Software Engineer, Privacy & Data Governance

Thinking Machines Lab•San Francisco, CA

9d•$300,000 - $350,000

About The Position

Thinking Machines is hiring an engineer to manage data handling across the company, including what data is collected or acquired, where it is stored, who and which systems can access it, how long it is retained, and how it is used in training, evaluation, and products. The role builds systems for privacy protection and for making definitive statements about company practices, spanning data inventory and classification, access and purpose controls, retention, deletion, and auditing. The engineer will collaborate with researchers and product engineers to resolve complex privacy questions. This role treats privacy as an engineering problem. It requires weighing privacy against model quality, research velocity, and product usefulness, choosing defensible approaches, and implementing them. Examples include addressing deletion requests involving trained models, isolating customer fine-tuning data on Tinker, and deciding when to use deidentification versus differential privacy.

Requirements

Built and operated at least one production privacy or data governance system, such as a retention or deletion pipeline, policy evaluation engine, data cataloging or lineage system, or consent system.
Written and operated production code in Python or a comparable language, and be able to explain a system's operation, failure modes, and debugging in detail.
Direct experience enforcing privacy or governing data in an AI/ML data pipeline involving training data, fine-tuning, inference, or evaluation, and ability to describe a specific privacy risk identified or mitigated.
Experience choosing pragmatic controls over ideal ones for real systems and explaining what was shipped as a result.
Experience translating a legal or policy obligation, such as GDPR or CCPA, into a technical requirement or control, and ability to identify the obligation and control.

Nice To Haves

Experience at an AI lab or with ML infrastructure, such as training data curation, multi-tenant fine-tuning platforms, or inference systems handling user data.
Implemented a privacy-enhancing technique, such as deidentification, differential privacy, or secure enclaves, in a real system and can describe its limitations.
Experience building data lineage, metadata, or policy-engine tooling, or large-scale deletion and retention systems.
Background in security engineering or experience working directly with a security team on access control implementation.
Experience as one of the first engineers building a privacy function, with specific systems personally built.

Responsibilities

Implement and enforce privacy and data governance across internal systems by building and integrating data classification tagging, retention jobs, deletion pipelines, and data classifiers.
Build isolation guarantees that keep customer and user data separate and protected, including customer-provided Tinker training data and conversations with the company's interfaces.
Conduct privacy reviews and threat models for new data sources, training runs, and product features, and address findings by shipping controls, checks, or tooling.
Translate legal and policy requirements, including GDPR, CCPA, and contractual commitments, into policy-as-code, CI checks, and pipeline enforcement.
Maintain shared libraries and guardrails that make privacy-protective practices the default, and repair or update them when needed.