Senior GPU Isolation & Kernel Security Engineer

fal - Features & Labels; San Francisco (CA); On-site; USD 180,000 - 250,000; Full time

Benefits offered by this job

Health, dental, and vision insurance (

Visa sponsorship and relocation to San

Regular team events and offsites

Interesting and challenging work

Significant learning and growth

Job summary

Cybersecurity Jobs is seeking an experienced Security Engineer to secure fal.ai’s compute platform, spanning Linux kernel, virtualization, and GPU driver layers. You will build robust isolation for shared GPU infrastructure, drive security improvements, and reduce real-world risk across the stack.

You will implement threat models, validate GPU isolation controls, and coordinate with Detection & Response, Infra, and ML teams to ensure secure defaults and rapid mitigations.

Qualifications

• 5+ years in systems or security engineering focusing on the Linux kernel, hypervisors, or device drivers.
• Fluent in kernel C; proficient with Rust, Go, or Python for tooling.
• Strong virtualization internals knowledge (KVM, VFIO, IOMMU/DMA).
• Experience shipping production hardening at fleet scale.

Responsibilities

• Develop and maintain a threat model for executing code on shared GPU hosts, covering containers and microVMs down to PCIe, IOMMU/DMA.
• Design and validate GPU isolation controls, including memory scrubbing and device-state scrubbing between tenants.
• Support deployment of hardware-backed isolation, confidential computing, and attestation.
• Harden kernel builds and host images using config minimization, LSMs, seccomp, and namespace/cgroup policy.
• Reduce attack surface across GPU components including drivers, CUDA runtimes, and NVLink/NVSwitch fabrics.
• Assess and triage security vulnerabilities in kernel, hypervisors, GPU drivers, and firmware; drive fixes or mitigations.
• Monitor vendor bulletins; patch kernel and drivers without fleet disruption.
• Perform vulnerability research on key dependencies.
• Contribute to host and isolation security roadmap and tooling.
• Coordinate with Detection & Response on telemetry; serve as escalation point for host, kernel, and driver incidents.
• Review security-relevant designs from Infra, Platform, and ML teams to make secure approaches default.
• Collaborate with GPU vendors, cloud providers, and upstream maintainers on disclosures and fixes.

Skills

Kernel C

Rust

Go

Python

KVM

VFIO

Tools

KVM

VFIO

IOMMU

Job description

Cybersecurity Jobs is seeking an experienced Security Engineer to secure fal.ai’s compute platform, spanning Linux kernel, virtualization, and GPU driver layers. You will build robust isolation for shared GPU infrastructure, drive security improvements, and reduce real-world risk across the stack.

You will implement threat models, validate GPU isolation controls, and coordinate with Detection & Response, Infra, and ML teams to ensure secure defaults and rapid mitigations.