Staff Security Engineer

fal - Features & Labels; San Francisco (CA); On-site; USD 180,000 - 250,000; Full time

Benefits offered by this job

Equity

Health, dental, and vision insurance

Team events and offsites

Visa sponsorship

Relocation to San Francisco

Job summary

fal's is seeking a Staff Security Engineer to set the technical direction for security across fal.ai. You will own the security architecture and roadmap for high-risk areas, including multi-tenant GPU workloads, model weights, and delivery pipelines, with day-to-day AI fluency.

You will design secure patterns, run vulnerability management, and mentor engineers while driving security reviews and guardrails across the organization. This role is based in San Francisco with onsite work requirements.

Qualifications

• AI fluency with LLMs, agents, and AI coding tools used daily to build and automate security work.
• 8+ years of engineering experience, including 5+ years in hands-on security engineering.
• Deep knowledge of cloud security (AWS/GCP), Kubernetes, Linux, and IAM systems.
• Proficient in Python or Rust with production code experience.
• Proven track record of security improvements adopted by engineering teams.
• Ability to explain security risk in business terms to engineers and executives.

Responsibilities

• Design isolation for multi-tenant GPU workloads, customer code, and model execution
• Protect model weights, customer data, and inference endpoints with identity, encryption, and access controls
• Harden cloud, Kubernetes, CI/CD, and software supply chain
• Threat model inference and agentic workflows, including risks such as prompt injection, data leakage, and model supply chain threats
• Build AI and agent guardrails, including scoped permissions, sandboxing, and audit logging
• Use LLMs and agents to automate security reviews, vulnerability triage, and remediation
• Own security architecture and roadmap coverage for top-risk areas
• Lead design reviews and publish secure patterns for broader adoption
• Run vulnerability management from discovery through prioritization and fixes
• Mentor engineers and raise the security bar across the company

Skills

AI fluency

LLMs & agents

Python or Rust

Security engineering

Risk communication

Tools

AWS

GCP

Kubernetes

Linux

CI/CD

gVisor

Firecracker

Kata

SOC 2

ISO 27001

Python

Rust

Job description

fal's seeking a Staff Security Engineer to set the technical direction for security across fal.ai. This role will define and drive security architecture while building practical controls spanning GPU compute, multi-cloud and Kubernetes environments, inference APIs, and AI systems, with strong day-to-day AI fluency.

Role Overview

You will own the security architecture and roadmap for fal's highest-risk areas. The work includes designing secure isolation for multi-tenant workloads, protecting model weights and customer data, hardening critical infrastructure and delivery pipelines, and establishing repeatable security patterns that engineering teams can adopt without waiting on security reviews.

Key Responsibilities

• Design isolation for multi-tenant GPU workloads, customer code, and model execution
• Protect model weights, customer data, and inference endpoints using identity, encryption, and access controls
• Harden cloud, Kubernetes, CI/CD, and the software supply chain
• Threat model inference and agentic workflows, including risks such as prompt injection, data leakage, and model supply chain threats
• Build AI and agent guardrails, including scoped permissions, sandboxing, and audit logging
• Use LLMs and agents to automate security reviews, vulnerability triage, and remediation
• Own security architecture and roadmap coverage for top-risk areas
• Lead design reviews and publish secure patterns for broader adoption
• Run vulnerability management from discovery through prioritization and fixes
• Mentor engineers and raise the security bar across the company

Required Qualifications

• AI fluency, using LLMs, agents, and AI coding tools daily to build, review, and automate security work
• 8+ years of engineering experience, including 5+ years in hands-on security engineering
• Deep knowledge of cloud security (AWS/GCP), Kubernetes, Linux, and identity and access systems
• Strong ability in Python or Rust, with experience writing and shipping production code
• Demonstrated record of security improvements that engineering teams adopted
• Ability to explain security risk in business terms to engineers and executives
• Experience securing GPU infrastructure, ML platforms, or multi-tenant compute
• Experience with securing LLM-based systems or agent frameworks, or AI red teaming
• Experience with sandboxing and isolation technologies such as gVisor, Firecracker, or Kata
• Experience supporting SOC 2 or ISO 27001 audits

Technologies

AWS, GCP, Kubernetes, Linux, Python, Rust, LLMs, agents, CI/CD, gVisor, Firecracker, Kata, SOC 2, ISO 27001

Compensation and Equity

Salary: USD 180,000 - 250,000 per year

Equity: Offers Equity

Total package: $180,000 - $250,000 + equity + comprehensive benefits package

Benefits

• Offers Equity
• Health, dental, and vision insurance (US)
• Regular team events and offsites
• Visa sponsorship and relocation support to San Francisco

Location and Employment

• Location: San Francisco, CA (onsite)
• Employment type: Full time
• Department: Engineering