SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Fluidstack is building civilization-scale AI compute infrastructure, acquiring power, designing and operating data centers globally. The Security team is standing up a comprehensive security program from scratch as the company scales across continents.
In this role, you will own exposure and vulnerability management across Fluidstack's entire estate: external attack surface, cloud and Kubernetes environments, corporate endpoints (macOS, Windows, Linux), network infrastructure, and bare-metal fleet. You'll extend coverage to the corporate fleet, managing OS and application patch posture, first-party and third-party software, and drift from approved baselines.
Key responsibilities include:
- Building engineering solutions for vulnerability management: asset inventory, scanner orchestration, deduplication, and prioritization based on reachability and real-world exploitation rather than raw CVSS scores
- Identifying and assessing unmanaged software and SaaS, package-level software (npm, PyPI, Homebrew), browser and IDE extensions, driving findings to remediation or removal
- Engineering remediation into existing team workflows so findings become owned tickets, fixes ride existing pipelines, and closure verifies automatically
- Remediating vulnerabilities alongside teams that own systems: writing patch PRs, hardening base images, fixing IaC modules, shipping config changes
- Extending the program beyond enterprise playbooks: BMC and device firmware, GPU drivers, host images at fleet scale, data center equipment
- Running intake for pen test findings and external reports, reporting exposure honestly on reachability, wild exploitation, and accepted risk
The threat surface is measured in gigawatts. Model weights training on Fluidstack's infrastructure are the most valuable and targeted artifacts in technology. A breach isn't a leak—it's the frontier walking out the door. You'll be securing the most consequential technology in human history.
Fluidstack operates with full autonomy, insane urgency, first-principles reasoning, and a focus on building something that actually matters. The company hires people who care deeply about this problem space and are willing to put in long hours at high intensity.
REQUIREMENTS:
- Built vulnerability management as an engineering problem: pipelines, automation, and integrations rather than spreadsheet triage
- Write production-quality automation (Python or similar) and have wired scanners, asset systems, and ticketing into coherent solutions
- Run prioritization that survives contact with reality: KEV, EPSS, reachability, and judgment to overrule all three
- Fixed vulnerabilities yourself in someone else's codebase or infrastructure; pull requests got merged because they were good, not because security demanded it
- Driven remediation at scale through teams that don't report to you while keeping SLAs credible without burning relationships
- Can take a technology class most programs never touch (firmware, GPU stacks, data center equipment) and stand up a defensible assessment approach instead of waiting for a vendor
- Run vulnerability and exposure coverage on corporate endpoints and third-party software, including unmanaged long tail of shadow apps, packages, and extensions
BONUS: External attack surface management platforms, firmware or BMC security depth, CSPM/KSPM tooling, exploit development or reachability validation, endpoint management and patching tooling (MDM, EDR), software inventory, extension and supply chain risk.
