Principal Bare-Metal Security Engineer

Fluidstack; Seattle (WA); On-site; USD 269,000 - 330,000; Full time

Job summary

Fluidstack is seeking an experienced security engineer to own end-to-end security for bare metal infrastructure. You will harden systems, design golden images, and enforce secure BMC controls across fleets, while collaborating with network teams on zero-trust architectures.

You’ll implement encryption, manage keys, and lead threat modeling for new hardware deployments. The role requires deep Linux security, automation in Python/Go/Rust, and experience with OpenBMC/Open-source security stacks.

Qualifications

• You've worked in information security or infrastructure engineering with a strong focus on bare metal, IaaS, or high‑scale cloud infrastructure.
• You harden Linux deeply (SELinux, AppArmor, kernel‑level security) and command network security (TCP/IP, VPNs, firewall rulesets, zero‑trust).
• You implement encryption in practice, including disk‑level (LUKS) and hardware‑level, and you understand HSMs and trusted computing (TPM/TXT).
• You automate fluently in Python, Go, or Rust, with configuration management (Ansible, Puppet, Chef).
• You work well across engineering teams and communicate security decisions clearly.
• Bonus: BMC platforms (OpenBMC, iDRAC, iLO). Hardware root of trust and secure boot. Compliance standards (SOC 2, ISO 27001, FedRAMP). CISSP, OSCP, or CEH.

Responsibilities

• Own end-to-end security for every server in the bare metal fleet, from supply chain and provisioning through hardening, operation, and secure decommissioning.
• Design and maintain hardened golden OS images with automated vulnerability scanning, patch pipelines, and configuration-drift detection.
• Define and enforce the BMC security model (access control, credential rotation, audit logging, firmware integrity) for one of the most under-defended surfaces in the industry.
• Partner with network engineering on micro‑segmentation, IDS/IPS, and firewall architecture, applying zero‑trust from the top‑of‑rack up.
• Implement data‑at‑rest encryption, key management, and secure storage access at fleet scale, and build the automation that makes secure‑by‑default the path of least resistance.
• Lead threat modeling and security reviews for new hardware platforms and network designs, and respond to incidents touching the physical fleet.

Skills

Bare metal / IaaS security

Linux hardening

Network security

Encryption implementation

Python/Go/Rust programming

Configuration management tools

Security standards (SOC 2, ISO 27001,,

Tools

OpenBMC

iDRAC

iLO

Job description

Fluidstack is seeking an experienced security engineer to own end-to-end security for bare metal infrastructure. You will harden systems, design golden images, and enforce secure BMC controls across fleets, while collaborating with network teams on zero-trust architectures.

You’ll implement encryption, manage keys, and lead threat modeling for new hardware deployments. The role requires deep Linux security, automation in Python/Go/Rust, and experience with OpenBMC/Open-source security stacks.