Remote Platform Security Engineer: Kernel & VM Isolation

Fly.io, Inc.; United States; Remote; USD 180,000 - 225,000; Full time

Job summary

Fly.io, Inc. is seeking a senior security engineer to own the kernel, hypervisor, and host-isolation stack across its platform.

You will harden VMM boundaries, design trust relationships between hosts and the control plane, and patch a custom host kernel to keep systems secure and resilient. You will collaborate with Platform and Networking teams, ensuring correct sandboxing, syscall filtering, and network confinement, while guiding investigations when isolation breaks.

Qualifications

• Shipped non-trivial Linux kernel, KVM or hypervisor work in production.
• Production experience with seccomp filters, jailer or sandbox configuration, or VM isolation hardening.
• Anchoring domain in kernel/sandboxing with credible reach into related areas.

Responsibilities

• Own isolation and sandboxing across two VMMs (Firecracker and Cloud Hypervisor).
• Own host network isolation, including nftables rules and health checks.
• Own trust model between hosts and the control plane and host-to-host operations authentication.

Skills

Linux kernel

KVM/Hypervisor

BPF security

seccomp filters

jailer/sandbox

VM isolation hardening

kernel patching

Job description

Fly.io, Inc. is seeking a senior security engineer to own the kernel, hypervisor, and host-isolation stack across its platform.

You will harden VMM boundaries, design trust relationships between hosts and the control plane, and patch a custom host kernel to keep systems secure and resilient. You will collaborate with Platform and Networking teams, ensuring correct sandboxing, syscall filtering, and network confinement, while guiding investigations when isolation breaks.