Information Security Engineer, Bare Metal

Responsibilities

• Own end-to-end security for every server in the bare metal fleet, from supply chain and provisioning through hardening, operation, and secure decommissioning.
• Design and maintain hardened golden OS images with automated vulnerability scanning, patch pipelines, and configuration-drift detection.
• Define and enforce the BMC security model (access control, credential rotation, audit logging, firmware integrity).
• Partner with network engineering on micro-segmentation, IDS/IPS, and firewall architecture, applying zero-trust from the top-of-rack up.
• Implement data-at-rest encryption, key management, and secure storage access at fleet scale; build automation that makes secure-by-default the path of least resistance.
• Lead threat modeling and security reviews for new hardware platforms and network designs.
• Respond to incidents touching the physical fleet.

Requirements

• Experience in information security or infrastructure engineering with a strong focus on bare metal, IaaS, or high-scale cloud infrastructure.
• Deep Linux hardening (SELinux, AppArmor, kernel-level security).
• Strong network security knowledge (TCP/IP, VPNs, firewall rulesets, zero-trust).
• Practical experience implementing encryption (disk-level LUKS, hardware-level), HSMs, and trusted computing (TPM/TXT).
• Fluency automating in Python, Go, or Rust; experience with configuration management (Ansible, Puppet, Chef).
• Ability to work across engineering teams and communicate security decisions clearly.

Nice-to-Haves

• Experience with BMC platforms (OpenBMC, iDRAC, iLO).
• Knowledge of hardware root of trust and secure boot.
• Familiarity with compliance standards (SOC 2, ISO 27001, FedRAMP).
• Certifications such as CISSP, OSCP, or CEH.