Platform Security Engineer

We have a security team. It covers application security, trust boundaries and auth, vulnerability research against our own hypervisor stack, corporate security, compliance, and disclosure. What it doesn't have is someone who works alongside the platform team hacking on the platform itself: the kernel, the hypervisor jailers, the syscall filters, host network isolation, and the trust relationships between hosts. That's the gap this role closes.

The work has two halves, and you will own both:

Keep the guest in the VM. Harden the per-workload boundary on every host.

Plan for the worst. Limit the blast radius for when the next horrible KVM guest-to-host escape drops.