← All roles

Network Security Engineer

Etched· Software
Apply on company site
San Jose$175k - $350kFull-timePosted 3mo ago

About the role

Etched is building hardware for frontier intelligence. As the first dedicated Network Security Engineer, you will design and implement Etched's network security posture end to end across on-prem, multi-location, and multi-cloud environments, harden networks, enforce least-privilege access to chip-design environments, and build detection/response capabilities for sensitive assets in production-scale AI infrastructure.

Responsibilities

  • Design and implement a zero-trust network architecture across on-prem datacenters, multiple office locations, and multi-cloud platforms, including secure remote access that eliminates VPN sprawl without sacrificing engineer usability and speed
  • Define and enforce network segmentation policies that isolate sensitive ASIC development workflows from general infrastructure, customer access, validation labs, and manufacturing infrastructure
  • Balancing prevention and detection, deploy, tune, and operate NDR, IDS/IPS, and next-generation firewalls across our physical and virtual network fabric; build automation to continuously assess and enforce firewall rules, ACLs, and routing policies - treating network security configuration as code
  • Integrate and operate EDR/XDR, MDM/MAM, SASE, and CASB tooling in partnership with end-user and IT teams, enforcing unified DLP policies and device compliance posture across endpoint, cloud, and network control planes to eliminate data exfiltration risk
  • Own our vulnerability management process for network-layer exposure: scanning, prioritization, and remediation tracking in partnership with infrastructure engineers
  • Lead incident response for network-layer security events: detection, containment, root-cause analysis, and post-incident hardening
  • Partner with legal, compliance, and leadership to support regulatory requirements and customer security reviews as they arise
  • Architect and deploy network segmentation for HPC clusters, isolating EDA tool traffic, ASIC simulation workloads, and CI pipelines from each other and from the corporate network
  • Architect and deploy a ZTNA-based corporate network that eliminates VPN sprawl and ensures end-user devices maintain a consistent security posture and seamless access to sensitive development environments
  • Design and implement a scalable NDR pipeline that ingests flow data across bare-metal switches and cloud VPCs, feeds a centralized SIEM, and generates actionable alerts with low false-positive rates
  • Develop runbooks and automated playbooks for the highest-probability incident scenarios - credential compromise, lateral movement, and exfiltration from IP-sensitive environments
  • Integrate EDR/XDR telemetry with SASE enforcement and CASB inline controls to build a unified DLP detection and response pipeline spanning endpoints, cloud SaaS, and the corporate network
  • Partner with end-user and IT teams to roll out MDM/MAM policies that containerize sensitive IP on engineer devices and enforce compliance-based conditional access across managed and unmanaged environments

Qualifications

  • Bring deep, broad networking expertise - from low-level packet analysis and firewall log forensics to BGP configuration, multi-cloud networking, and CASB/SASE integration across a diverse SaaS landscape
  • Have hands-on experience with the Fortinet ecosystem - firewalls, FortiSASE, FortiAPs, and switches - and are comfortable with Arista switch platforms, including configuration, EOS automation, and integration into a broader security architecture
  • Treat security as an engineering discipline: you write code and automation rather than relying on point-and-click tooling, version-control your configurations, and develop intent-driven network automation
  • Have experience securing high-value compute environments - datacenters, HPC clusters, semiconductor design environments, or similar settings where the cost of a breach is extremely high
  • Have deployed and integrated EDR/XDR, MDM/MAM, SASE, and CASB tooling, and understand how to stitch them together into a unified DLP and access control framework that spans endpoints, cloud, and the network
  • Have built or operated ZTNA-based access models and understand how to enforce consistent security posture across on-site, remote, and traveling users without degrading the experience for engineers
  • Are comfortable owning your domain with minimal oversight: you can independently scope a project, identify the right tooling, and drive it to completion
  • Have strong Linux fundamentals and understand how OS-level networking (iptables/nftables, network namespaces, eBPF) interacts with physical and virtual network security controls
  • Have built or operated network security monitoring at scale - you know the difference between a good alert and noise, and you can architect a detection pipeline that surfaces real signal
  • Can communicate risk clearly to both technical peers and non-technical leadership, and can translate security requirements into actionable infrastructure changes

Skills

Required:Networking expertise

Benefits

  • Medical, dental, and vision packages with generous premium coverage
  • $500 per month credit for waiving medical benefits
  • Housing subsidy of $2,500 per month for those living within walking distance of the office
  • Relocation support for those moving to San Jose (Santana Row)
  • Various wellness benefits covering fitness, mental health, and more
  • Daily lunch and dinner in our office
  • Unlimited compute budget subject to ROI justification
Last updated Oct 15, 2026. Interested? Apply on the company site.
Etched logo

About Etched

Etched is building frontier inference clusters: co-designs chips, racks, software and manufacturing to push the pareto frontier for AI hardware.

frontier inference clustersAI hardwarechipsrackssoftwaremanufacturingparto frontier
Company profileWebsite

More open roles at Etched