MTS - Security Engineer

About Ironsite Ironsite is building the intelligence layer for the physical world. We design our own wearable hardware, deploy it alongside craft workers, and transform a shift's footage into a next-morning report. Our internal team and purpose-built models label the data overnight and deliver actionable insights to superintendents by 5 AM. We are accelerating the speed, efficiency, and predictability of construction, especially for complex, mission-critical infrastructure projects, including data centers, LNG facilities, sports stadiums, hospitals, and other large-scale developments, by training AI models on egocentric construction footage and labor productivity data. We are built with a pro-worker philosophy at our core: we believe technology should empower the workforce, not replace it. We're working to give craft workers and project leaders better visibility into what's happening on-site, while creating a system where the reality of construction and the chaos of each day are finally available to the people running the project. Ironsite is deployed across several of the largest active construction projects in the country. To date, we've captured more than 100,000 hours of construction footage across seven states, now process thousands of hours of site activity every day, and maintain a worker opt-out rate below two percent. This is enabled by a workforce-first architecture that anonymizes devices, captures no audio, and never releases raw video. Ironsite is backed by leading investors (8VC, South Park Commons, Saga Ventures) and prominent operators across technology and construction, including Eric Schmidt, Jeff Dean, Jeff Rothschild, Mark Leslie, Scott Wu, Eric Glyman, Karim Atiyeh, Russell Kaplan, and others, alongside over a dozen construction industry operators who have joined us as partners in building this. Longer term, we believe Ironsite is the foundation for what construction becomes in the next decade. The systems we're building will be the operating system for how the physical world gets built. We see a future where craft workers are more valued, more visible, and better paid for the skill they bring, and where the industry finally has the intelligence layer that makes autonomous construction possible. Both start with the same foundation. The Role We're hiring our first Security Engineer to own security from every angle: a wearable camera fleet and the jobsite networks it runs on, petabyte-scale video and ML systems, the cloud they live in, the platform our customers log into, and the AI agents our engineers now build with every day. AI agents now find and exploit vulnerabilities faster than vendors can patch. A model wrote a working remote-root exploit for the Linux kernel this fall, and the CVE stream across libraries, runtimes, kernels, CAs, and vendors has become a firehose. Knowing exactly what we run, everywhere, and responding methodically is the core of the job. Alongside it, you'll protect first-person video of thousands of workers, the sites of critical infrastructure under construction, and our promise that raw video never leaves. Some of the Things You’ll Work On Software supply chain security. A living SBOM across firmware, edge, cloud, ML, and laptops. Package firewalls in front of every install (we run Socket today). Minimal, continuously rebuilt base images, and build attestations verified at deploy time, so everything in prod traces back to reviewed code. Plus vendor risk. Upstream incident response. When a CA, runtime, library, kernel, or vendor is compromised, you'll work out the blast radius in hours. That means every container, CI runner, host, device, and engineer laptop. Then you ship the fix to cloud and to an often-offline device fleet. Device and firmware security. Secure boot, signed OTA, hardware-backed identity, and encryption, so a lost device is a dead brick, not a data source. Privacy by architecture. Worker anonymization and the no-raw-video guarantee enforced by systems, with audits that prove it. Network, cloud, and ML platform security. Zero-trust jobsite and overlay networks, and least-privilege, keyless access (workload identity, short-lived credentials, MFA-gated admin) to video, model weights, and production data. Infrastructure as code you can audit. Detection and triage across the fleet and cloud that tells a routine deploy from an intruder fast. Application and agent security. Tenant isolation and authorization across our API. Hardening the AI agents and automation that read our code, run our tooling, and touch production. Making agent-assisted code review and pentesting a standard part of how we ship. Technical Challenges You'll Solve CVE volume that outpaces humans. MTTE (mean time to exploit) is going negative. Build the automation, much of it agent-driven, that lets a small team keep up: triage against what's actually deployed and reachable, not just what's installed, and patch devices that stay offline for days. One SBOM from silicon to models. Chip SDKs, embedded Linux, kernels, container images, cloud services, CI, ML frameworks, and weights, all in one accurate, decision-ready graph. Physical access is a given. Thousands of cameras in uncontrolled environments need a threat model, alerting, and revocation that hold anyway. The seams. The real risk lives where hardware, firmware, network, cloud, ML, and agents meet: a field device on the same overlay network as production, an agent with shell access, an internal tool deployed straight from a laptop. You'll see all of them. What We're Looking For Hands-on supply chain security: SBOMs that drive decisions (CycloneDX, including ML-BOM/CBOM), reachability-aware vulnerability management at scale, build and deploy provenance verified at deploy time, dependency firewalls, and upstream incident response. Security engineering depth in at least two of embedded/IoT, networks, cloud, and application security. Applied cryptography and PKI: device identity, key management, certificate lifecycles and trust stores (and what to do when a CA is compromised). Strong threat-modeling judgment and real incident response experience, including telling a false positive from a breach under pressure. A record of building security into systems engineers actually adopt: guardrails in CI and infrastructure as code, not tickets. Typically 4+ years of experience, 1-2 at a senior level; CS or related degree, or equivalent experience. Preferred Qualifications Artifact attestations and trusted publishing in production (in-toto, Sigstore/cosign, GitHub attestations), VEX to cut noise, and CI/CD hardening (OIDC, pinned actions, runner egress control). Using AI agents defensively for triage, code review, or vuln discovery, and securing the agents themselves (permissions, sandboxing, prompt injection). Securing hardware end to end: secure boot, secure elements, OTA. Privacy engineering for video or biometric data. Offensive or hardware security experience. Compliance programs (SOC 2, ISO 27001, GDPR, etc.) run as engineering rather than paperwork. Location, Compensation, & Perks San Francisco Bay Area (on-site) Base salary: $230k-$280k per year, commensurate with experience Meaningful early-stage team equity. Ability to purchase xPU or devices for development Full benefits including health, dental, vision, and 401(k) with 6% match Daily catered lunch Office in San Francisco, next to Oracle Park and the Caltrain Final compensation is determined by experience, location, and level.