Security Engineer, Detection & Response
Thinking Machines Lab12 days ago
Base Salary
$300k - $350k/yr
Responsibilities
- Lead incident response through triage, scoping, containment, eradication, recovery, and blameless postmortems.
- Design, build, and operate security data pipelines that collect, normalize, enrich, store, and query telemetry from cloud, Kubernetes, identity, endpoint, SaaS, and application sources.
- Author, deploy, and maintain high-fidelity detections across SIEM, endpoint, cloud, and security tooling.
- Build and run a threat intelligence practice focused on actors and campaigns targeting AI labs, translating intelligence into hunts, detections, and hardening recommendations.
- Proactively hunt for threats and build enrichment, playbook, and automated-containment tooling.
- Develop and exercise incident response plans, on-call processes, and tabletop exercises with technical and business teams.
- Participate in an on-call pager rotation for security incidents.
Requirements
- Bachelor’s degree or equivalent experience in computer science, engineering, or a similar field.
- Proficiency in Python or Rust for building data pipelines, detections, and internal tools.
- Demonstrated experience responding to real production security incidents, leading investigations, and coordinating across teams.
- Hands-on experience building and operating security data pipelines at scale, including log ingestion, parsing, normalization, enrichment, storage, and querying in a SIEM or data lake.
- Experience producing and consuming threat intelligence, tracking adversary tactics, techniques, and procedures, mapping them to MITRE ATT&CK, and translating intelligence into detections and hunts.
- Strong understanding of cloud environments, AWS, GCP, or Azure, Kubernetes, and identity-provider telemetry.
- Familiarity with host and network forensics, including endpoint telemetry, memory and disk analysis, and network logs.
- Ability to operate across the stack and own projects end-to-end.
- Ability to communicate clearly through incident reports, intelligence briefs, and postmortems for technical and non-technical audiences.
- Preferred: detection and response experience at an AI lab, cloud provider, or other high-threat environment.
- Preferred: experience detecting AI-specific abuse such as prompt injection, model extraction, or anomalous API usage.
- Preferred: familiarity with ML infrastructure telemetry including GPU clusters, training jobs, and model artifact storage.
- Preferred: experience with stream processing and cost-aware, high-volume log management.
- Preferred: malware analysis or reverse engineering experience.
- Preferred: talks, blogs, open-source detection content, or published threat research.
Benefits
- Annual salary range of $300,000-$350,000 USD.
- Generous health, dental, and vision benefits.
- Unlimited PTO and paid parental leave.
- Relocation support as needed.
- Role based in San Francisco, California.
- Visa sponsorship is offered, with the company committed to working through the visa process for the right candidate, though success is not guaranteed for every candidate or role.
Tech Stack
Apache FlinkApache KafkaAWSAzureClickHouseGoogle BigQueryGoogle Cloud PlatformKubernetesPythonRustSnowflakeSplunk
Categories
About Thinking Machines Lab
Thinking Machines Lab develops AI and generative AI software and conducts applied research to help organizations make data-driven decisions. The company builds products and data science solutions for enterprise use cases, pairing foundational models with practical tooling and services across industries. It is privately held and headquartered in San Francisco.