Staff Security Engineer

fal•San Francisco, CA

15h•$180,000 - $250,000

About The Position

fal is hiring a Staff Security Engineer to set technical direction for security across fal.ai. The role spans the GPU compute fleet, multi-cloud and Kubernetes environments, inference APIs, and the AI systems the company builds and uses. The engineer will design security architecture, build controls hands-on, and make secure-by-default practices easy for engineers to adopt. Proficiency in building with and using AI is central to the role.

Requirements

Use LLMs, agents, and AI coding tools daily to build, review, and automate security work.
8+ years of engineering experience, including 5+ years in hands-on security engineering.
Deep knowledge of cloud security (AWS/GCP), Kubernetes, Linux, and identity and access systems.
Strong Python or Rust skills, with experience writing and shipping production code.
A record of leading security improvements adopted by engineering teams without formal authority.
Ability to explain security risk in business terms to engineers and executives.

Nice To Haves

Experience with GPU infrastructure, ML platforms, or multi-tenant compute.
Experience securing LLM-based systems or agent frameworks, or conducting AI red teaming.
Experience with sandboxing and isolation technologies such as gVisor, Firecracker, or Kata.
Experience supporting SOC 2 or ISO 27001 audits.

Responsibilities

Design isolation for multi-tenant GPU workloads, customer code, and model execution.
Protect model weights, customer data, and inference endpoints with identity, encryption, and access controls.
Harden cloud, Kubernetes, CI/CD, and the software supply chain.
Threat model inference, agentic workflows, and internal AI tools, including prompt injection, data leakage, and model supply chain risks.
Build guardrails for agents and AI tools, including scoped permissions, sandboxing, and audit logging.
Use LLMs and agents to automate security reviews, vulnerability triage, and remediation.
Own the security architecture and roadmap for the company's highest-risk areas.
Run design reviews and publish secure patterns teams can adopt independently.
Run vulnerability management from discovery through prioritization and remediation.
Mentor engineers and raise the security bar across the company.