Own security across Ironsite’s wearable devices, firmware, jobsite networks, cloud, ML systems, customer platform, and AI agents. Responsibilities include software supply-chain security, SBOM management, vulnerability and incident response, device identity and encryption, privacy enforcement, zero-trust networking, cloud and application security, infrastructure-as-code guardrails, detection, and agent security. The role protects sensitive worker video and critical infrastructure data while building scalable, automated security systems.
About Ironsite
The Role
Some of the Things You’ll Work On
Technical Challenges You'll Solve
What We're Looking For
Preferred Qualifications
Location, Compensation, & Perks
Ironsite is building the intelligence layer for the physical world. We design our own wearable hardware, deploy it alongside craft workers, and transform a shift's footage into a next-morning report. Our internal team and purpose-built models label the data overnight and deliver actionable insights to superintendents by 5 AM.
We are accelerating the speed, efficiency, and predictability of construction, especially for complex, mission-critical infrastructure projects, including data centers, LNG facilities, sports stadiums, hospitals, and other large-scale developments, by training AI models on egocentric construction footage and labor productivity data. We are built with a pro-worker philosophy at our core: we believe technology should empower the workforce, not replace it. We're working to give craft workers and project leaders better visibility into what's happening on-site, while creating a system where the reality of construction and the chaos of each day are finally available to the people running the project.
Ironsite is deployed across several of the largest active construction projects in the country. To date, we've captured more than 100,000 hours of construction footage across seven states, now process thousands of hours of site activity every day, and maintain a worker opt-out rate below two percent. This is enabled by a workforce-first architecture that anonymizes devices, captures no audio, and never releases raw video.
Ironsite is backed by leading investors (8VC, South Park Commons, Saga Ventures) and prominent operators across technology and construction, including Eric Schmidt, Jeff Dean, Jeff Rothschild, Mark Leslie, Scott Wu, Eric Glyman, Karim Atiyeh, Russell Kaplan, and others, alongside over a dozen construction industry operators who have joined us as partners in building this.
Longer term, we believe Ironsite is the foundation for what construction becomes in the next decade. The systems we're building will be the operating system for how the physical world gets built. We see a future where craft workers are more valued, more visible, and better paid for the skill they bring, and where the industry finally has the intelligence layer that makes autonomous construction possible. Both start with the same foundation.
We're hiring our first Security Engineer to own security from every angle: a wearable camera fleet and the jobsite networks it runs on, petabyte-scale video and ML systems, the cloud they live in, the platform our customers log into, and the AI agents our engineers now build with every day.
AI agents now find and exploit vulnerabilities faster than vendors can patch. A model wrote a working remote-root exploit for the Linux kernel this fall, and the CVE stream across libraries, runtimes, kernels, CAs, and vendors has become a firehose. Knowing exactly what we run, everywhere, and responding methodically is the core of the job. Alongside it, you'll protect first-person video of thousands of workers, the sites of critical infrastructure under construction, and our promise that raw video never leaves.
- Software supply chain security. A living SBOM across firmware, edge, cloud, ML, and laptops. Package firewalls in front of every install (we run Socket today). Minimal, continuously rebuilt base images, and build attestations verified at deploy time, so everything in prod traces back to reviewed code. Plus vendor risk.
- Upstream incident response. When a CA, runtime, library, kernel, or vendor is compromised, you'll work out the blast radius in hours. That means every container, CI runner, host, device, and engineer laptop. Then you ship the fix to cloud and to an often-offline device fleet.
- Device and firmware security. Secure boot, signed OTA, hardware-backed identity, and encryption, so a lost device is a dead brick, not a data source.
- Privacy by architecture. Worker anonymization and the no-raw-video guarantee enforced by systems, with audits that prove it.
- Network, cloud, and ML platform security. Zero-trust jobsite and overlay networks, and least-privilege, keyless access (workload identity, short-lived credentials, MFA-gated admin) to video, model weights, and production data. Infrastructure as code you can audit. Detection and triage across the fleet and cloud that tells a routine deploy from an intruder fast.
- Application and agent security. Tenant isolation and authorization across our API. Hardening the AI agents and automation that read our code, run our tooling, and touch production. Making agent-assisted code review and pentesting a standard part of how we ship.
- CVE volume that outpaces humans. MTTE (mean time to exploit) is going negative. Build the automation, much of it agent-driven, that lets a small team keep up: triage against what's actually deployed and reachable, not just what's installed, and patch devices that stay offline for days.
- One SBOM from silicon to models. Chip SDKs, embedded Linux, kernels, container images, cloud services, CI, ML frameworks, and weights, all in one accurate, decision-ready graph.
