Senior Security Engineer

Runware is the AI inference platform that builds and runs its own infrastructure, end to end. Our Sonic Inference Engine has served more than 20 billion requests for over 1 million developers and 500 million end users, with 400,000+ models behind a single integration, at up to 10x lower cost per token than traditional providers.

We are now building the AI Factory that runs it. The Sonic Inference Pod packs 1 MW of custom-designed compute into a 20-foot container with closed-loop, water-free cooling, sited wherever power exists. Pods are live in the US and Europe, and we are scaling to dozens of pods and tens of thousands of GPUs, all operated as one distributed fabric that reroutes traffic the moment a pod goes offline (announcement).

Every one of those pods holds customer models, customer data and millions of dollars of GPUs, sometimes inside a customer's own perimeter or a sovereign jurisdiction. Keeping all of it secure without slowing anyone down is the job.

The role

As Senior Security Engineer, you will own the security of Runware's AI supercomputer: the bare-metal GPU fleet, the Sonic Inference Pods it lives in, the managed Kubernetes clusters we hand to customers, and the control plane that ties it all together across the US and Europe. You will design the controls, build the first version with your own hands, and set the standard for how security is run across every pod.

This is a hands-on senior individual-contributor role. You will threat-model a new pod before it ships, harden the image that every GPU node boots from, prove to an enterprise customer's security team that their model weights never leave their tenant, and when something goes wrong, lead the response and fix the root cause so it never happens again. You will work directly with our CISO, with the inference engine, platform and hardware teams, and with the site teams deploying pods.

Success means a customer workload on a shared pod is isolated as strongly as on a dedicated one, no human has a standing login to a production node, every change to the fleet is reviewed, signed and auditable, and an enterprise security review takes days instead of months.

What you'll do

Own the security architecture of the fleet: host hardening for bare-metal GPU nodes, immutable images and a signed build pipeline, boot integrity, and the identity, secrets and access model for humans and services across every pod.

Secure multi-tenancy on shared infrastructure. Design and verify isolation between customer workloads at the network, Kubernetes, host and GPU layers, and produce the evidence that proves it holds.

Secure the managed Kubernetes offering: cluster hardening, admission control, RBAC, supply-chain controls for images, and a clean, auditable handover of clusters to customers.

Build security visibility across the fleet: logging, detection, alerting and audit trails from firmware to API, wired into the fleet dashboards and on-call so that an anomaly on one node in one pod is seen within minutes.

Lead security reviews and threat models for new pods, sites, servers and platform features, with a focus on real-world risk rather than checklists.

Run incident response for the infrastructure: investigation, containment, recovery and post-incident learning, as part of the on-call rotation.

Own vulnerability management for the fleet: firmware, kernel, drivers, GPU stack and container images across thousands of nodes, with a patch cadence you can defend to a customer.

Answer enterprise customers' security due diligence with engineering evidence, and partner with the CISO on the SOC 2 and ISO 27001 controls that touch the infrastructure.