Infrastructure Security Engineer

About the role

Runway-ml is seeking an Infrastructure Security Engineer to secure the platform used for training and serving advanced AI models. This remote position involves working on Kubernetes security, cloud identity, software supply chain, and tenant isolation.

Key responsibilities

• Design and implement security controls in Kubernetes, including admission policies, RBAC, workload identity, network policies, and runtime hardening.
• Harden the software supply chain with package firewalls, artifact signing, provenance, and admission controls.
• Develop and maintain cloud IAM architecture with least‑privilege roles, short‑lived credentials, and workload federation.
• Secure research infrastructure and training pipelines while maintaining performance.
• Threat model new platform components and translate findings into actionable requirements.
• Write infrastructure‑as‑code and policy‑as‑code, treating security changes like any other production change.
• Provide rapid incident response support for infrastructure‑related issues.

Required profile

• Hands‑on experience securing Kubernetes in production, including admission policies and RBAC debugging.
• Working knowledge of cloud IAM and networking on a major cloud platform.
• Experience with infrastructure‑as‑code, GitOps‑style deployments, and shipping security changes through CI/CD pipelines.
• Proficiency in Python, Typescript, Rust, or similar languages for building tooling.
• Understanding of software supply chain attacks and controls such as signing, provenance, and SBOMs.

Required skills

• Kubernetes security
• Cloud IAM (AWS, GCP, or Azure)
• Python
• Typescript
• Rust
• GitOps / Infrastructure as Code
• Policy engines (Kyverno, OPA Gatekeeper, Falco)
• Software supply chain security (SBOM, artifact signing)