基础设施安全工程师
Infrastructure Security Engineer
我们正在通过融合艺术与科学，构建人工智能来模拟世界。
我们认为，世界模型是人工智能进步的前沿。仅靠语言模型无法解决世界上最难的问题——机器人技术、疾病、科学发现。真正的进步需要能够体验世界并从错误中学习的模型，就像人类一样。而这种试错过程在模拟环境中进行时，可以被大幅加速，而不是在现实世界中。
世界模型为通用模拟提供了最清晰的路径，改变了故事的讲述方式、科学进步的方式以及人类下一个前沿领域的探索方式。
我们的团队由富有创造力、思想开放、充满关怀和抱负的人组成，他们决心改变世界。我们渴望不断打造不可能的事物，而我们实现这一目标的能力依赖于打造一支非凡的团队。如果你也有同样的动力，我们很期待收到你的消息。
### **关于该职位**
* _接受远程办公 —— 我们在纽约、旧金山、西雅图、伦敦、巴黎和特拉维夫也设有办公室。_
Runway 正在招聘一名基础设施安全工程师，以保护我们模型训练和部署的平台。该职位涵盖 Kubernetes 平台安全、云身份和访问管理、软件供应链、服务层中的租户隔离以及我们模型背后的科研基础设施。
为一家训练和部署前沿视频模型的公司提供安全保障，与保障典型 SaaS 产品不同。该环境包括研究计算、大型训练数据集、快速移动的构建流程，以及每天使用 AI 辅助工具的工程师。这些因素都改变了攻击的形态，也改变了平台需要执行的防护措施。
这是一个安全团队中的实际工程岗位。你将编写策略、工具和基础设施代码，参与平台团队的代码仓库，并发布能够在生产环境中经受考验的控制措施。
### **你将负责**
- 在我们的 Kubernetes 生态系统中设计并发布安全控制措施：准入策略、RBAC、工作负载身份、网络策略和每个集群运行时的加固
- 从依赖项接收、构建和部署整个软件供应链中加强安全性，包括包防火墙、工件签名和来源验证，以及阻止不符合要求的准入控制
- 负责云 IAM 和身份架构：最小权限角色、短期凭证和工作流
查看英文原文
We are building AI to simulate the world through merging art and science.
We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world.
World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached.
Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you.
### **About the role**
* _Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv._
Runway is hiring an Infrastructure Security Engineer to secure the platform our models are trained and served on. The role covers Kubernetes platform security, cloud identity and access, software supply chain, tenant isolation in the serving layer and the research infrastructure behind our models.
Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline, and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what the platform has to enforce to stop it.
This is a hands-on engineering role on the Security team. You'll write policy, tooling and infrastructure code, work in the platform team's repositories, and ship controls that hold up in production.
### **What you'll do**
- Design and ship security controls in our Kubernetes ecosystem: admission policy, RBAC, workload identity, network policy and runtime hardening across every cluster we run
- Harden the software supply chain from dependency intake through build and deploy, including package firewalling, artifact signing and provenance, and admission controls that block what doesn't pass
- Own cloud IAM and identity architecture: least-privilege roles, short-lived credentials and workload federation
- Secure research infrastructure and training pipelines, including access to model weights and datasets, without slowing down the people using them
- Threat model new platform components before they ship and turn the findings into concrete requirements the owning team can act on
- Build guardrails for AI agents and developer tooling operating inside our infrastructure
- Write infrastructure as code and policy as code, and treat security configuration with the same review and rollout discipline as any other change
- Give the incident response team what they need when infrastructure is involved: fast answers about how a system works and what to shut off
### **What you'll need**
- Hands-on experience securing Kubernetes in production: you've written admission policies, debugged RBAC and workload identity problems and understand how a cluster gets compromised
- Working knowledge of cloud IAM and networking on at least one major cloud platform, including how identity federation and short-lived credentials actually work
- Experience with infrastructure as code and GitOps-style deployment, and the habit of shipping security changes through the same pipeline as everything else
- Comfort writing Python, Typescript, Rust or another language to build tooling, not just scripts
- An understanding of software supply chain attacks and the controls that stop them: signing, provenance, SBOMs, admission enforcement
- Clear writing. Design docs, threat models and explanations to engineers who don't work in security are all part of the job
- Judgment about which controls to enforce, which to recommend and how to roll out a breaking change without breaking the company
### **Even better if you have**
- Experience securing GPU or HPC-style compute, training pipelines or research environments
- Experience with policy engines and admission controllers (Kyverno, OPA Gatekeeper, Falco or similar)
- Multi-tenant isolation design in a cloud environment: ABAC, scoped credentials, per-tenant boundaries
- Experience producing security architecture evidence for SOC 2, ISO 27001 or other audits and customer assessments
- Open source contributions or published work in cloud or Kubernetes security
Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide.
There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range.
Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates.
#### **Working at Runway**
[**Great things come from great teams.**](https://www.youtube.com/watch?v=kwmj4ato2kw&ab_channel=Runway) **We’d love to hear from you.**
We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply.
More about Runway
- [Universal World Simulator](https://runwayml.com/world-simulator.html)
- [GWM-1](https://runwayml.com/research/introducing-runway-gwm-1)
- [Gen-4.5](https://runwayml.com/research/introducing-runway-gen-4.5)
- [General World Models](https://runwayml.com/research/introducing-general-world-models)
- [Robotics SDK](https://runwayml.com/research/introducing-runway-gwm-1#robotics-section)
- [Conversational Real-time Agents](https://runwayml.com/research/introducing-runway-gwm-1#avatars-section)
- [Runway Studios](https://runwayml.com/studios)
We're excited to be recognized as a best place to work:
[Crain's](https://www.crainsnewyork.com/awards/best-places-work-2023) | [InHerSight](https://www.inhersight.com/companies/best/city/new-york-city-ny) | [BuiltIn NYC](https://builtin.com/awards/new-york-city/2024/best-places-to-work) | [INC](https://www.inc.com/best-workplaces/2024)