Member of Technical Staff, Vulnerability Management

Inferact Inc.; San Francisco (CA); Hybrid; USD 200,000 - 400,000; Full time

Job summary

Inferact in San Francisco, California is seeking a Member of Technical Staff, Vulnerability Management to own the vulnerability process for vLLM. You will investigate reports, reproduce issues, and clearly articulate remediation steps for the core team.

You will coordinate fixes, advisories, and releases, and help establish security best practices as the project evolves. Remote US candidates may be considered for exceptional fit.

Qualifications

• Hands-on product security experience with infrastructure software and security of complex systems.
• Ability to read code, debug unfamiliar systems, reproduce issues, and explain root cause and impact.
• Strong systems reasoning about architecture, trust boundaries, deployment assumptions, and component interactions.
• Ability to learn vLLM's core architecture and independently manage vulnerability investigations.
• Sound prioritization and risk assessment, with clear evidence, remediation needs and next steps.
• Strong written and verbal communication, discretion with sensitive reports, and collaboration with engineers and researchers.

Responsibilities

• Own Inferact's vulnerability-management process for vLLM.
• Investigate vulnerability reports, reproduce issues, and articulate root causes and impact.
• Drive reports from triage through analysis and resolution.
• Coordinate fixes, security advisories, and releases with maintainers and researchers.
• Identify security best practices and strengthen vLLM as it evolves.
• Prepare architecture reviews and regression considerations for fixes.

Skills

Product security

Infrastructure security

Code reading

Root cause analysis

Systems thinking

Vulnerability investigations

Documentation & reporting

Communication

Open-source security

Coordination

Job description

Overview

Inferact's mission is to grow vLLM as the world's AI inference engine and accelerate AI progress by making inference cheaper and faster. Founded by the creators and core maintainers of vLLM, we sit at the intersection of models and hardware, a position that took years to build.

About the Role

We're looking for a Member of Technical Staff, Vulnerability Management to own Inferact's side of vLLM's vulnerability-management process and help keep a critical piece of AI infrastructure secure and production-grade. You'll develop a deep understanding of vLLM's architecture, independently investigate vulnerability reports, and turn technical findings into clear, actionable work for the core team.

Working primarily in open source, you'll collaborate with vLLM maintainers, Red Hat counterparts, security firms, and researchers working with frontier AI models. You'll drive reports from initial triage through analysis and resolution, helping coordinate fixes, security advisories, and releases under the project's established process. You'll also identify practical security best practices that strengthen vLLM as it evolves. This is a hands-on product security role that combines technical investigation, sound judgment, and ownership of follow-through.

vLLM's vulnerability-management process

Skills and Qualifications

Minimum qualifications:

• Hands-on product security experience, with a strong orientation toward infrastructure software and the security of complex software systems.

• Ability to read source code, debug unfamiliar systems, reproduce reported issues, and explain root cause and practical security impact rather than simply forward findings.

• Strong systems reasoning, including the ability to understand architecture, trust boundaries, deployment assumptions, and how different software components interact.

• Ability to learn vLLM's core architecture and independently manage vulnerability investigations while bringing in maintainers where their expertise is needed.

• Sound prioritization and risk-assessment judgment, with clear documentation of evidence, affected behavior, remediation needs, and next steps.

• Strong written and verbal communication, discretion with sensitive reports, and the ability to work constructively with engineers, researchers, and external security collaborators.

Preferred qualifications:

• Experience with vulnerability management and security best practices for open-source infrastructure software.

• Experience coordinating vulnerability resolution across reporters, maintainers, security teams, and software releases.

• Familiarity with vLLM, inference engines, ML infrastructure, or similarly complex distributed software; prior vLLM contributions are helpful but not required.

• Experience preparing security advisories, assessing affected versions, and working with CVE and coordinated-disclosure workflows.

• Experience translating security findings into practical architecture reviews, regression tests, secure development practices, or deployment guidance.

Bonus points if you have:

• Helped resolve vulnerabilities in an open-source infrastructure project and can explain your technical contribution and coordination with maintainers.

• Built security tooling or automation that improved investigation quality or reduced repetitive triage work.

• Turned recurring vulnerability patterns into maintainable fixes, tests, or documentation that helped prevent similar issues.

Logistics

• Location: This role is based in San Francisco, California. Will consider remote in the US for exceptional candidates.

• Compensation: Depending on background, skills, and experience, the expected annual salary range for this position is $200,000 - $400,000 USD + equity.

• Visa sponsorship: We sponsor visas on a case-by-case basis.

• Benefits: Applicable benefits will be confirmed based on the final role location.