Member of Technical Staff, Product Security

San Franciscofull timeRemote

Apply on Employer Site

senior

$200k–$400k

H1B: yes

Inferact Member of Technical Staff, Product Security at Inferact secures the product as it transitions to production use by enterprise customers. The role involves threat-modeling, code review, vulnerability management, and building secure defaults across the inference platform and infrastructure.

Responsibilities

We're looking for a Member of Technical Staff, Product Security to secure the Inferact product as it moves from early deployments to production use by enterprise customers. Customers trust Inferact with their models, prompts, and production traffic. You'll own the security of the systems that serve them: the inference platform and its APIs, the control plane, the cloud and Kubernetes infrastructure underneath, and the way we build and ship software.
This is a hands-on engineering role. You'll threat-model new features with the engineers who build them, review and write code, find and fix vulnerabilities, and build secure defaults, tooling, and guardrails that let a small team move fast without adding risk. You'll work closely with the inference, infrastructure, product, and forward-deployed engineering teams, and with the engineer who owns vLLM vulnerability management when an upstream issue affects our product. You'll set the direction for product security at Inferact and carry the work from design review to shipped fix.
Skills and Qualifications

Qualification

Strong software engineering abilitySound risk judgmentExperience building security toolingCredited CVEs

Required

Hands-on product or application security experience on software that customers run or depend on, with a record of finding, fixing, and preventing real vulnerabilities, not only running scanners or tracking compliance.
Strong software engineering ability: you read and write production code, review pull requests, and can ship a fix and the test that proves it.
Experience threat-modeling and reviewing the design of distributed systems, APIs, and services, including authentication, authorization, multi-tenancy, data isolation, and secrets handling.
Working knowledge of cloud and container security: IAM, network boundaries, Kubernetes, and infrastructure as code.
Sound risk judgment: you can separate a real, reachable risk from a theoretical one and choose controls that fit the stage of the company.
Clear written and verbal communication with engineers, leadership, and customers' security teams, and discretion with sensitive information.

Preferred

Experience securing AI / ML infrastructure, model serving, GPU workloads, or developer platforms.
Experience securing software supply chains and CI/CD: dependency risk, build integrity, artifact signing, and container image hardening.
Familiarity with security risks specific to inference systems, such as untrusted model loading, tenant isolation on shared hardware, and handling of prompts and outputs.
Experience building security tooling, paved roads, or secure-by-default libraries that engineers adopt.
Experience answering the technical part of enterprise customer security reviews and supporting customer deployments in their own cloud environments.
Credited CVEs, security fixes, or security tooling in widely used open-source infrastructure.
Built a product security function from the ground up at an early-stage company.
Offensive security or security research experience that you turned into lasting engineering fixes.