Staff Kernel Security Engineer

Join the Crusoe Cloud Software Development team as a Staff Kernel Security Engineer. In this critical role, you will strengthen the security posture of our core Linux kernel and operating system components.

Responsibilities

• You will implement kernel security enhancements, manage configuration hardening, and triage incoming CVEs.
• You will also enforce mandatory access controls, secure the boot path, and establish CI guardrails and fuzzing coverage.
• Additionally, you will research vulnerabilities across kernel, driver, and OS components, establish secure coding standards, and provide expert support during security incidents.
• This is a full-time position that offers comprehensive health benefits, paid time off, a 401(k) matching program, and resources for mental wellness.
• Implement kernel security enhancements, manage configuration hardening, and triage incoming CVEs to assess severity and exploitability.
• Enforce mandatory access controls, secure the boot path, and establish CI guardrails and fuzzing coverage to prevent regressions.
• Research vulnerabilities across kernel, driver, and OS components to build proactive mitigations and backport non-trivial upstream fixes to production.
• Company Values: Embody the Company values
• Hardware Security Concepts: Familiarity with hardware-assisted security features (e.g., Intel SGX, AMD SEV, ARM TrustZone) and their relevance to kernel security

Requirements

• Linux Kernel Security Expertise: Proven deep knowledge of Linux kernel internals (e.g., memory management, process scheduling, system calls, I/O subsystems) with a strong focus on security aspects
• Secure Coding: Strong background in secure coding principles and experience conducting security-focused code reviews, particularly in C
• Vulnerability & Exploitation Knowledge: Solid understanding of common kernel vulnerabilities (e.g., privilege escalation, information disclosure, denial of service) and associated exploitation techniques
• Education & Experience: Bachelor's degree in Computer Science, Computer Engineering, or a related field, and a minimum of 5 years of relevant industry experience with at least 3 years focused on low-level operating systems or kernel security
• Debugging & Analysis Tools: Proficiency with kernel debugging tools (e.g., GDB, crash, kgdb) and security analysis tools (e.g., valgrind, address sanitizers, fuzzers)
• First year: Kernel security response has a defined SLA by severity and we consistently hit it. A hardening baseline is defined, enforced in CI, and rolled out across supported SKUs. Cloud Hypervisor has been audited and the highest-value isolation gaps are closed or scheduled
• Security Mitigations: Experience with existing Linux kernel security mitigations (e.g., ASLR, DEP/NX, SMEP/SMAP, KASLR, namespaces, cgroups, LSMs like SELinux/AppArmor)
• Safety and Compliance: Must be able to pass a background check
• First 90 days: You own kernel CVE triage end to end and have shipped at least one backported fix through our full release path. You have an independent read on where our kernel configuration is weakest
• Background in offensive security or penetration testing at the kernel level
• Familiarity with hypervisor security and the interaction between the hypervisor and the guest kernel's security

Preferred

Experience dealing with CVE Remediation and automation

• Experience with hardware security modules (HSMs) or Trusted Platform Modules (TPMs)
• Experience with specific kernel security projects or contributions to open-source kernel security initiatives

Pay

USD 215,000 - 260,000