Security Engineer

Deepgram is looking for a Security Engineer to build and automate the technical controls behind its security program. Most infrastructure is bare metal in colocation datacenters, running containerized GPU-intensive workloads on Docker, managed with Ansible, and shipped through CI/CD on GitHub Actions, with AWS used for overflow capacity and a small set of services. Controls must be delivered as code, be reproducible, and produce their own audit evidence. This is a hands-on technical role that reports to the Director of Information Security. The company is open on level, with strong mid-level and senior candidates both in scope.

Responsibilities

Build, deploy, and maintain security controls across the bare-metal fleet and AWS footprint (access management, network segmentation and firewalling, encryption and secrets management, logging and detection, endpoint security, vulnerability management); Own configuration management and host hardening as code with Ansible; Secure containerized workloads (Docker image build pipelines, registry scanning, runtime hardening, secrets management); Run vulnerability management end to end; Own patch and update management as a program; Own the penetration testing lifecycle; Write detections, tune noise, and take part in incident response; Run periodic log and access reviews and automate compliance evidence collection for SOC 2, PCI DSS, and ISO 27001; Harden GitHub Actions CI/CD and the software supply chain; Apply AI and agentic tooling to security work; Provide technical input behind customer-facing security work

Requirements

Solid experience in security engineering or infrastructure engineering with a security focus, including owning controls in production; Deep Linux experience (hardening, debugging, and managing a large fleet of physical Linux hosts, including users and sudo, SSH, systemd, kernel and package updates, host firewalls, and host-based agents); Ansible at fleet scale; Strong scripting in Python and/or Go, plus real shell competence; Production experience securing Docker containers and the pipelines that build them; Hands-on experience securing GitHub and GitHub Actions (branch protection, CODEOWNERS, workflow permissions, secrets, third-party action risk); Experience running vulnerability and patch management as an ongoing program; Experience managing third-party penetration tests from the inside; Hands-on involvement in at least one formal audit (ISO 27001, PCI DSS, or SOC 2) as the engineer producing and defending evidence; Comfortable using AI coding and agentic tools in daily work, and clear-eyed about their risks (prompt injection, secret leakage, supply chain exposure); Pragmatic approach to security controls

Nice to have

Datacenter or colocation experience (network segmentation, out-of-band management, physical and vendor controls); Detection engineering or SIEM/HIDS ownership at scale (e.g., Wazuh, OSSEC, Elastic); Secrets management with HashiCorp Vault; AWS security (IAM, SCPs, VPC) and Terraform; Kubernetes security; Offensive security background (penetration testing or red teaming); PCI DSS work inside a cardholder data environment; Ownership of a secure SDLC program; Experience with GPU infrastructure, ML platforms, or multi-tenant inference workloads; Certifications such as OSCP, GIAC, CISSP, or AWS Security Specialty