- Physical access is a given. Thousands of cameras in uncontrolled environments need a threat model, alerting, and revocation that hold anyway.
- The seams. The real risk lives where hardware, firmware, network, cloud, ML, and agents meet: a field device on the same overlay network as production, an agent with shell access, an internal tool deployed straight from a laptop. You'll see all of them.
- Hands-on supply chain security: SBOMs that drive decisions (CycloneDX, including ML-BOM/CBOM), reachability-aware vulnerability management at scale, build and deploy provenance verified at deploy time, dependency firewalls, and upstream incident response.
- Security engineering depth in at least two of embedded/IoT, networks, cloud, and application security.
- Applied cryptography and PKI: device identity, key management, certificate lifecycles and trust stores (and what to do when a CA is compromised).
- Strong threat-modeling judgment and real incident response experience, including telling a false positive from a breach under pressure.
- A record of building security into systems engineers actually adopt: guardrails in CI and infrastructure as code, not tickets.
- Typically 4+ years of experience, 1-2 at a senior level; CS or related degree, or equivalent experience.
- Artifact attestations and trusted publishing in production (in-toto, Sigstore/cosign, GitHub attestations), VEX to cut noise, and CI/CD hardening (OIDC, pinned actions, runner egress control).
- Using AI agents defensively for triage, code review, or vuln discovery, and securing the agents themselves (permissions, sandboxing, prompt injection).
- Securing hardware end to end: secure boot, secure elements, OTA.
- Privacy engineering for video or biometric data.
- Offensive or hardware security experience.
- Compliance programs (SOC 2, ISO 27001, GDPR, etc.) run as engineering rather than paperwork.
- San Francisco Bay Area (on-site)
- Base salary: $230k-$280k per year, commensurate with experience
- Meaningful early-stage team equity.
- Ability to purchase xPU or devices for development
- Full benefits including health, dental, vision, and 401(k) with 6% match
- Daily catered lunch
- Office in San Francisco, next to Oracle Park and the Caltrain
Final compensation is determined by experience, location, and level.
CompensationThe base pay range for this role is $230,000 – $280,000 per year.
Similar Jobs
Artificial Intelligence • Fintech • Insurance • Marketing Tech • Software • Analytics
Investigates and processes moderately complex to complex workers compensation claims, determining coverage, liability, compensability, reserves, damages, and settlements. The role coordinates litigation, engages experts, conducts negotiations and field investigations, and supports arbitrations and mediations. It also provides technical guidance, mentors team members, assists with caseload management, and participates in quality reviews. Candidates need advanced claims-handling and insurance coverage knowledge, strong negotiation and investigation skills, applicable licenses, and typically a bachelor’s degree with 3–5 years of related experience.
Consumer Web • eCommerce • Information Technology • Retail • Software • Analytics • App development
Provides fast, friendly checkout service; operates registers and self-checkout areas; scans and bags merchandise; processes payments and exchanges; answers customer questions; maintains a clean, safe workstation; and assists with stocking, carts, and other store duties as needed.
Top Skills:
Cash RegisterComputerSelf-Checkout Systems
Consumer Web • eCommerce • Information Technology • Retail • Software • Analytics • App development
Receive and unload freight, stock and organize merchandise, prepare delivery orders, and maintain clean, safe backroom and sales-floor areas. Operate forklifts, pallet jacks, scanners, Zebra phones, balers, and other store equipment. Assist customers, verify deliveries, stage and load orders, and support store operations. The role is physically active, requires safe handling of hazardous materials and lifting up to 75 pounds, and may include evening or overnight shifts.
Top Skills:
BalersForkliftsOrders AppPallet JacksScannersZebra Phones
What you need to know about the San Francisco Tech Scene
San Francisco and the surrounding Bay Area attracts more startup funding than any other region in the world. Home to Stanford University and UC Berkeley, leading VC firms and several of the world’s most valuable companies, the Bay Area is the place to go for anyone looking to make it big in the tech industry. That said, San Francisco has a lot to offer beyond technology thanks to a thriving art and music scene, excellent food and a short drive to several of the country’s most beautiful recreational areas.
Key Facts About San Francisco Tech
- Number of Tech Workers: 365,500; 13.9% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Google, Apple, Salesforce, Meta
- Key Industries: Artificial intelligence, cloud computing, fintech, consumer technology, software
- Funding Landscape: $50.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Sequoia Capital, Andreessen Horowitz, Bessemer Venture Partners, Greylock Partners, Khosla Ventures, Kleiner Perkins
- Research Centers and Universities: Stanford University; University of California, Berkeley; University of San Francisco; Santa Clara University; Ames Research Center; Center for AI Safety; California Institute for Regenerative Medicine


