---
title: 'Systems Security Engineer at Blacksmith'
canonical: 'https://feeny.ai/job/systems-security-engineer-blacksmith-new-york-7v60v6p40kp9'
type: 'job'
last_seen: '2026-11-05'
---

# Systems Security Engineer at Blacksmith

- **Company:** Blacksmith
- **Location:** New York, NY
- **Compensation:** $225k–$300k
- **Employment:** full-time
- **Work type:** onsite
- **Posted:** 2026-10-30
- **Last confirmed live:** 2026-11-05
- **Apply:** https://jobs.ashbyhq.com/blacksmith/365ce100-6b89-4950-a19f-61bfbce35a3c

## Job description

## About Blacksmith

- We started by building infrastructure to run CI workloads really fast. Our first product helps companies run GitHub Actions substantially faster and cheaper by owning and operating our own global fleet of bare-metal machines rather than renting generic cloud VMs.
- Today, we orchestrate tens of millions of Firecracker VMs each week, running CI for 10,000+ companies and tens of millions in ARR. We’ve grown 20x so far in 2026.
- We operate thousands of bare-metal machines across multiple regions, regularly schedule 300k+ vCPUs concurrently, and run a petabyte-scale Ceph cluster that we manage ourselves.
- We’ve raised $125M from Seed to Series C, led by Sequoia, Google Ventures (GV) & Peak XV Partners, and we’re intentionally building a small, but exceptional team.
- Blacksmith was founded by a team with deep systems and scaling experience, including building search/ads infrastructure at Faire, and operating large distributed systems at Cockroach Labs. Our GTM is led by Jon Boyer, formerly Head of Sales at Zapier.
- We're now extending the same CI infrastructure into a broader platform: running agent sandboxes at scale and building our own background coding agent on top of it.

## The role at Blacksmith

We are looking for a Systems Security Engineer to build and operate security controls at Blacksmith. Your primary focus will be our bare-metal fleet, with responsibility extending to our AWS control plane, application services and the broader organization. This is a hands-on engineering role. You'll work alongside our systems engineers to harden production systems, strengthen workload isolation, and investigate and remediate security issues. You'll partner with our Security Lead to translate security priorities into engineering work.

## What you’ll be doing

- Identify, prioritize and remediate security risks across our bare-metal fleet, AWS control plane, application services and the broader organization.
- Strengthen tenant isolation, host hardening, network boundaries and access controls across our platform.
- Build and operate automated security controls for secure configuration, vulnerability remediation, intrusion detection and response, validating their effectiveness without compromising production reliability or performance.
- Investigate and respond to security incidents, driving remediation through to completion.
- Partner with engineering and IT to establish secure defaults and practical security standards across systems and workflows, balancing security, reliability and usability.

You’re a good fit if you have

- Strong Linux systems experience, with the ability to debug production issues across the kernel, networking and storage stack.
- A practical understanding of security fundamentals, including least privilege, defense in depth and threat modeling, and the ability to translate risks into technical solutions.
- Experience with virtualization and Linux isolation primitives, such as Firecracker, KVM, namespaces and cgroups, and an understanding of their security boundaries and tradeoffs.
- An understanding of storage access controls, tenant isolation and secure data deletion.
- An understanding of how to use eBPF for runtime security monitoring, including observing process, file and network activity to detect suspicious behavior.
- Experience securing production AWS environments, particularly IAM, networking and audit logging.
- The ability to write and debug production code in Go, Rust, C, C++ or similar, and automate security changes through configuration management and infrastructure as code.
- Strong comfort with agent-driven development and debugging, including directing coding agents, reviewing their changes and validating correctness and security.
- A track record of turning ambiguous problems into practical engineering solutions, owning implementation through production rollout, and explaining technical tradeoffs to engineers, leadership and non-technical partners.

We welcome candidates from security engineering, systems engineering and SRE backgrounds. You should bring strong systems fundamentals and a demonstrated interest in securing the infrastructure you operate. Bonus

- You've found or reported CVEs, done container or VM escape research, or competed in CTFs.
- You've secured multi-tenant infrastructure running untrusted workloads, such as CI runners, cloud compute or agent sandboxes.
- You've built or extended eBPF-based detection tooling, turning runtime telemetry into actionable alerts and investigations.
- You've secured software delivery pipelines, including build isolation, artifact signing, image provenance or secrets handling.
- You've operated or secured distributed storage systems such as Ceph or MinIO in production.
- You've secured macOS infrastructure running untrusted workloads.

## Compensation and benefits

- Medical, Vision, and Dental insurance.
- Competitive base + equity.
- 401K match.
- Unlimited PTO.
- Annual offsite.
- Early-exercise stock options.
- 12 weeks fully paid parental leave (US).

## About Blacksmith

## Company Overview
- **One-liner**: Blacksmith is a high-performance CI cloud platform that runs GitHub Actions on purpose-built hardware to accelerate build, test, and deployment workflows.
- **Entity Type**: Private (Startup, backed by Y Combinator and Google Ventures)
- **Headquarters**: San Francisco, CA, USA (with an office in New York City)
- **Founded**: 2024
- **Founders**: Aditya Maru, Aditya "JP" Jayaprakash, and Aayush Shah

## Core Business
- **Primary industry**: Developer Infrastructure / CI/CD (Continuous Integration & Continuous Delivery)
- **Target customers**: B2B, primarily software engineering teams of all sizes (from startups to enterprises) using GitHub Actions
- **Mission or purpose**: To be the compute layer for CI — making developers’ feedback loops as fast as possible by providing a drop-in replacement for GitHub-hosted runners that is faster, more observable, and more cost-efficient.

