Cybersecurity Engineer; IT Security

MATS Research, Inc. BERKELEY, California, United States

MATS finds and trains talented individuals for what we see as the world's most urgent and talent-constrained problem: reducing risks from unaligned artificial intelligence. We believe ambitious researchers from a variety of backgrounds have the potential to meaningfully contribute to alignment, control, security, and governance research. Through our research fellowship, we provide mentorship, training, professional network, and financial support to accelerate their careers and increase their impact.

Since 2021, we have trained over 630 researchers. 75% of pre-2026 fellows continue to work in AI alignment. 10% have co-founded organizations. Our fellows have produced 215+ research papers with 17,000+ citations. And we are just getting started: in the coming year we will expand our program to support even more researchers.

This is a build role, and a founding one. As our first dedicated IT Security hire, you will stand up and own the corporate IT and security function: the endpoint, identity, and collaboration scaffolding a distributed research organization runs on, in combination with the compliance frameworks that unlock lab partnerships.

We think about security in two closely related areas. The first is IT and security - the human-operational attack surface: accounts, devices, email, office networks, vendors, and the SaaS suite that staff and fellows use every day. The second is research and infrastructure security - the machine-operational attack surface of our compute cluster, CI/CD pipelines, and model artefacts. This role focuses on the former.

We expect to grow the security team one hire at a time. Depending on hiring order, in your first few months you will inevitably wear both hats, biased toward the IT side, while keeping the research infrastructure side functioning until a second engineer joins.

Good security here is not overhead. It is what makes deeper lab partnerships possible, and it is a core part of how MATS earns access to sensitive models and data. You will be accountable for getting researchers and staff the tools they need to move fast, while maintaining a posture that external partners can trust.

You should be comfortable getting into the weeds of configuration and implementation, but you understand that the ultimate goal is to enable world-class research through secure operations.

• Build the secure-by-default environment. Design and deploy endpoint security (MDM/EDR) for a hybrid, two-country fleet spanning in-person teams in London and Berkeley and remote collaborators. Researchers and staff should be able to work with high-value code and data safely, without sacrificing velocity.
• Own identity and access management. Define the lifecycle of identities for staff, collaborators, fellows, and the automated service accounts that touch MATS systems. Advance our identity toward a robust Zero-Trust architecture (SSO, least-privilege, and hardware-key MFA), and set the boundary between what AI agents can do on our behalf and what requires human authorization. Run rigorous access control that balances our open-science publication goals against the sensitivity of pre-publication research.
• Secure communications and email. You will implement advanced email security, DMARC progression, phishing protection, and secure collaborative workflows, and governance of how AI tools are used across the organization. You will run a phishing simulation and training programme that shows measurable improvement in detection and response over time.
• Turn compliance into acceleration. Act as the primary bridge between our research needs and the security requirements of external AI labs. Lead MATS through the audits required to gain and maintain frontier-model access (e.g. SOC 2, ISO 27001, Cyber Essentials), and systematically manage vendor security reviews. MATS operates across the UK and US, so you will also handle the compliance that follows in both jurisdictions: data-protection obligations (UK GDPR, CCPA) and breach-notification timelines.
• Run the security programme. Operate the day-to-day function: quarterly access reviews, backup verification, regulatory incident-reporting, vendor SOC 2 reviews, audit-evidence preparation, and the policy iterations that hold it all together. As MATS shares research data with external partners, own the privacy and data-processing side: consent handling,…