Security Engineer, Detection & Response

Thinking Machines Lab•San Francisco, CA

2d•Onsite

About The Position

Thinking Machines is hiring a detection and response engineer to build capabilities for finding, investigating, and stopping threats against the company, its platforms, models, and data. The role owns the pipelines that turn raw telemetry into high-fidelity detections, leads response to security incidents, and runs a threat intelligence practice focused on adversaries targeting frontier AI labs. The engineer works closely with security, infrastructure, research, and product teams so that detection and response scale with the company.

Requirements

Bachelor’s degree or equivalent experience in computer science, engineering, or a similar field.
Proficiency in Python or Rust for building data pipelines, detections, and internal tools.
Track record responding to real security incidents in production environments, including leading investigations and coordinating across teams under pressure.
Hands-on experience building and operating security data pipelines at scale, including log ingestion, parsing and normalization, enrichment, and storage and querying in a SIEM or data lake.
Experience producing and consuming threat intelligence, tracking adversary TTPs, mapping them to frameworks such as MITRE ATT&CK, and translating intelligence into detections and hunts.
Strong understanding of cloud platforms (AWS, GCP, or Azure), Kubernetes, and identity provider telemetry, including how attackers move through these environments.
Familiarity with host and network forensics, including endpoint telemetry, memory and disk analysis, and network logs.
Comfort operating across the stack and owning projects end-to-end.
Clear communication skills for incident reports, intelligence briefs, and postmortems for technical and non-technical audiences.

Nice To Haves

Detection and response experience at an AI lab, cloud provider, or other high-threat environment targeted by sophisticated actors.
Experience detecting AI-specific abuse, such as prompt injection, model extraction, or anomalous API usage.
Familiarity with ML infrastructure telemetry, including GPU clusters, training jobs, and model artifact storage.
Experience with stream processing (such as Kafka, Flink, or Vector) and cost-aware log management at high volume.
Malware analysis or reverse engineering experience.
Talks, blogs, open-source detection content, or published threat research.

Responsibilities

Lead incident response end-to-end, including triage, scoping, containment, eradication, recovery, and blameless postmortems that translate lessons into detections and controls.
Design, build, and operate security data pipelines and tooling to collect, normalize, enrich, and store telemetry from cloud, Kubernetes, identity, endpoint, SaaS, and application sources.
Author, deploy, and maintain high-fidelity detections across SIEM, endpoint, cloud, and security tooling.
Build and run a threat intelligence practice focused on actors and campaigns relevant to AI labs, and turn intelligence into hunts, detections, and hardening recommendations.
Proactively hunt for threats and build automation and response tooling, including enrichment, playbooks, and automated containment.
Collaborate with researchers and product teams to detect AI-specific threats in production.
Develop and exercise incident response plans, on-call processes, and tabletop exercises with engineering, research, legal, and leadership.
Participate in an on-call pager rotation for security incidents.