Security Engineer, Detection & Response

Thinking Machines Lab•San Francisco, CA

2d•$300,000 - $350,000•Onsite

About The Position

Thinking Machines is hiring a detection and response engineer to build and operate capabilities for finding, investigating, and stopping threats against the company, its platforms, models, and data. The role owns pipelines that turn raw telemetry into high-fidelity detections, leads responses to security incidents, and runs a threat intelligence practice focused on adversaries targeting frontier AI labs. The engineer partners with security, infrastructure, research, and product teams so detection and response can scale with the company. The position is based in San Francisco, California. The expected annual salary range is $300,000–$350,000 USD, depending on background, skills, and experience. Visa sponsorship is available, and relocation support is offered as needed.

Requirements

Bachelor’s degree or equivalent experience in computer science, engineering, or a similar field.
Proficiency in Python or Rust for building data pipelines, detections, and internal tools.
Track record responding to real security incidents in production environments, including leading investigations and coordinating across teams under pressure.
Hands-on experience building and operating security data pipelines at scale, including log ingestion, parsing and normalization, enrichment, and storage and query in a SIEM or data lake.
Experience producing and consuming threat intelligence, tracking adversary TTPs, mapping them to frameworks such as MITRE ATT&CK, and translating intelligence into detections and hunts.
Strong understanding of cloud environments (AWS, GCP, or Azure), Kubernetes, and identity provider telemetry, including how attackers move through these environments.
Familiarity with host and network forensics, including endpoint telemetry, memory and disk analysis, and network logs.
Comfort operating across the stack and owning projects end-to-end.
Clear communication skills for incident reports, intelligence briefs, and postmortems intended for technical and non-technical audiences.

Nice To Haves

Detection and response experience at an AI lab, cloud provider, or other high-threat environment targeted by sophisticated actors.
Experience detecting AI-specific abuse, such as prompt injection, model extraction, or anomalous API usage.
Familiarity with ML infrastructure telemetry, including GPU clusters, training jobs, and model artifact storage.
Experience with stream processing (e.g., Kafka, Flink, Vector) and cost-aware log management at high volume.
Malware analysis or reverse engineering experience.
Talks, blogs, open-source detection content, or published threat research.

Responsibilities

Lead incident response end-to-end, including triage, scoping, containment, eradication, recovery, and blameless postmortems that inform new detections and controls.
Design, build, and operate security data pipelines and tooling that collect, normalize, enrich, and store telemetry from cloud, Kubernetes, identity, endpoint, SaaS, and application sources.
Author, deploy, and maintain high-fidelity detections across SIEM, endpoint, cloud, and security tooling.
Build and run a threat intelligence practice tracking actors and campaigns relevant to AI labs, and translate intelligence into hunts, detections, and hardening recommendations.
Proactively hunt for threats and build automation and response tooling, including enrichment, playbooks, and automated containment.
Collaborate with researchers and product teams to detect AI-specific threats in production.
Develop and exercise incident response plans, on-call processes, and tabletop exercises with engineering, research, legal, and leadership.
Participate in an on-call pager rotation for security incidents.