# Security Engineer, Host Assurance

**Company:** [OpenAI](https://hotfix.jobs/companies/openai)
**Location:** San Francisco, CA, Seattle, WA
**Role:** Security Engineering
**Salary:** $293k – $385k/yr
**Skills:** Pki, Hsm, Applied Cryptography, Secure Boot, Host Attestation, Firmware Security, Hardware Security, Machine Identity, Certificate Management, Key Management
**Posted:** 2026-04-01

> Builds and operates Host Assurance platform to establish trust in bare-metal hosts for OpenAI's global infrastructure. Requires strong software engineering, deep expertise in PKI/HSM/cryptography/secure boot/host attestation, and ability to work across hardware-software boundaries at scale.

## Job Description

## Responsibilities
- Design, build, and operate components of the Host Assurance platform that establish trust in bare-metal hosts before they are eligible for production use.
- Help ensure hosts are verifiably trustworthy from delivery and installation through secure bootstrap and readiness to join orchestration systems.
- Build and improve systems such as machine identity, certificate issuance and enrollment, **HSM**-backed or key-management-backed trust services, host attestation, measurement, and baseline verification tooling.
- Validate delivered hardware and firmware against vendor claims and continuously detect and manage drift over time.
- Eliminate insecure bootstrap patterns while preserving deployment throughput and operational reliability. Partner with provisioning, fleet, and orchestration teams to deliver paved paths where the secure approach is the easiest approach.
- Contribute code, reviews, operational improvements, and design guidance for foundational trust services that must be dependable at scale.
- Help define observable, testable security properties for host platforms and improve the telemetry and validation needed to enforce them in practice.
- Participate in incident response, debugging, and post-incident improvements for security-critical infrastructure.
- Work across different deployment models and provider boundaries while maintaining a consistent bar for host trust outcomes.

## Requirements
- Strong software engineering experience building and operating reliable production systems at scale.
- Deep expertise in at least one relevant domain such as **PKI**, **HSMs**, machine identity, applied cryptography, secure boot, firmware or hardware security, host attestation, or low-level platform security.
- Comfortable working across systems boundaries, from services and APIs down to host, boot, firmware, or hardware-adjacent trust mechanisms.
- Can write production quality code and reason clearly about failure modes, operational safety, and long-term maintainability.
- Experience replacing fragile or manual security mechanisms with durable, paved-path infrastructure.
- Balance rigor with pragmatism, and care about making strong security controls deployable in real-world environments.
- Self-directed, low ego, and willing to work across disciplines to solve the most important problems.
- Enjoy building in ambiguous spaces where the architecture is still emerging, stakes are at all time high, and the future is being built.

## Similar roles

- [Security Engineer, Detection and Response](https://hotfix.jobs/jobs/b02c5533-5c6f-4a14-9352-1a06e1f7b1fd) - OpenAI - San Francisco, CA - $293k – $385k/yr
- [Security Engineer, Agent Security](https://hotfix.jobs/jobs/dc83643f-9f40-4224-a248-6a53c33f06a2) - OpenAI - San Francisco, CA - $293k – $385k/yr
- [Researcher, Automated Red Teaming](https://hotfix.jobs/jobs/c8bad9d3-b859-4225-a74f-118514d784b4) - OpenAI - San Francisco, CA - $295k – $445k/yr
- [Security Engineer, Detection & Response](https://hotfix.jobs/jobs/8fbbaee5-e02c-4617-8eba-262d886cda43) - Anthropic - San Francisco, CA - $300k – $405k/yr
- [Threat Collections Engineer](https://hotfix.jobs/jobs/c0c31e7e-6d1b-48ef-a06a-69c21286e94b) - Anthropic - San Francisco, CA - $300k – $320k/yr

**Apply:** https://hotfix.jobs/jobs/b25f415d-5149-4104-a91a-384cc6f42e57
**Canonical:** https://hotfix.jobs/jobs/b25f415d-5149-4104-a91a-384cc6f42e57