Security Engineer, Detection & Response

Thinking Machines Lab; San Francisco (CA); On-site; USD 300,000 - 350,000; Full time

Benefits offered by this job

Health, dental, and vision benefits

Unlimited PTO

Paid parental leave

Relocation support

Job summary

Thinking Machines Lab Inc. in San Francisco seeks a Detection and Response Engineer to build and run defenses for our frontier AI platforms, models and data. You’ll own telemetry pipelines, detections, and incident response, collaborating with security, infra, research, and product teams to scale protections.

You’ll hunt threats, translate intel into detections, and develop automation and playbooks to shorten detection and response times, including on-call coverage and tabletop exercises.

Qualifications

• Bachelor’s degree or equivalent in CS/engineering.
• Proficiency in Python or Rust for data pipelines and tooling.
• Experience leading investigations during real incidents.
• Hands-on with security data pipelines: ingestion, normalization, storage and query.
• Experience threat intelligence: tracking adversaries and MITRE ATT&CK mappings.
• Strong cloud and container telemetry knowledge (AWS/GCP/Azure, Kubernetes).
• Familiarity with host/network forensics and telemetry.
• Clear communication for technical and non-technical audiences.

Responsibilities

• Lead incident response end-to-end: triage, scoping, containment, eradication, recovery, and postmortems.
• Design, build, and operate security data pipelines powering detection and response.
• Author, deploy, and maintain high-fidelity detections across SIEM, cloud, and tooling.
• Build and run threat intelligence: hunts, detections, and hardening recommendations.
• Proactively hunt for threats; develop automation and response tooling.
• Collaborate with researchers and product teams to detect AI-specific threats.
• Develop and exercise incident response plans, on-call processes, and tabletop exercises.
• Participate in an on-call pager rotation for security incidents.

Skills

Python

Rust

Incident response

Data pipelines

Detections

Threat intel

Cloud telemetry

Kubernetes

Communication

Education

Bachelor's degree or equivalent in CS/engineering

Tools

Splunk

Elastic

Panther

BigQuery

Snowflake

ClickHouse

Kafka

Flink

Vector

Job description

We’re looking for a detection and response engineer to build how we find, investigate, and stop threats against our company, platforms, models, and data. You’ll own the pipelines that turn raw telemetry into high-fidelity detections, lead the response when real incidents happen, and run a threat intelligence practice that keeps our defenses focused on the adversaries who actually target frontier AI labs. You’ll partner closely with security, infrastructure, research, and product teams so that detection and response scale with the company instead of slowing it down.

What You’ll Do

• Lead incident response end-to-end: triage, scoping, containment, eradication, recovery, and blameless postmortems that turn lessons into new detections and controls.
• Design, build, and operate the security data pipelines and tooling that power detection and response: collecting, normalizing, enriching, and storing telemetry from cloud, Kubernetes, identity, endpoint, SaaS, and application sources.
• Author, deploy, and maintain high-fidelity detections across SIEM, endpoint, cloud, and security tooling
• Build and run our threat intelligence practice: track actors and campaigns relevant to AI labs such as espionage, model weight theft, supply chain compromise, and credential abuse. Turn that intel into hunts, detections, and hardening recommendations.
• Proactively hunt for threats across our environment, and build automation and response tooling: enrichment, playbooks, automated containment that shortens time to detect and respond.
• Collaborate with researchers and product teams to detect AI-specific threats in production.Develop and exercise incident response plans, on-call processes, and tabletop exercises with engineering, research, legal, and leadership.
• Participate in an on-call pager rotation for security incidents.

Skills and Qualifications

• Bachelor’s degree or equivalent experience in computer science, engineering, or similar.
• Proficiency in Python or Rust for building data pipelines, detections, and internal tools.
• A track record responding to real security incidents in production environments, including leading investigations and coordinating across teams under pressure.
• Hands-on experience building and operating security data pipelines at scale: log ingestion, parsing and normalization, enrichment, and storage and query in a SIEM or data lake (e.g., Splunk, Elastic, Panther, BigQuery, Snowflake, or ClickHouse).
• Experience producing and consuming threat intelligence: tracking adversary TTPs, mapping them to frameworks like MITRE ATT&CK, and translating intel into detections and hunts.
• Strong understanding of cloud, AWS, GCP, or Azure, Kubernetes, and identity provider telemetry, and how attackers move through these environments.
• Familiarity with host and network forensics, including endpoint telemetry, memory and disk analysis, and network logs.
• Comfort operating across the stack and owning projects end-to-end.
• Clear communication: incident reports, intel briefs, and postmortems for both technical and non-technical audiences.

Preferred qualifications

• Detection and response experience at an AI lab, cloud provider, or other high-threat environment targeted by sophisticated actors.
• Experience detecting AI-specific abuse, such as prompt injection, model extraction, or anomalous API usage.
• Familiarity with ML infrastructure telemetry: GPU clusters, training jobs, and model artifact storage.
• Experience with stream processing (e.g., Kafka, Flink, Vector) and cost-aware log management at high volume.
• Malware analysis or reverse engineering experience.
• Talks, blogs, open-source detection content, or published threat research.

Logistics

• Location: This role is based in San Francisco, California.
• Compensation: Depending on background, skills and experience, the expected annual salary range for this position is $300,000 - $350,000 USD.
• Visa sponsorship: We sponsor visas. While we can't guarantee success for every candidate or role, if you're the right fit, we're committed to working through the visa process together.
• Benefits: Thinking Machines offers generous health, dental, and vision benefits, unlimited PTO, paid parental leave, and relocation support as needed.