Principal Security Engineer
Crux AI · Palo Alto · onsite
Built to set the gold standard for integrated AI infrastructure
Crux AI is a newly formed, U.S.-based integrated AI infrastructure company created to remove the physical and operational constraints on consequential AI ambitions. Crux brings together power, high-density data centers, TPU silicon, networking, orchestration software, and ongoing operations as one integrated system.
Crux is being capitalized to plan every layer together, develop each one to demanding standards, and operate the whole system with efficiency and reliability. That gives hyperscalers, frontier AI labs, sovereign customers, enterprises, and AI-native companies greater freedom to pursue the AI they are here to create.
WHAT YOU'LL DO
You will be the first security engineer at Crux and the architect of how our platform protects customer workloads, from hardware root of trust to the tenant boundary. Reporting within our CTPO organization, you will define the security architecture of record for our TPU clusters, data centers, network, and control plane, and build the controls yourself. Our customers include sovereign governments, frontier AI labs, and regulated enterprises running their most sensitive models on dedicated capacity, so security is part of the product, not a review at the end. This is an individual contributor seat with company-wide reach: you lead through the quality of your designs and the controls you ship.
In this role, you will:
- Define the security architecture of record across the stack: hardware and firmware, bare metal hosts, out-of-band management, cluster fabric, control plane, and customer access.
- Build tenant isolation that dedicated and sovereign customers can verify, including network segmentation, secure provisioning and wipe between tenants, and attestation of what is running on their capacity.
- Secure the hardware supply chain and boot path with Google and our suppliers: secure and measured boot, BMC hardening, firmware integrity, and key management.
- Design how customer model weights and data are protected at rest, in transit, and in use, and how access to them is controlled and audited.
- Work with Data Center Engineering and Facility Operations so that physical security, access control, and network security are designed together at every site.
- Stand up threat modeling, security design review, detection, and incident response for the platform, and automate them so they scale with the fleet.
- Turn customer and regulatory requirements, such as FedRAMP, SOC 2, ISO 27001, and sovereign data residency, into concrete controls and the evidence that proves them.
SIGNALS OF SUCCESS
After 60 days in this role:c
- Gained a complete understanding of the platform architecture, the Google partnership model, and our first customer commitments, and published a threat model and security architecture of record for the first build.
- Become a required reviewer on the design decisions that set the security posture of the first sites.
- Adapted to a fast-paced environment, triaging appropriately and continuously improving our function.
After 6 months:
- Delivered the first production TPU cluster with tenant isolation, secure boot, and access controls in place and verified.
- Stood up security monitoring and incident response for the platform, with tested playbooks for the scenarios that matter most.
- Demonstrated an AI-forward and automated approach to this role: you have built, in a hands-on way, AI-enabled tools for threat detection, design review, or compliance evidence that the team uses every day.
After 1 year:
- Passed the first customer and third-party security assessments without findings that block a deal.
- Made security a reason sovereign and regulated customers choose Crux, with an isolation and attestation story they can verify.
- Set a multi-year security roadmap that the CTPO, Google, and engineering leaders are aligned on.
EXPERIENCES, ATTRIBUTES AND MINDSET THAT INDICATE A GOOD MATCH
Experiences
- 12+ years in security engineering, with deep focus on infrastructure, cloud, or platform security at scale.
- Hands-on experience securing bare metal and data center infrastructure, including hardware root of trust, TPMs, secure and measured boot, BMC hardening, and out-of-band management networks.
- A track record of designing multi-tenant isolation and identity and access architectures for a cloud or hyperscale platform, and shipping them to production.
Attributes
- You are outcome driven and hands-on. You write the design, the code, and the detection rule yourself. This is a builder's seat, not a supervisory one.
- You make security an enabler. You find the path that ships the product safely rather than the reason it cannot ship.
- You have a high tolerance for ambiguity. You absorb ambiguity and navigate complexity rather than passing it along.
Mindset
- You are skeptical by default. "The tenant is isolated" is a hypothesis until it survives a red team. You build the system that makes the next incident boring.
- You operate as an owner, not an advisor.
- You are AI-agentic first. Fluent with AI agents, or committed to becoming so quickly, you embed them as first principles in how you and your team work, defaulting to agentic workflows before adding headcount or process.
Nice to have (Preferred, not required):
- Infrastructure security at a hyperscaler (Google, AWS, Microsoft, Meta) or a neocloud (CoreWeave, Nebius, Lambda, Crusoe).
- Experience with confidential computing, remote attestation, or securing AI accelerators and model weights.
- Experience building controls for FedRAMP High, IL5, or sovereign cloud programs.
- An active security clearance, or experience working with government and defense customers.
- Patents, publications, or recognized work in hardware, firmware, or cloud security.
Salary Range Information
The annual salary range for this position has been estimated based on market data and other factors. However, a salary higher or lower than this range may be appropriate for a candidate whose qualifications differ meaningfully from those listed in the job description.
About Crux
- We offer generous base, bonus and additional incentive based compensation
- Health, dental, and vision coverage for you and your dependents
- Company-paid life insurance and disability
- Full suite of other optional benefits
- 401(k) Plan with 4% company match
- Hybrid schedule offering four days in-office collaboration paired with one remote workday for focused, individual work