Security Engineer, Threat Intelligence

Fluidstack•Austin, TX

13d•$220,000 - $280,000

About The Position

Fluidstack is building civilization-scale infrastructure for AI, focusing on delivering gigawatts of compute faster than anyone else. The Security Team is responsible for securing this frontier AI infrastructure, where model weights are highly valuable and targeted. The role involves building the entire security program from scratch, from bare metal to boardroom, as the company scales across continents. The threat surface is measured in gigawatts, and the team is responsible for the physical and logical security of critical AI development work.

Requirements

Tracked specific nation-state or advanced criminal actors as a core job function, with deep knowledge of their tooling, infrastructure, and targeting.
Proficiency in production-quality Python (or similar) for building automation and data pipelines.
Experience with hands-on malware, infrastructure, and log analysis to develop and validate findings.
Authored quality detection logic (YARA, Sigma, or SIEM-native queries) that has been deployed to production.
Collaborated closely with detection engineers and incident responders to translate intelligence into detections, hunting hypotheses, and incident context.
Ability to write intelligence that is concise, actionable, and leads to clear decisions and next steps for engineers and executives.

Nice To Haves

Active network in the threat intelligence community with a habit of sharing information in both directions.
Experience defending large-scale GPU or AI compute infrastructure, data centers, or multi-tenant cloud environments.
Experience applying LLMs or agentic tooling to accelerate collection, enrichment, and analysis.
Public research, conference talks, or open-source contributions in the CTI space.

Responsibilities

Track nation-state and advanced criminal actors targeting frontier AI infrastructure, and translate their tooling, infrastructure patterns, and tradecraft into actionable intelligence for detection and hunting.
Build and operate pipelines for collecting, enriching, and correlating indicators, and integrate them into the detection and agentic triage stack for instant operationalization.
Lead intelligence-driven hunts across enterprise, cloud, identity, data center IT, and OT telemetry, and convert findings into code-authored, high-fidelity detections.
Perform hands-on analysis of malware, phishing infrastructure, and attacker tooling to extract indicators, TTPs, and attribution signals for real-time detection engineering and incident response.
Curate the inbound intelligence pipeline from commercial feeds, open source, government, and peer relationships, prioritizing information relevant to the program's threat model.
Build and maintain external intelligence-sharing relationships (ISACs, peer AI and cloud security teams, government partners) to stay ahead of active campaigns.