The Role
Own security across Ironsite’s wearable devices, firmware, jobsite networks, cloud, ML systems, customer platform, and AI agents. Responsibilities include software supply-chain security, SBOM management, vulnerability and incident response, device identity and encryption, privacy enforcement, zero-trust networking, cloud and application security, infrastructure-as-code guardrails, detection, and agent security. The role protects sensitive worker video and critical infrastructure data while building scalable, automated security systems.
Summary Generated by Built In
About Ironsite
The Role
Some of the Things You’ll Work On
Technical Challenges You'll Solve
What We're Looking For
Preferred Qualifications
Location, Compensation, & Perks
Ironsite is building the intelligence layer for the physical world. We design our own wearable hardware, deploy it alongside craft workers, and transform a shift's footage into a next-morning report. Our internal team and purpose-built models label the data overnight and deliver actionable insights to superintendents by 5 AM.
We are accelerating the speed, efficiency, and predictability of construction, especially for complex, mission-critical infrastructure projects, including data centers, LNG facilities, sports stadiums, hospitals, and other large-scale developments, by training AI models on egocentric construction footage and labor productivity data. We are built with a pro-worker philosophy at our core: we believe technology should empower the workforce, not replace it. We're working to give craft workers and project leaders better visibility into what's happening on-site, while creating a system where the reality of construction and the chaos of each day are finally available to the people running the project.
Ironsite is deployed across several of the largest active construction projects in the country. To date, we've captured more than 100,000 hours of construction footage across seven states, now process thousands of hours of site activity every day, and maintain a worker opt-out rate below two percent. This is enabled by a workforce-first architecture that anonymizes devices, captures no audio, and never releases raw video.
Ironsite is backed by leading investors (8VC, South Park Commons, Saga Ventures) and prominent operators across technology and construction, including Eric Schmidt, Jeff Dean, Jeff Rothschild, Mark Leslie, Scott Wu, Eric Glyman, Karim Atiyeh, Russell Kaplan, and others, alongside over a dozen construction industry operators who have joined us as partners in building this.
Longer term, we believe Ironsite is the foundation for what construction becomes in the next decade. The systems we're building will be the operating system for how the physical world gets built. We see a future where craft workers are more valued, more visible, and better paid for the skill they bring, and where the industry finally has the intelligence layer that makes autonomous construction possible. Both start with the same foundation.
We're hiring our first Security Engineer to own security from every angle: a wearable camera fleet and the jobsite networks it runs on, petabyte-scale video and ML systems, the cloud they live in, the platform our customers log into, and the AI agents our engineers now build with every day.
AI agents now find and exploit vulnerabilities faster than vendors can patch. A model wrote a working remote-root exploit for the Linux kernel this fall, and the CVE stream across libraries, runtimes, kernels, CAs, and vendors has become a firehose. Knowing exactly what we run, everywhere, and responding methodically is the core of the job. Alongside it, you'll protect first-person video of thousands of workers, the sites of critical infrastructure under construction, and our promise that raw video never leaves.
- Software supply chain security. A living SBOM across firmware, edge, cloud, ML, and laptops. Package firewalls in front of every install (we run Socket today). Minimal, continuously rebuilt base images, and build attestations verified at deploy time, so everything in prod traces back to reviewed code. Plus vendor risk.
- Upstream incident response. When a CA, runtime, library, kernel, or vendor is compromised, you'll work out the blast radius in hours. That means every container, CI runner, host, device, and engineer laptop. Then you ship the fix to cloud and to an often-offline device fleet.
- Device and firmware security. Secure boot, signed OTA, hardware-backed identity, and encryption, so a lost device is a dead brick, not a data source.
- Privacy by architecture. Worker anonymization and the no-raw-video guarantee enforced by systems, with audits that prove it.
- Network, cloud, and ML platform security. Zero-trust jobsite and overlay networks, and least-privilege, keyless access (workload identity, short-lived credentials, MFA-gated admin) to video, model weights, and production data. Infrastructure as code you can audit. Detection and triage across the fleet and cloud that tells a routine deploy from an intruder fast.
