Cybersecurity Engineer; Research Infrastructure

MATS finds and trains talented individuals for what we see as the world’s most urgent and talent-constrained problem: reducing risks from unaligned artificial intelligence. We believe ambitious researchers from a variety of backgrounds have the potential to meaningfully contribute to alignment, control, security, and governance research. Through our research fellowship, we provide mentorship, training, professional network, and financial support to accelerate their careers and increase their impact.

Since 2021, we have trained over 630 researchers. 75% of pre-2026 fellows continue to work in AI alignment. 10% have co-founded organizations. Our fellows have produced 215+ research papers with 17,000+ citations. And we are just getting started: in the coming year we will expand our program to support even more researchers.

You are the security architect for our research pipeline. You will define how we securely conduct research across our compute cluster and cloud environments, partnering closely with our compute team and engineers to make CI/CD, automated research agents, and large-scale compute secure by default. You will build a hardened environment where researchers and agents iterate at speed without risking data leakage, supply-chain compromise, model exfiltration, or lateral movement between research environments.

We think about security in two closely related areas. The first is research and infrastructure security — the machine-operational attack surface: the compute cluster, CI/CD pipelines, cloud infrastructure, and model artefacts and pipelines, including potentially dual-use processes and artefacts. The second is IT security — the human-operational attack surface of accounts, devices, email, and vendors. This role focuses on the former.

We grow the security team one hire at a time. Depending on hiring order, your initial responsibilities may span both areas, biased toward the research infrastructure side, until a second engineer joins.

Good security here is not a brake. It is what lets us say "yes, safely" to ambitious research, and what makes deeper lab partnerships possible. You will be working at the frontier of how automated alignment research is actually done — building the security primitives for a new way of doing science, where humans and machines collaborate on the most important problem of the 21st century.

• Harden Dev Sec Ops  and CI/CD. Build security guardrails directly into our pipelines so that every deployment (manual or agent-driven) is automatically scanned, verified, and compliant. Establish workflows where agents can test their own code and infrastructure changes against security policies before reaching production. Lead the implementation of "compliance as code," automating the auditing and enforcement of security configurations across our AWS, GCP, and neocloud footprints in Terraform.
  
  Establish and harden the source-control environment for research code (e.g. Git Hub): secret scanning, dependency and code scanning, and branch protections. Issue short-lived cloud credentials from CI rather than long-lived keys.
• Secure the software supply chain. In an environment that relies heavily on automated coding agents, build systems that establish the provenance of code and dependencies: robust signing, SBOM generation (Sigstore, cosign), dependency and container scanning (Snyk, Trivy), and automated vulnerability management.
• Define agent sandboxing and least-privilege execution. Set and enforce the security models for our research agents. Determine what an agent can compile, deploy, or call from inside the cluster, ensuring agents hold only the access required to run experiments while remaining isolated from…