Infrastructure Security Engineer

We are building AI to simulate the world through merging art and science.

We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world.

World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached.

Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you.

About the role

*Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv.

Runway is hiring an Infrastructure Security Engineer to secure the platform our models are trained and served on. The role covers Kubernetes platform security, cloud identity and access, software supply chain, tenant isolation in the serving layer and the research infrastructure behind our models.

Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline, and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what the platform has to enforce to stop it.

This is a hands-on engineering role on the Security team. You'll write policy, tooling and infrastructure code, work in the platform team's repositories, and ship controls that hold up in production.

What you'll do

• Design and ship security controls in our Kubernetes ecosystem: admission policy, RBAC, workload identity, network policy and runtime hardening across every cluster we run

• Harden the software supply chain from dependency intake through build and deploy, including package firewalling, artifact signing and provenance, and admission controls that block what doesn't pass

• Own cloud IAM and identity architecture: least-privilege roles, short-lived credentials and workload federation

• Secure research infrastructure and training pipelines, including access to model weights and datasets, without slowing down the people using them