Security - Member of Technical Staff

Goodfire•San Francisco, CA

4d•$250,000 - $500,000•Onsite

About The Position

Goodfire is seeking its first security hire to own security across the company’s infrastructure, product, and operations. This foundational, hands-on role calls for an engineer who tracks emerging vulnerabilities and attacks, assesses the company’s exposure, responds quickly, and understands how AI is changing the threat landscape. The role will help define security practices for an AI research lab and work closely with research, engineering, and operations teams. The position is based at Goodfire’s San Francisco headquarters, with employees working in person five days a week and one company-wide remote week per month. It reports to the CTO. The role offers a market-competitive salary, equity, and competitive benefits. The expected salary range is $250,000 to $500,000 USD.

Requirements

At least 5 years of security engineering experience, including hands-on ownership of cloud and infrastructure security.
Strong software engineering skills and experience building security tooling.
Experience running incident response and vulnerability management.
Strong understanding of AI security, including how AI agents change the threat model and how to use AI agents in security work.
Willingness and humility to personally own any security-related work, large or small.

Nice To Haves

Startup experience or experience building a security program from scratch.
Experience securing ML research infrastructure or sandboxes for AI agents.
Experience with application and product security.
Corporate security experience, including SSO, MFA, and endpoint management.

Responsibilities

Track newly disclosed exploits, supply-chain risks, and third-party breaches; assess the company’s exposure and remediate issues quickly.
Manage access and credentials for people, services, and AI agents, including short-lived credentials and tightly managed API keys.
Implement logging and alerting across cloud environments, clusters, networks, and SaaS tools.
Maintain product security as new features are built and shipped.
Secure cloud infrastructure, GPU clusters, and agent sandboxes.
Own security operations, including SSO, MFA, and endpoint security.