180K–225K USD / year
Platform Security Engineer
DevOpsRemote — worldwide
Published on 2026-11-05
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Own the security and isolation of Fly.io’s Linux host platform, including its micro-VM boundaries, host networking, and trust relationships between hosts and the control plane. Partner closely with Platform and Networking teams to harden production systems, limit incident blast radius, and investigate suspected escapes.
About the company
Fly.io is a public cloud that runs customer containers as hardware-isolated microVMs on bare-metal hosts around the world.
The team
Security team, reporting to the Head of Security and working closely with Platform and Networking.
Stack
Linux kernelKVMFirecrackerCloud HypervisorseccompBPFnftables
What you'll do
- Own sandboxing, syscall filtering, process confinement, and violation telemetry for both VMMs and host services.
- Manage host network isolation rules, health checks, and killswitches.
- Design and implement host-to-control-plane trust, host identity, authorization, and credential boundaries.
- Own kernel patching cadence and SLA, and live kernel patching for urgent fixes.
- Design isolation controls for agent workloads across fleets with different trust levels.
- Lead technical host investigations of suspected guest escapes and other security incidents.
What we're looking for
- Production experience shipping substantial Linux kernel, KVM/hypervisor, or BPF security work.
- Production experience with seccomp, jailers or sandbox configuration, or VM isolation hardening.
- Deep expertise in one of kernel and sandboxing or host networking, with ability to expand into related areas.
- Experience running hardware virtualization on hardware outside your control.
- Ability to collaborate across teams, communicate clearly in writing, and work independently as a low-level security authority.
Nice to have
- Experience as a platform-security specialist on a security team.
- Experience with bare-metal cloud instances, nested virtualization, or customer-account hosts.
Benefits
- Competitive equity grants with a long exercise window
- Health care benefits
- Flexible vacation with a minimum
- Hardware and phone allowances
Hiring process
- Short written application
- Async work sample: kernel live patch for a recent CVE, critique of an AI-generated patch, and a brief note on AI tooling
- 15–20-minute HR phone screen
- Two-hour live host-isolation scenario with a platform engineer over Slack
- 30-minute CEO conversation