Fifty-one people. No one is a résumé on a bench.
We hire slowly, pay properly, and keep people a long time. Every engineer here ships code or breaks it, including the directors.
Current openings
Apply by emailing [email protected] with the role title in the subject, a résumé or a link to your work, and a few sentences about why. No portal. A person reads every application and replies within two weeks.
Systems Engineer, Infrastructure & Security Operations Featured
You will be the dedicated systems engineer for the firm: the person who owns the infrastructure, identity, endpoints and controls that our SOC 2 report describes and that fifty engineers working in client environments depend on every day. This is a sole-owner role with a budget, a mandate, and colleagues who will test your work because that is what they do for a living.
What you will own
- Identity and access: SSO, hardware-key MFA for every account, per-engagement access grants and removals with an audit trail
- Endpoint fleet: about 60 managed laptops across macOS, Linux and Windows, with full-disk encryption, monitoring and clean offboarding
- Delivery infrastructure: isolated workstations and networks for engagements that require them, the secure lab, and the office network
- Servers and services: the small on-premises footprint, the corporate cloud accounts, backups with quarterly restore tests, centralized logging
- Controls and evidence: the technical half of our SOC 2 program, vulnerability management for our own estate, and the incident response plan you will help rehearse
- Documentation good enough that an auditor, a new hire or your future replacement can follow it
What we are looking for
- Five or more years running infrastructure and security operations for an organization that takes it seriously
- Fluent across Linux, macOS and Windows administration, identity providers, MDM, and modern networking (segmentation, zero-trust access, VPN)
- Scripting and infrastructure-as-code habits, and the instinct to automate the second time you do something
- Experience owning backup and recovery that has been tested for real
- The ability to explain a risk to a director in plain language and to tell a senior engineer no, politely, in writing
Nice to have
- Time inside a SOC 2, ISO 27001 or FedRAMP program on the implementing side
- Experience supporting a consultancy or any team that works inside other people's environments
Senior Software Engineer
Design and build web, API and data systems for regulated clients, under review, from a threat model. You will own features end to end, including the first retest when our security practice tries to break them.
- Six or more years shipping production software; depth in at least one of TypeScript, Go, Python, Rust or .NET
- Comfortable with authentication, authorization and data-handling design, and curious about how it fails
- Writes clearly: design docs, decision records and pull requests that explain why
Application Security Engineer
Grey-box penetration testing, secure code review and threat modeling on client software and our own. You will write findings engineers respect and summaries boards understand.
- Four or more years in application security testing or security-focused development
- Hands-on with web, API, mobile and cloud testing; able to read code in several languages
- Relevant certifications are welcome and not required; a portfolio of findings or research is better
Platform Engineer
Build and operate client platforms: infrastructure as code, Kubernetes and serverless, observability, and the on-call rotation that keeps our 24×7 retainers honest.
- Four or more years in platform, SRE or infrastructure roles with real on-call experience
- Deep in at least one major cloud and in Terraform or Pulumi; comfortable with policy-as-code
- Calm in incidents, thorough in postmortems
What everyone gets
- Medical, dental and vision with the majority of the premium paid by the firm
- 401(k) with a company match that vests immediately
- Four weeks paid time off to start, plus holidays and a week-long December shutdown
- Annual profit-sharing paid to every employee on the same formula
- Paid training, certifications and conference time, with a research-day budget for the security practice
- Company-managed hardware of your choice, replaced on a schedule
Three steps, usually three weeks
A conversation
Thirty minutes with the practice lead about the role and your background. No trick questions.
A working session
Half a day, paid, with the team you would join. Engineers review a real design; security engineers test a real target; the systems role walks through a real incident.
An offer
In writing, with the full compensation picture, within a week of the working session.
Learn from the people who test your work.
Every other Friday afternoon is practice time: a security engineer walks the firm through a recent finding, a platform engineer runs a game day, or a product team presents a design for the room to attack. New engineers pair with a senior for their first engagement and get a written review at ninety days, not a surprise at twelve months.
Grey Ferrite is an equal opportunity employer. We make hiring decisions on skill and fit for the role, and we provide reasonable accommodation throughout the hiring process on request. Some engagements require US citizenship or the ability to pass a background check; the posting will say so.