Security Engineer - Remote

Originally posted 16 September 2026 by the employer.

This role secures software, build systems, and cloud infrastructure for MatX products.

About the role

This role is responsible for securing the software, build systems, and cloud infrastructure that MatX products are designed, verified, and delivered on.

What you'll do

• Own and grow our supply chain and build integrity program, including dependency and third-party IP provenance, artifact signing, code signing, SBOM generation, and hardening CI/CD systems.
• Perform hands-on security assessments of code, build tooling, internal services, developer platforms, and systems holding design data, including manual code review and application/API testing.
• Conduct vulnerability research against systems built and depended on, turning findings into fixes and controls.
• Partner with software, compiler, ML, and silicon teams on threat modeling and design review for new systems.
• Harden cloud infrastructure, focusing on identity and access management, network segmentation, secrets management, and infrastructure-as-code review.
• Build and run the vulnerability management program, including discovery, triage, prioritization, and driving remediation.
• Integrate security into the SDLC with code scanning, dependency policy, pre-merge checks, and secrets detection.
• Write automation, tooling, and services to scale security work, such as internal utilities and developer-facing tools.

What you'll need

• 8+ years in security engineering with depth in at least two of application and product security, offensive security, cloud infrastructure security, or supply chain and build security.
• Strong application security fundamentals: threat modeling, manual secure code review, common vulnerability classes, and experience running SAST, DAST, and SCA tooling.
• Hands-on offensive experience in penetration testing, red team engagements, or vulnerability research with current-day fluency in application and cloud attack paths.
• Strong software engineering skills, including shipping production-quality code (Go, Python, Rust) and reading code in other languages.
• Working knowledge of at least one major cloud provider (GCP, AWS, or Azure) including IAM models, network architecture, secrets management, and logging.
• Familiarity with modern supply chain and build integrity concepts: artifact signing, provenance, attestation, SBOMs, and CI/CD as an attack surface.
• A track record of shipping fixes with development teams.
• Comfort operating with ambiguity and breadth.

Nice to have

• Direct experience implementing supply chain security tooling and standards (Sigstore/cosign, SLSA, SBOM formats).
• Experience with containers and infrastructure-as-code (Terraform).
• Experience securing environments with high-value IP or export-controlled technical data.
• Familiarity with EDA, hardware design, or ML training infrastructure and their specific security problems.
• Experience with hardware or firmware supply chain concerns: secure boot, firmware signing, code signing infrastructure, HSM or KMS-backed key management.
• Experience standing up a security function at a high-growth startup, including its first compliance efforts.
• Contributions to open source security tooling, published research, or conference talks.

Skills: supply chain security, build integrity, code signing, vulnerability research, threat modeling, cloud infrastructure security