Infrastructure Engineer, Security

Thinking Machines Lab Inc.; San Francisco (CA); On-site; USD 300,000 - 350,000; Full time

Benefits offered by this job

Health benefits

Unlimited PTO

Parental leave

Relocation support

Job summary

Thinking Machines Lab Inc. is seeking an infrastructure engineer to own and evolve the security infrastructure that underpins our foundation models.

You’ll work across compute, storage, networking, and data platforms to ensure our systems are secure, reliable, and scalable. You’ll shape controls, architecture, and tooling so security is built into the platform by default, and you’ll partner closely with research and product teams to enable fast experimentation while protecting our models, data,

Qualifications

• Bachelor’s degree or equivalent experience in engineering or similar.
• Strong background with containers and orchestration (e.g., Kubernetes) and how to secure them.
• Experience with Infrastructure as Code (Terraform or similar) including secure patterns.
• Solid understanding of cloud networking and security (VPCs, load balancers, mTLS, firewalls).
• Proficiency with Rust and Python for building platform components and tools.
• Experience owning complex production-critical systems across infra, security, and applications.

Responsibilities

• Architect security patterns for platforms and services, including network segmentation, service-to-service authentication, RBAC, and policy enforcement in Kubernetes and cloud environments.
• Manage identity, access, and secrets for humans and services: workload and cross-cloud identity, least-privilege IAM, and secrets management.
• Build secure platforms for data ingestion, processing, and curation with encryption and access controls.
• Write threat models and review designs with researchers and engineers to ship features safely at scale.
• Automate security checks and build guardrails: policy-as-code, secure infrastructure baselines, CI/CD validation.

Skills

Kubernetes security

IaC (Terraform)

Cloud networking & security

Rust

Python scripting

Threat modeling

CI/CD security

Education

Bachelor's degree or equivalent in engineering

Tools

Terraform

Kubernetes

Job description

We’re looking for an infrastructure engineer to own and evolve the security infrastructure that underpins our foundation models. In this role, you’ll work across compute, storage, networking, and data platforms, making sure our systems are secure, reliable, and built to scale. You’ll shape controls, architecture, and tooling so that security is part of how the platform works by default. You’ll partner closely with research and product teams, enabling them to move quickly while keeping our models, data, and environments protected.

What You’ll Do

• Architect security patterns for platforms and services, including network segmentation, service-to-service authentication, RBAC, and policy enforcement in Kubernetes and cloud environments.
• Manage identity, access, and secrets for humans and services: workload and cross-cloud identity, least-privilege IAM, and secrets management.
• Build secure platforms for data ingestion, processing, and curation: classification, encryption, access controls, and safe sharing patterns across teams.
• Write threat models and review designs with researchers and engineers to help them ship features and experiments in a safe, scalable way.
• Automate security checks and build guardrails: policy-as-code, secure infrastructure baselines, validation in CI/CD, and tools that make the secure path the easiest one.

Skills and Qualifications

• Bachelor’s degree or equivalent experience in engineering, or similar.
• Strong background with containers and orchestration (e.g., Kubernetes) and how to secure them (namespaces, network policies, pod security, admission controls, etc.)
• Practical experience with Infrastructure as Code (Terraform or similar), including secure patterns for provisioning networks, IAM, and shared services.
• Solid understanding of cloud networking and security: VPCs, load balancers, service discovery, mTLS, firewalls, and zero-trust-style architectures.
• Proficiency with a systems language such as Rust and scripting in Python for building platform components and internal tools.
• Evidence of owning complex, production-critical systems, including debugging issues that span infra, security, and application layers.

Preferred qualifications — we encourage you to apply if you meet some even if you don't meet all of these:

• Experience with ML infrastructure, GPU clusters, or large-scale training environments (schedulers, job queues, shared storage, multi-tenant clusters).
• Background in AI labs, HPC environments, or ML-heavy organizations where both security and performance are first-class concerns.
• Experience profiling and tuning high-throughput systems, and an ability to reason about the cost of additional security layers.
• Talks, blogs, or publications on infrastructure security, distributed systems, or performance engineering.
• Open-source contributions to security, orchestration, observability, or infrastructure tooling.
• Familiarity with securing specialized hardware (GPUs, TPUs) and their integrations into training and inference pipelines.

Logistics

• Location: This role is based in San Francisco, California.
• Compensation: Depending on background, skills and experience, the expected annual salary range for this position is $300,000 - 350,000 USD.
• Visa sponsorship: We sponsor visas. While we can't guarantee success for every candidate or role, if you're the right fit, we're committed to working through the visa process together.
• Benefits: Thinking Machines offers generous health, dental, and vision benefits, unlimited PTO, paid parental leave, and relocation support as needed.

As set forth in Thinking Machines' Equal Employment Opportunity policy, we do not discriminate on the basis of any protected group status under any applicable law.

Thinking Machines Lab will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the California Fair Chance Act, the San Francisco Fair Chance Ordinance, and any other applicable state or local fair chance ordinance or law.