Member of Technical Staff, Vulnerability Management

Inferact•San Francisco, CA

6d•$200,000 - $400,000•Remote

About The Position

Inferact's mission is to grow vLLM as the world's AI inference engine and accelerate AI progress by making inference cheaper and faster. Founded by the creators and core maintainers of vLLM, we sit at the intersection of models and hardware, a position that took years to build. About the Role We're looking for a Member of Technical Staff, Vulnerability Management to own Inferact's side of vLLM's vulnerability-management process and help keep a critical piece of AI infrastructure secure and production-grade. You'll develop a deep understanding of vLLM's architecture, independently investigate vulnerability reports, and turn technical findings into clear, actionable work for the core team. Working primarily in open source, you'll collaborate with vLLM maintainers, Red Hat counterparts, security firms, and researchers working with frontier AI models. You'll drive reports from initial triage through analysis and resolution, helping coordinate fixes, security advisories, and releases under the project's established process. You'll also identify practical security best practices that strengthen vLLM as it evolves. This is a hands-on product security role that combines technical investigation, sound judgment, and ownership of follow-through. vLLM's vulnerability-management process

Requirements

Hands-on product security experience, with a strong orientation toward infrastructure software and the security of complex software systems.
Ability to read source code, debug unfamiliar systems, reproduce reported issues, and explain root cause and practical security impact rather than simply forward findings.
Strong systems reasoning, including the ability to understand architecture, trust boundaries, deployment assumptions, and how different software components interact.
Ability to learn vLLM's core architecture and independently manage vulnerability investigations while bringing in maintainers where their expertise is needed.
Sound prioritization and risk-assessment judgment, with clear documentation of evidence, affected behavior, remediation needs, and next steps.
Strong written and verbal communication, discretion with sensitive reports, and the ability to work constructively with engineers, researchers, and external security collaborators.

Nice To Haves

Experience with vulnerability management and security best practices for open-source infrastructure software.
Experience coordinating vulnerability resolution across reporters, maintainers, security teams, and software releases.
Familiarity with vLLM, inference engines, ML infrastructure, or similarly complex distributed software; prior vLLM contributions are helpful but not required.
Experience preparing security advisories, assessing affected versions, and working with CVE and coordinated-disclosure workflows.
Helped resolve vulnerabilities in an open-source infrastructure project and can explain your technical contribution and coordination with maintainers.
Built security tooling or automation that improved investigation quality or reduced repetitive triage work.
Turned recurring vulnerability patterns into maintainable fixes, tests, or documentation that helped prevent similar issues.

Responsibilities

Own Inferact's side of vLLM's vulnerability-management process.
Develop a deep understanding of vLLM's architecture.
Independently investigate vulnerability reports.
Turn technical findings into clear, actionable work for the core team.
Collaborate with vLLM maintainers, Red Hat counterparts, security firms, and researchers.
Drive reports from initial triage through analysis and resolution.
Coordinate fixes, security advisories, and releases.
Identify practical security best practices that strengthen vLLM.
Translate security findings into practical architecture reviews, regression tests, secure development practices, or deployment guidance.