Member of Technical Staff, Product Security

Inferact•San Francisco, CA

About The Position

Inferact is seeking a hands-on product security engineer to secure its product as it moves from early deployments to production use by enterprise customers. The role covers the inference platform and its APIs, the control plane, the cloud and Kubernetes infrastructure, and the software development and release process. The position works closely with inference, infrastructure, product, and forward-deployed engineering teams, as well as the engineer responsible for vLLM vulnerability management when upstream issues affect the product. The successful candidate will set the direction for product security and carry work from design review through shipped fixes.

Requirements

Hands-on product or application security experience on software customers run or depend on, with a record of finding, fixing, and preventing real vulnerabilities.
Strong software engineering ability, including reading and writing production code, reviewing pull requests, and shipping fixes and the tests that validate them.
Experience threat-modeling and reviewing distributed systems, APIs, and services, including authentication, authorization, multi-tenancy, data isolation, and secrets handling.
Working knowledge of cloud and container security, including IAM, network boundaries, Kubernetes, and infrastructure as code.
Sound risk judgment, including distinguishing reachable risks from theoretical ones and choosing controls appropriate to the company's stage.
Clear written and verbal communication with engineers, leadership, and customers' security teams, and discretion when handling sensitive information.

Nice To Haves

Experience securing AI/ML infrastructure, model serving, GPU workloads, or developer platforms.
Experience securing software supply chains and CI/CD, including dependency risk, build integrity, artifact signing, and container image hardening.
Familiarity with inference-specific security risks, such as untrusted model loading, tenant isolation on shared hardware, and handling prompts and outputs.
Experience building security tooling, paved roads, or secure-by-default libraries adopted by engineers.
Experience responding to the technical aspects of enterprise customer security reviews and supporting deployments in customer cloud environments.
Credited CVEs, security fixes, or security tooling in widely used open-source infrastructure.
Experience building a product security function from the ground up at an early-stage company.
Offensive security or security research experience translated into lasting engineering fixes.
Contributions to vLLM, PyTorch, or other inference and ML infrastructure projects.

Responsibilities

Threat-model new features with the engineers building them.
Review and write production code, and find and fix vulnerabilities.
Build secure defaults, tooling, and guardrails that enable the team to move quickly without adding risk.
Work with inference, infrastructure, product, and forward-deployed engineering teams on product security.
Coordinate with the engineer who owns vLLM vulnerability management when upstream issues affect the product.
Set the direction for product security at Inferact and carry security work from design review to shipped fix.