Staff Security Engineer - Vulnerability Management

Inferact; San Francisco (CA); Remote; USD 200,000 - 400,000; Full time

Job summary

Inferact seeks a Member of Technical Staff, Vulnerability Management to own vLLM's vulnerability-management process and help keep AI infrastructure secure and production-grade. You'll develop a deep understanding of vLLM's architecture and independently investigate vulnerability reports.

Working with open‑source collaborators, you will drive reports from triage through analysis and resolution, coordinate fixes, security advisories, and releases, and identify practical security best practices to

Qualifications

• Hands-on product security experience focused on infrastructure software and secure systems.
• Ability to read source code, debug unfamiliar systems, reproduce issues, and explain root cause with impact.
• Strong systems reasoning: understand architecture, trust boundaries and deployment.
• Learn vLLM core architecture and manage investigations with maintainers.
• Clear evidence, remediation steps, and next actions documented.
• Strong written and verbal communication, and collaboration with engineers and researchers.

Responsibilities

• Own vLLM vulnerability-management process from triage to resolution.
• Investigate vulnerability reports, reproduce issues, and assess security impact.
• Coordinate fixes, advisories, and releases with maintainers and security teams.
• Develop security best practices and contribute to open-source security work.

Skills

Product security

Code reading

Systems reasoning

Architecture understanding

Risk assessment

Communication

Job description

Inferact seeks a Member of Technical Staff, Vulnerability Management to own vLLM's vulnerability-management process and help keep AI infrastructure secure and production-grade. You'll develop a deep understanding of vLLM's architecture and independently investigate vulnerability reports.

Working with open‑source collaborators, you will drive reports from triage through analysis and resolution, coordinate fixes, security advisories, and releases, and identify practical security best practices to