Member of Technical Staff, Vulnerability Management

Inferact; San Francisco (CA); À distance; USD 200 000 - 400 000; Plein temps

Résumé du poste

Inferact seeks a Member of Technical Staff, Vulnerability Management to own vLLM's vulnerability-management process and help keep AI infrastructure secure and production-grade. You'll develop a deep understanding of vLLM's architecture and independently investigate vulnerability reports.

Working with open‑source collaborators, you will drive reports from triage through analysis and resolution, coordinate fixes, security advisories, and releases, and identify practical security best practices to

Qualifications

• Hands-on product security experience focused on infrastructure software and secure systems.
• Ability to read source code, debug unfamiliar systems, reproduce issues, and explain root cause with impact.
• Strong systems reasoning: understand architecture, trust boundaries and deployment.
• Learn vLLM core architecture and manage investigations with maintainers.
• Clear evidence, remediation steps, and next actions documented.
• Strong written and verbal communication, and collaboration with engineers and researchers.

Responsabilités

• Own vLLM vulnerability-management process from triage to resolution.
• Investigate vulnerability reports, reproduce issues, and assess security impact.
• Coordinate fixes, advisories, and releases with maintainers and security teams.
• Develop security best practices and contribute to open-source security work.

Connaissances

Product security

Code reading

Systems reasoning

Architecture understanding

Risk assessment

Communication

Description du poste

Overview

Inferact's mission is to grow vLLM as the world's AI inference engine and accelerate AI progress by making inference cheaper and faster. Founded by the creators and core maintainers of vLLM, we sit at the intersection of models and hardware, a position that took years to build.

Overview

Inferact's mission is to grow vLLM as the world's AI inference engine and accelerate AI progress by making inference cheaper and faster. Founded by the creators and core maintainers of vLLM, we sit at the intersection of models and hardware, a position that took years to build.

About The Role

We're looking for a Member of Technical Staff, Vulnerability Management to own Inferact's side of vLLM's vulnerability-management process and help keep a critical piece of AI infrastructure secure and production-grade. You'll develop a deep understanding of vLLM's architecture, independently investigate vulnerability reports, and turn technical findings into clear, actionable work for the core team.

Working primarily in open source, you'll collaborate with vLLM maintainers, Red Hat counterparts, security firms, and researchers working with frontier AI models. You'll drive reports from initial triage through analysis and resolution, helping coordinate fixes, security advisories, and releases under the project's established process. You'll also identify practical security best practices that strengthen vLLM as it evolves. This is a hands‑on product security role that combines technical investigation, sound judgment, and ownership of follow‑through.

vLLM's vulnerability‑management process

Skills And Qualifications

Minimum qualifications:

• Hands‑on product security experience, with a strong orientation toward infrastructure software and the security of complex software systems.
• Ability to read source code, debug unfamiliar systems, reproduce reported issues, and explain root cause and practical security impact rather than simply forward findings.
• Strong systems reasoning, including the ability to understand architecture, trust boundaries, deployment assumptions, and how different software components interact.
• Ability to learn vLLM's core architecture and independently manage vulnerability investigations while bringing in maintainers where their expertise is needed.
• Sound prioritization and risk‑assessment judgment, with clear documentation of evidence, affected behavior, remediation needs, and next steps.
• Strong written and verbal communication, discretion with sensitive reports, and the ability to work constructively with engineers, researchers, and external security collaborators.

Preferred qualifications:

• Experience with vulnerability management and security best practices for open‑source infrastructure software.
• Experience coordinating vulnerability resolution across reporters, maintainers, security teams, and software releases.
• Familiarity with vLLM, inference engines, ML infrastructure, or similarly complex distributed software; prior vLLM contributions are helpful but not required.
• Experience preparing security advisories, assessing affected versions, and working with CVE and coordinated‑disclosure workflows.
• Experience translating security findings into practical architecture reviews, regression tests, secure development practices, or deployment guidance.

Bonus points if you have:

• Helped resolve vulnerabilities in an open‑source infrastructure project and can explain your technical contribution and coordination with maintainers.
• Built security tooling or automation that improved investigation quality or reduced repetitive triage work.
• Turned recurring vulnerability patterns into maintainable fixes, tests, or documentation that helped prevent similar issues.

Logistics

• Location: This role is based in San Francisco, California. Will consider remote in the US for exceptional candidates.
• Compensation: Depending on background, skills, and experience, the expected annual salary range for this position is $200,000 - $400,000 USD + equity.
• Visa sponsorship: We sponsor visas on a case‑by‑case basis.
• Benefits: Applicable benefits will be confirmed based on the final role location.

Compensation Range: $200K - $400K