Platform Security Engineer (Fully Remote)

Fly.io; United States; Remote; USD 180,000 - 260,000; Full time

Job summary

Fly.io is seeking a senior Linux kernel security engineer to harden per-workload boundaries, manage host isolation with nftables-like controls, and steer the cadence of kernel patching across our global bare-metal fleet.

You will collaborate across teams, lead investigations into guest escapes and kernel anomalies, and shape trust models between hosts and the control plane in a remote-first culture. Strong written communication and ability to work asynchronously are essential.

Qualifications

• Deep expertise in Linux kernel security and hardening.
• Ability to collaborate across teams and act as senior security expert.
• Strong written communication in asynchronous environments.

Responsibilities

• Harden per-workload boundaries with syscall filtering, network confinement, and violation telemetry.
• Own host network isolation with nftables and health checks.
• Lead kernel patching cadence and live kernel patching for critical fixes.

Skills

Linux kernel

Remote collaboration

Async writing

Security expertise

Tools

KVM

BPF

Seccomp

Job description

• You will own the isolation and sandboxing across VMMs, host networking, and kernel.
• Design blast radius limits and trust models between hosts and control plane.
• Drive technical investigations for guest escapes and kernel anomalies.

What You'll Be Doing:

• Harden per-workload boundaries with syscall filtering, network confinement, and violation telemetry.
• Own host network isolation with nftables and health checks.
• Lead kernel patching cadence and live kernel patching for critical fixes.

Who We're Looking For:

• Experienced with Linux kernel, KVM, BPF, and seccomp in production.
• Comfortable collaborating across teams and being the senior security expert on low-level work.
• Write well asynchronously and thrive in a remote-first culture.

Fly.io

We build a public cloud that runs on our own hardware all over the world. We are a remote-first team operating thousands of bare-metal hosts, with a culture of engineering excellence and security focus.