## Products & Services
- **Blacksmith CI Platform (SaaS)**: A cloud-based service that replaces standard GitHub Actions runners with bare-metal microVMs running on high-performance gaming CPUs. Key features include:
    - **2x faster hardware** (highest single-core performance)
    - **4x faster cache downloads** (co-located caching)
    - **40x faster Docker builds** (NVMe persistence)
    - **Advanced observability** (global log search, inline PR failure comments, job-level insights)
    - **Instant provisioning** and unlimited concurrency
    - Claimed to be 75% more cost-efficient than GitHub runners and a drop-in replacement (one-line YAML change)

## Market Standing
- **Valuation/Market Cap**: Not publicly disclosed
- **Key Metric**: Total Funding (undisclosed amount, but backed by Y Combinator and Google Ventures); also reports **50M+ jobs processed monthly** and **30,000+ happy developers** across **3,000+ organizations**
- **Notable Investors/Partners**: Y Combinator (backed), Google Ventures (backed), and angel investors including Kelsey Hightower (former Distinguished Engineer, Google), Spencer Kimball (CEO, Cockroach Labs), David Cramer (Co-founder, Sentry), Theo Browne (Founder, t3.gg), and Kelvin Beachum (NFL athlete, Arizona Cardinals)
- **Growth Signals**: Launched in 2024, grew to a team of 25, acquired 30,000+ users and 3,000+ customer organizations within the first year, and is actively hiring across engineering, sales, marketing, and operations roles in both San Francisco and New York City.

## Competitive Advantages
- **Purpose-built hardware**: Uses bare-metal gaming CPUs with the highest single-core performance available, specifically optimized for the CI workload, unlike generic cloud VMs from hyperscalers (AWS, GCP, Azure).
- **Co-located caching**: Cache artifacts are stored in the same data center where jobs run, dramatically reducing download times compared to solutions where cache is remote.
- **Cost efficiency**: Claims 75% lower cost than GitHub-hosted runners while providing significantly better performance.
- **Drop-in simplicity**: Integration is a single-line change in the GitHub Actions YAML file, with no credit card required to start.
- **Founding team pedigree**: Founders are University of Waterloo graduates and former engineers at Cockroach Labs and Faire (YC W17), bringing deep infrastructure and scaling expertise.

## Strategic Focus
- **Current priorities**: Scaling the platform to handle increasing job volume, expanding observability features, and building out the go-to-market team (active hiring for Sales, Marketing, and Customer-facing roles).
- **Future direction**: While starting with GitHub Actions, the company plans to expand to other CI platforms such as BuildKite, GitLab, and Jenkins, aiming to become the universal compute layer for CI — going after the $10B CI compute market currently dominated by hyperscalers.

## Why Work Here
- **Culture**: Values-driven environment emphasizing “No passengers,” “Be contrarian,” “Take risks,” “Play hard,” “Show kindness,” and “Stay optimistic.” The team is described as lean (25 people), exceptionally talented, and multidisciplinary.
- **Remote/Hybrid Policy**: Hybrid model with offices in San Francisco and New York City. Roles are listed for specific locations, suggesting in-office presence is expected.
- **Notable Perks**:
    - Competitive salary and equity (with early exercise tax benefits)
    - 5% 401K match (100% on first 3%, 50% on next 2%)
    - Health, dental, and vision insurance
    - Paid family leave
    - Unlimited PTO
    - Birthday off + a Michelin star dinner for you and a +1
    - Team offsites and Michelin star team dinners
    - Choice of mechanical keyboard
    - Lunch on Fridays
- **Engineering Culture**: Small, high-agency team where engineers are expected to own large areas of the product. Strong emphasis on taking risks, moving fast, and building infrastructure from the ground up.

## Sources
1. [blacksmith.sh](https://www.blacksmith.sh/)
2. [blacksmith.sh/company](https://www.blacksmith.sh/company)
3. [blacksmith.sh/careers](https://www.blacksmith.sh/careers)
4. [Y Combinator](https://www.ycombinator.com/companies/blacksmith)
5. [LinkedIn](https://www.linkedin.com/company/blacksmithrun)
6. [Ashby Careers Page](https://jobs.ashbyhq.com/blacksmith)

## Other roles at Blacksmith

- [Developer Marketer](https://feeny.ai/job/developer-marketer-blacksmith-san-francisco-ds98ysjb0ng3) — San Francisco, CA / New York, NY
- [Enterprise Account Executive](https://feeny.ai/job/enterprise-account-executive-blacksmith-san-francisco-xbc99ejvpj0c) — San Francisco, CA
- [Technical Recruiter](https://feeny.ai/job/technical-recruiter-blacksmith-san-francisco-f18t6wc11j85) — San Francisco, CA
- [IT Operations Engineer](https://feeny.ai/job/it-operations-engineer-blacksmith-new-york-8v69s2ssnsy5) — New York, NY
- [Executive Assistant (to the CEO)](https://feeny.ai/job/executive-assistant-to-the-ceo-blacksmith-san-francisco-20e2pvt3189a) — San Francisco, CA
- [Office Manager](https://feeny.ai/job/office-manager-blacksmith-new-york-w9hxy3y3mhvr) — New York, NY
- [Account Executive, Digital Natives](https://feeny.ai/job/account-executive-digital-natives-blacksmith-san-francisco-yz3rxnr3s2vq) — San Francisco, CA / New York, NY
- [Brand Designer](https://feeny.ai/job/brand-designer-blacksmith-san-francisco-sr8gv055fqvp) — San Francisco, CA / New York, NY
- [Enterprise Product Manager](https://feeny.ai/job/enterprise-product-manager-blacksmith-new-york-0aa9egntz0xv) — New York, NY
- [GTM & Ops Recruiter](https://feeny.ai/job/gtm-ops-recruiter-blacksmith-san-francisco-jgevfamc9a62) — San Francisco, CA / New York, NY