Deepgram - Security Engineer
Requirements
• Solid experience in security engineering or infrastructure engineering with a security focus — enough that you have owned controls in production, not just recommended them. • Deep Linux. You should be comfortable hardening, debugging, and reasoning about a large fleet of physical Linux hosts — users and sudo, SSH, systemd, kernel and package updates, host firewalls, and what a host-based agent is actually doing. • Ansible at fleet scale is required. You automate first and document second. • Strong scripting. Python and/or Go, plus real shell competence. • Production experience securing Docker containers and the pipelines that build them. • Hands-on experience securing GitHub and GitHub Actions: branch protection, CODEOWNERS, workflow permissions, secrets, and third-party action risk. • Experience running vulnerability and patch management as an ongoing program — including the unglamorous part, which is getting other teams to actually ship the fix. • Experience managing third-party penetration tests from the inside: scoping them well, and turning a report into closed engineering work rather than a PDF in a folder. • Hands-on involvement in at least one formal audit — ISO 27001, PCI DSS, or SOC 2 — as the engineer producing and defending evidence, not only as a reader of the report. • Comfortable using AI coding and agentic tools in daily work, and clear-eyed about their risks: prompt injection, secret leakage, and supply chain exposure. • Pragmatic. Controls that block shipping without a proportionate risk reduction get routed around, and we would rather you name the trade-off than pretend it does not exist. • Datacenter or colocation experience: network segmentation, out-of-band management (IPMI/BMC), physical and vendor controls. • Detection engineering or SIEM/HIDS ownership at scale (for example Wazuh, OSSEC, Elastic). • Secrets management with HashiCorp Vault. • AWS security (IAM, SCPs, VPC) and Terraform. • Kubernetes security. • Offensive security background: penetration testing or red teaming. • PCI DSS work inside a cardholder data environment. • Ownership of a secure SDLC program. • Experience with GPU infrastructure, ML platforms, or multi-tenant inference workloads. • Certifications such as OSCP, GIAC, CISSP, or AWS Security Specialty. • Notice: We're aware of individuals impersonating Deepgram recruiters. All legitimate Deepgram recruiting communication comes from an @deepgram.com email address. If you've received a message claiming to be Deepgram, please forward it to [email protected]. • Notice
Responsibilities
• Build, deploy, and maintain security controls across our bare-metal fleet and AWS footprint — access management, network segmentation and firewalling, encryption and secrets management, logging and detection coverage, endpoint security, and vulnerability management. • Own configuration management and host hardening as code with Ansible, so baselines are reproducible across hundreds of Linux hosts and drift is detectable rather than merely documented. • Secure containerized workloads: Docker image build pipelines, registry scanning, runtime hardening and detection, and secrets management. • Run vulnerability management end to end — discovery, prioritization by real exploitability rather than raw CVSS, driving remediation with engineering teams, and reporting on it. • Own patch and update management as a program: the server fleet, the endpoint fleet, base images, OS and package updates, firmware where it matters, and dependency upgrades. Set and hold patch SLAs, track exceptions, and automate the routine cases so they do not depend on anyone remembering. • Own the penetration testing lifecycle: scoping and vendor selection, scheduling, triaging findings into engineering work with real owners and dates, verifying fixes on retest, and producing the summary we can share with customers. • Write detections, tune out noise, and take part in incident response. Improve log, telemetry, and security-agent coverage where we are blind. • Run periodic log and access reviews as a standing control, and automate the collection so each cycle produces its own evidence rather than a scramble. • Automate compliance evidence collection for SOC 2, PCI DSS, and ISO 27001, and support audit fieldwork on technical questions — the GRC lead owns the auditor relationship and the narrative; you own the systems that make the evidence true and repeatable. • Harden GitHub Actions CI/CD and the software supply chain: dependency and secret scanning, action pinning, SBOM, artifact and image signing, least-privilege OIDC in place of long-lived credentials. • Provide the technical input behind customer-facing security work: questionnaire and architecture answers, penetration test summaries, and hardening guidance for customers running Deepgram self-hosted.
Benefits
• Tier 1(San Francisco, Seattle, NYC) $165K – $245K • Offers Equity • Offers Bonus • 10% Annual Bonus • Tier 2(Everywhere else in US) $150K – $225K • Offers Equity • Offers Bonus • 10% Annual Bonus • This range is determined by work location and additional factors, including job-related skills and experience. There may be instances where a salary higher or lower than this range may be appropriate for a candidate whose qualifications differ meaningfully from those listed in the job description. Please note that the compensation details listed on US role postings reflect the base salary only and does not include bonus, equity or benefits. • Upload your resume here to autofill key application fields. • Drop your resume here! • Parsing your resume. Autofilling key fields... • Please Note: we have set up limits for applications for this role. It is in the General Application Limit Setting group. The following limits apply to applications for all jobs within this group: • General Application Limit Setting • Candidates may not apply more than 2 times in any 60 day span for any job in the General Application Limit Setting Group. • Candidates may not re-apply to the same role within 180 days if not presented with an offer • or drag and drop here • The city you currently live in. Start typing and select from the list. • Decline to self-identify • Hispanic or Latino - A person of Cuban, Mexican, Puerto Rican, South or Central American, or other Spanish culture or origin regardless of race. • Hispanic or Latino • White (Not Hispanic or Latino) - A person having origins in any of the original peoples of Europe, the Middle East, or North Africa. • White • Black or African American (Not Hispanic or Latino) - A person having origins in any of the Black racial groups of Africa. • Black or African American • Native Hawaiian or Other Pacific Islander (Not Hispanic or Latino) - A person having origins in any of the peoples of Hawaii, Guam, Samoa, or other Pacific Islands. • Native Hawaiian or Other Pacific Islander • Asian (Not Hispanic or Latino) - A person having origins in any of the original peoples of the Far East, Southeast Asia, or the Indian Subcontinent, including, for example, Cambodia, China, India, Japan, Korea, Malaysia, Pakistan, the Philippine Islands, Thailand, and Vietnam. • Asian • American Indian or Alaska Native (Not Hispanic or Latino) - A person having origins in any of the original peoples of North and South America (including Central America), and who maintain tribal affiliation or community attachment. • American Indian or Alaska Native • Two or More Races (Not Hispanic or Latino) - All persons who identify with more than one of the above five races. • Two or More Races • Hispanic or Latino • White (Not Hispanic or Latino) • Black or African American (Not Hispanic or Latino) • Native Hawaiian or Other Pacific Islander (Not Hispanic or Latino) • Asian (Not Hispanic or Latino) • American Indian or Alaska Native (Not Hispanic or Latino) • Two or More Races (Not Hispanic or Latino) • I identify as one or more of the classifications of protected veteran listed above • I am not a protected veteran
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT