Security Engineer, Detection & Response
Thinking Machines Lab2 days ago
Base Salary
$300k - $350k/yr
Responsibilities
- Lead end-to-end security incident response, including triage, investigation, containment, eradication, recovery, and postmortems.
- Design, build, and operate security data pipelines and tooling for telemetry from cloud, Kubernetes, identity, endpoint, SaaS, and application sources.
- Author, deploy, and maintain high-fidelity detections across SIEM, endpoint, cloud, and security tooling.
- Build and run a threat intelligence practice focused on adversaries and campaigns targeting AI labs.
- Conduct threat hunting and build automation, playbooks, enrichment, and automated containment tooling.
- Collaborate with research and product teams to detect AI-specific threats in production.
- Develop and exercise incident response plans, on-call processes, and tabletop exercises.
- Participate in an on-call pager rotation for security incidents.
Requirements
- Bachelor’s degree or equivalent experience in computer science, engineering, or a similar field.
- Proficiency in Python or Rust for data pipelines, detections, and internal tools.
- Demonstrated experience responding to real production security incidents and leading investigations across teams.
- Hands-on experience building and operating security data pipelines at scale, including ingestion, parsing, normalization, enrichment, storage, and querying.
- Experience producing and consuming threat intelligence, tracking adversary TTPs, using MITRE ATT&CK, and translating intelligence into detections and hunts.
- Strong understanding of cloud environments including AWS, GCP, or Azure, as well as Kubernetes and identity-provider telemetry.
- Familiarity with host and network forensics, endpoint telemetry, memory and disk analysis, and network logs.
- Ability to operate across the stack and own projects end-to-end.
- Clear communication skills for incident reports, intelligence briefs, and postmortems.
- Preferred: detection and response experience at an AI lab, cloud provider, or other high-threat environment.
- Preferred: experience detecting AI-specific abuse such as prompt injection, model extraction, or anomalous API usage.
- Preferred: familiarity with ML infrastructure telemetry, including GPU clusters, training jobs, and model artifact storage.
- Preferred: experience with stream processing and cost-aware log management at high volume.
- Preferred: malware analysis or reverse engineering experience, and talks, blogs, open-source detection content, or published threat research.
Benefits
- Annual salary range of $300,000–$350,000 USD.
- Generous health, dental, and vision benefits.
- Unlimited PTO.
- Paid parental leave.
- Relocation support as needed.
- Based in San Francisco, California.
- Visa sponsorship is available, subject to the employer’s stated success caveat.
Tech Stack
Apache FlinkApache KafkaAWSAzureClickHouseGoogle BigQueryGoogle Cloud PlatformKubernetesPythonRustSnowflakeSplunk
Categories
About Thinking Machines Lab
Thinking Machines Lab develops AI and generative AI software and conducts applied research to help organizations make data-driven decisions. The company builds products and data science solutions for enterprise use cases, pairing foundational models with practical tooling and services across industries. It is privately held and headquartered in San Francisco.