- Application and agent security. Tenant isolation and authorization across our API. Hardening the AI agents and automation that read our code, run our tooling, and touch production. Making agent-assisted code review and pentesting a standard part of how we ship.
- CVE volume that outpaces humans. MTTE (mean time to exploit) is going negative. Build the automation, much of it agent-driven, that lets a small team keep up: triage against what's actually deployed and reachable, not just what's installed, and patch devices that stay offline for days.
- One SBOM from silicon to models. Chip SDKs, embedded Linux, kernels, container images, cloud services, CI, ML frameworks, and weights, all in one accurate, decision-ready graph.
- Physical access is a given. Thousands of cameras in uncontrolled environments need a threat model, alerting, and revocation that hold anyway.
- The seams. The real risk lives where hardware, firmware, network, cloud, ML, and agents meet: a field device on the same overlay network as production, an agent with shell access, an internal tool deployed straight from a laptop. You'll see all of them.
- Hands-on supply chain security: SBOMs that drive decisions (CycloneDX, including ML-BOM/CBOM), reachability-aware vulnerability management at scale, build and deploy provenance verified at deploy time, dependency firewalls, and upstream incident response.
- Security engineering depth in at least two of embedded/IoT, networks, cloud, and application security.
- Applied cryptography and PKI: device identity, key management, certificate lifecycles and trust stores (and what to do when a CA is compromised).
- Strong threat-modeling judgment and real incident response experience, including telling a false positive from a breach under pressure.
- A record of building security into systems engineers actually adopt: guardrails in CI and infrastructure as code, not tickets.
- Typically 4+ years of experience, 1-2 at a senior level; CS or related degree, or equivalent experience.
- Artifact attestations and trusted publishing in production (in-toto, Sigstore/cosign, GitHub attestations), VEX to cut noise, and CI/CD hardening (OIDC, pinned actions, runner egress control).
- Using AI agents defensively for triage, code review, or vuln discovery, and securing the agents themselves (permissions, sandboxing, prompt injection).
- Securing hardware end to end: secure boot, secure elements, OTA.
- Privacy engineering for video or biometric data.
- Offensive or hardware security experience.
- Compliance programs (SOC 2, ISO 27001, GDPR, etc.) run as engineering rather than paperwork.
- San Francisco Bay Area (on-site)
- Base salary: $230k-$280k per year, commensurate with experience
- Meaningful early-stage team equity.
- Ability to purchase xPU or devices for development
- Full benefits including health, dental, vision, and 401(k) with 6% match
- Daily catered lunch
- Office in San Francisco, next to Oracle Park and the Caltrain
Final compensation is determined by experience, location, and level.
CompensationThe base pay range for this role is $230,000 – $280,000 per year.
Skills Required
- Typically 4+ years of professional experience, including 1–2 years at a senior level
- Computer science or related degree, or equivalent experience
- Hands-on software supply-chain security experience, including SBOMs, reachability-aware vulnerability management, build provenance, dependency firewalls, and upstream incident response
- Security engineering depth in at least two of embedded or IoT security, network security, cloud security, and application security
- Applied cryptography and PKI experience, including device identity, key management, certificate lifecycles, and trust stores
- Strong threat-modeling judgment and real incident-response experience
- Experience building adopted security guardrails in CI and infrastructure as code
- Experience with artifact attestations, trusted publishing, VEX, or CI/CD hardening
- Experience using or securing AI agents for triage, code review, or vulnerability discovery
- End-to-end hardware security experience, including secure boot, secure elements, or OTA updates
- Privacy engineering experience involving video or biometric data
- Offensive security or hardware security experience
- Experience running SOC 2, ISO 27001, GDPR, or similar compliance programs as engineering
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Ironsite AI is a construction technology company that leverages wearable cameras and AI vision models to drive on-site productivity, safety, and training. By equipping workers with smart hard hats, the platform captures real-time data to analyze field activities, optimize labor allocation, and identify safety risks. Their mission is to modernize construction management by providing data-driven insights that help contractors reduce labor costs and deliver projects more efficiently.
