.
• Production experience with eBPF telemetry or equivalent.
• Experience integrating security tooling into CI and working with fuzzers or test harnesses.
• Experience building agent or LLM tooling for operational data, with prompt-injection safeguards.
• Incident response experience, including leading or contributing deeply to investigations.
• Ability to drive remediation across teams without direct authority and communicate clearly in writing.

Nice to have

• Experience with Tracee, Falco, or Tetragon.
• Experience with AFL, libFuzzer, or syzkaller.

Hiring process

1. Short written application
2. Async work sample (2–3 hours)
3. HR screen (15–20 minutes)
4. Live Slack incident exercise (2 hours)
5. CEO conversation (30 minutes)