Security Engineer - Frontier AI Infra, Threat Intel

Socket.dev; New York (NY); On-site; USD 220,000 - 300,000; Full time

Benefits offered by this job

Competitive total compensation package

Equity

Retirement or pension plan

Health, dental, and vision insurance

Generous PTO policy

Job summary

Fluidstack is seeking a security-focused engineer to join our Security Team and defend frontier AI infrastructure across enterprise, cloud, and data center environments. You will track nation-state and criminal actors, build and run pipelines to collect, enrich, and correlate indicators, and push intelligence into fast, automated detections.

We expect hands-on malware and log analysis, production-grade Python, and the ability to author detection logic.

Qualifications

• You write production-quality Python and have built automation and data pipelines your intelligence work depended on, end to end.
• You've done hands-on malware, infrastructure, and log analysis to develop and validate your own findings.
• You've authored quality detection logic (YARA, Sigma, or SIEM-native queries) that shipped to production.
• You've worked shoulder to shoulder with detection engineers and incident responders, turning intelligence into detections, hunting hypotheses, and incident context while an event was live.

Responsibilities

• Track the nation-state and advanced criminal actors most likely to target frontier AI infrastructure, and turn their tooling, infrastructure patterns, and tradecraft into intelligence that changes what the program detects and hunts for.
• Build and run the pipelines that collect, enrich, and correlate indicators, then push them into the detection and agentic triage stack so intelligence becomes operational instantly.
• Drive intelligence-led hunts across enterprise, cloud, identity, data center IT, and OT telemetry, and convert findings into high-fidelity detections authored as code.
• Perform hands‑on malware, phishing‑infrastructure, and attacker‑tooling analysis to extract indicators, TTPs, and attribution signals that feed detection engineering and incident response in near real time.
• Curate the inbound intelligence pipeline across commercial feeds, open source, government, and peer relationships, and prioritize what actually matters for the program's threat model.
• Build and maintain the external intelligence‑sharing relationships (ISACs, peer AI and cloud security teams, government partners) that keep the program ahead of active campaigns.

Job description

Fluidstack is seeking a security-focused engineer to join our Security Team and defend frontier AI infrastructure across enterprise, cloud, and data center environments. You will track nation-state and criminal actors, build and run pipelines to collect, enrich, and correlate indicators, and push intelligence into fast, automated detections.

We expect hands-on malware and log analysis, production-grade Python, and the ability to author detection logic.