Staff Kernel Security Engineer

Crusoe Energy Systems; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Health & wellbeing

Time away

401(k) match

Mental wellness

Job summary

Crusoe Energy Systems is seeking a Staff Software Engineer focused on Linux kernel security to strengthen kernel security posture for our AI cloud solutions. You will own CVE triage end to end, drive kernel hardening, and collaborate with hardware, hypervisor, and OS teams to ship secure, high-assurance software.

The role demands deep kernel internals knowledge, secure coding practices, and experience in vulnerability research and tooling for auditing and fuzzing.

Qualifications

• Bachelor’s degree in CS/CE or related field and 5+ years in kernel security or low-level OS security.
• Deep understanding of Linux kernel internals and security mitigations.
• Experience with CVE remediation, secure coding reviews, and kernel hardening.
• Familiarity with hardware security concepts and SGX/SEV is a plus.
• Proven track record in vulnerability research and secure development practices.

Responsibilities

• Kernel hardening enhancements and configuration hardening across kernels and OS components.
• Triage incoming CVEs to assess severity, exploitability, and prioritization.
• Enforce access control, secure boot, and CI guardrails with fuzzing coverage.
• Research vulnerabilities across kernel, drivers, and OS components for proactive mitigations.
• Backport upstream fixes to production and ensure secure development lifecycle practices.
• Develop and use tooling for kernel security auditing, fuzzing, and static/dynamic analysis.
• Provide incident response support for kernel/OS compromises and root-cause analysis.
• Balance security improvements with system performance for high-performance AI infrastructure.

Skills

Linux kernel security

C/C++

Kernel debugging

Security analysis

Vulnerability research

CI/CD security

Mentoring

Education

Bachelor's degree in Computer Science or related field

Tools

GDB

KGDB

Valgrind

AddressSanitizer

Fuzzers

Job description

• The Crusoe Cloud Software Development team is seeking a passionate and experienced Staff Software Engineer specializing in Linux Kernel Security
• This critical role is essential in strengthening the security posture of our core Linux kernel and operating system components, which underpin our cutting-edge hardware and software solutions for the AI cloud
• A deep understanding of Linux kernel internals, security vulnerabilities, mitigation techniques, and secure development practices is paramount for developing reliable, high-assurance systems
• This is a full-time position
• Kernel Hardening & CVE Triage: Implement kernel security enhancements, manage configuration hardening, and triage incoming CVEs to assess severity and exploitability
• Access Control, Boot Security & Guardrails: Enforce mandatory access controls, secure the boot path, and establish CI guardrails and fuzzing coverage to prevent regressions
• Vulnerability Research & Analysis: Research vulnerabilities across kernel, driver, and OS components to build proactive mitigations and backport non-trivial upstream fixes to production
• Secure Development Practices: Establish and advocate for secure coding standards and best practices for kernel-level development. Conduct security-focused code reviews to identify and eliminate potential vulnerabilities early in the development lifecycle
• Security Auditing & Tools: Utilize and develop specialized tools for kernel security auditing, fuzzing, static analysis, and dynamic analysis to uncover hidden vulnerabilities and ensure compliance with security policies
• Incident Response Support: Provide expert support during security incidents involving kernel or OS-level compromises, assisting with root-cause analysis, containment, and recovery efforts
• Performance and Security Balance: Work to ensure that security enhancements do not unduly impact system performance, especially critical for our high-performance AI infrastructure
• First 90 days: Own kernel CVE triage end to end and have shipped at least one backported fix through our full release path. You have an independent read on where our kernel configuration is weakest
• First year: Kernel security response has a defined SLA by severity and we consistently hit it. A hardening baseline is defined, enforced in CI, and rolled out across supported SKUs. Cloud Hypervisor has been audited and the highest-value isolation gaps are closed or scheduled
• Cloud Hypervisor & Isolation: Audit, harden, and reduce privilege across Cloud Hypervisor device models and vhost-user datapaths, contributing upstream security fixes and advancing confidential computing primitives (AMD SEV-SNP, Intel TDX)
• Cross-Functional Collaboration: Collaborate closely with other engineering teams (hardware, hypervisor, OS development, cloud infrastructure, and security operations) to integrate security best practices and ensure a comprehensive security strategy across the stack
• Technical Leadership: Provide technical guidance and mentorship to junior engineers on kernel security best practices, fostering a culture of security awareness and excellence
• Debugging and Root-Cause Analysis: Debug and root-cause a variety of complex security-related issues at the kernel level

Benefits

• Health & wellbeing: Comprehensive health benefits designed to support your overall wellness
• Time away: Paid time off for vacations, family bonding, and unexpected needs
• 401(k) match: Build your financial future with our 401(k) matching program
• Mental wellness: Resources and support for your emotional wellbeing and navigating life’s challenges

Company Values: Embody the Company valuesLinux Kernel Security Expertise: Proven deep knowledge of Linux kernel internals (e.g., memory management, process scheduling, system calls, I/O subsystems) with a strong focus on security aspectsSecure Coding: Strong background in secure coding principles and experience conducting security-focused code reviews, particularly in CVulnerability & Exploitation Knowledge: Solid understanding of common kernel vulnerabilities (e.g., privilege escalation, information disclosure, denial of service) and associated exploitation techniquesHardware Security Concepts: Familiarity with hardware-assisted security features (e.g., Intel SGX, AMD SEV, ARM TrustZone) and their relevance to kernel securityEducation & Experience: Bachelor’s degree in Computer Science, Computer Engineering, or a related field, and a minimum of 5 years of relevant industry experience with at least 3 years focused on low-level operating systems or kernel securityDebugging & Analysis Tools: Proficiency with kernel debugging tools (e.g., GDB, crash, kgdb) and security analysis tools (e.g., valgrind, address sanitizers, fuzzers)First year: Kernel security response has a defined SLA by severity and we consistently hit it. A hardening baseline is defined, enforced in CI, and rolled out across supported SKUs. Cloud Hypervisor has been audited and the highest-value isolation gaps are closed or scheduledSecurity Mitigations: Experience with existing Linux kernel security mitigations (e.g., ASLR, DEP/NX, SMEP/SMAP, KASLR, namespaces, cgroups, LSMs like SELinux/AppArmor)Experience dealing with CVE Remediation and automationSafety and Compliance: Must be able to pass a background checkFirst 90 days: You own kernel CVE triage end to end and have shipped at least one backported fix through our full release path. You have an independent read on where our kernel configuration is weakestBackground in offensive security or penetration testing at the kernel levelFamiliarity with hypervisor security and the interaction between the hypervisor and the guest kernel’s securityExperience with hardware security modules (HSMs) or Trusted Platform Modules (TPMs)Experience with specific kernel security projects or contributions to open-source kernel security initiatives