AI Security Detection & Response Engineer

Thinking Machines Lab Inc.; San Francisco (CA); On-site; USD 300,000 - 350,000; Full time

Benefits offered by this job

Health, dental, and vision benefits

Unlimited PTO

Paid parental leave

Relocation support

Job summary

Thinking Machines in San Francisco seeks a detection and response engineer to own pipelines that turn raw telemetry into detections, lead incident response, and run a threat intelligence program focused on frontier AI labs.

You’ll collaborate with security, infra, research, and product teams to scale detection and response while maintaining rapid incident containment and postmortems. On-call rotations apply.

Qualifications

• Bachelor’s degree or equivalent in CS, engineering, or similar.
• Proficiency in Python or Rust for data pipelines and detections.
• Experience responding to real security incidents in production.
• Hands-on experience building security data pipelines at scale (log ingestion, parsing, normalization).
• Experience with threat intel: tracking adversaries and mapping to MITRE ATT&CK.
• Strong cloud/Kubernetes/identity telemetry knowledge.

Responsibilities

• Lead incident response end-to-end including containment and postmortems.
• Design and operate security data pipelines and tooling for telemetry.
• Author, deploy, maintain high-fidelity detections across SIEM and cloud.
• Build and run threat intelligence practice and hunts.
• Hunt for threats across environment and build automation for containment.
• Collaborate with researchers and product teams on AI-specific threats; on-call and tabletop exercises.
• Participate in on-call pager rotation.

Skills

Python

Rust

Incident response

Security data pipelines

SIEM

Cloud platforms

Kubernetes

Threat intelligence

Communication

Education

Bachelor’s degree in CS/Engineering

Tools

Splunk

Elastic

Panther

BigQuery

Snowflake

ClickHouse

Job description

Thinking Machines in San Francisco seeks a detection and response engineer to own pipelines that turn raw telemetry into detections, lead incident response, and run a threat intelligence program focused on frontier AI labs.

You’ll collaborate with security, infra, research, and product teams to scale detection and response while maintaining rapid incident containment and postmortems. On-call rotations apply.