AI Security: Detection & Response Engineer

Bison; San Francisco (CA); On-site; USD 300,000 - 350,000; Full time

Benefits offered by this job

Health benefits

Dental benefits

Vision benefits

Unlimited PTO

Parental leave

Relocation support

Job summary

Thinking Machines is seeking a detection and response engineer to own the pipelines that turn raw telemetry into high-fidelity detections, lead the response during real incidents, and run a threat intelligence program focused on AI labs.

You’ll partner with security, infrastructure, research, and product teams to scale detection and response across cloud, Kubernetes, identity, endpoint, SaaS, and applications.

Qualifications

• Bachelor’s degree or equivalent experience in computer science, engineering, or similar.
• Proficiency in Python or Rust for building data pipelines, detections, and internal tools.
• A track record responding to real security incidents in production environments, including leading investigations and coordinating across teams under pressure.
• Hands-on experience building and operating security data pipelines at scale: log ingestion, parsing and normalization, enrichment, and storage and query in a SIEM or data lake (e.g., Splunk, Elastic, Panther, BigQuery, Snowflake, or ClickHouse).
• Experience producing and consuming threat intelligence: tracking adversary TTPs, mapping them to frameworks like MITRE ATT&CK, and translating intel into detections and hunts.
• Strong understanding of cloud, AWS, GCP, or Azure, Kubernetes, and identity provider telemetry, and how attackers move through these environments.
• Familiarity with host and network forensics, including endpoint telemetry, memory and disk analysis, and network logs.
• Clear communication: incident reports, intel briefs, and postmortems for both technical and non-technical audiences.

Responsibilities

• Lead incident response end-to-end: triage, scoping, containment, eradication, recovery, and blameless postmortems that turn lessons into new detections and controls.
• Design, build, and operate the security data pipelines and tooling that power detection and response: collecting, normalizing, enriching, and storing telemetry from cloud, Kubernetes, identity, endpoint, SaaS, and application sources.
• Author, deploy, and maintain high-fidelity detections across SIEM, endpoint, cloud, and security tooling.
• Build and run our threat intelligence practice: track actors and campaigns relevant to AI labs such as espionage, model weight theft, supply chain compromise, and credential abuse. Turn that intel into hunts, detections, and hardening recommendations.
• Proactively hunt for threats across our environment, and build automation and response tooling: enrichment, playbooks, automated containment that shortens time to detect and respond.
• Collaborate with researchers and product teams to detect AI-specific threats in production. Develop and exercise incident response plans, on-call processes, and tabletop exercises with engineering, research, legal, and leadership.

Skills

Python

Rust

Incident response

Data pipelines

SIEM

Cloud platforms

Kubernetes

Threat intelligence

Communication

Education

Bachelor's degree or equivalent in CS/Engineering

Tools

Splunk

Elastic

Panther

BigQuery

Snowflake

ClickHouse

Job description

Thinking Machines is seeking a detection and response engineer to own the pipelines that turn raw telemetry into high-fidelity detections, lead the response during real incidents, and run a threat intelligence program focused on AI labs.

You’ll partner with security, infrastructure, research, and product teams to scale detection and response across cloud, Kubernetes, identity, endpoint, SaaS, and applications.