Detection and Response Engineer (AI)

Location: On-site in San Francisco, California, United States

Annual salary: $300,000–$350,000 USD

Company

Thinking Machines Lab builds frontier AI models, tools for customizing models, and interfaces for human-AI communication.

What you will do

• Lead end-to-end incident response, including triage, scoping, containment, eradication, recovery, and blameless postmortems.
• Design, build, and operate security data pipelines and tooling for telemetry from cloud, Kubernetes, identity, endpoint, SaaS, and application sources.
• Author, deploy, and maintain high-fidelity detections across SIEM, endpoint, cloud, and security tooling.
• Build threat intelligence capabilities focused on espionage, model weight theft, supply chain compromise, credential abuse, and other threats targeting AI labs.
• Conduct threat hunting and build enrichment, playbook, automated containment, and other response tooling.
• Develop and exercise incident response plans, on-call processes, and tabletop exercises with engineering, research, legal, and leadership teams; participate in the security incident pager rotation.

Requirements

• Bachelor’s degree or equivalent experience in computer science, engineering, or a similar field.
• Proficiency in Python or Rust for building data pipelines, detections, and internal tools.
• Production security incident response experience, including leading investigations and coordinating across teams under pressure.
• Hands-on experience building and operating security data pipelines at scale, including log ingestion, parsing, normalization, enrichment, storage, and querying in a SIEM or data lake such as Splunk, Elastic, Panther, BigQuery, Snowflake, or ClickHouse.
• Experience producing and consuming threat intelligence, tracking adversary TTPs, mapping them to MITRE ATT&CK, and translating intelligence into detections and hunts.
• Strong understanding of cloud environments including AWS, GCP, or Azure, Kubernetes, identity provider telemetry, and attacker movement through these environments.
• Familiarity with host and network forensics, including endpoint telemetry, memory and disk analysis, and network logs.
• Ability to operate across the stack, own projects end-to-end, and communicate clearly through incident reports, intelligence briefs, and postmortems for technical and non-technical audiences.

Nice to have

• Detection and response experience at an AI lab, cloud provider, or other high-threat environment targeted by sophisticated actors.
• Experience detecting AI-specific abuse such as prompt injection, model extraction, or anomalous API usage.
• Familiarity with ML infrastructure telemetry, including GPU clusters, training jobs, and model artifact storage.
• Experience with stream processing such as Kafka, Flink, or Vector and cost-aware high-volume log management.
• Malware analysis or reverse engineering experience.
• Talks, blogs, open-source detection content, or published threat research.

Culture & Benefits

• Visa sponsorship is available, with support through the visa process for suitable candidates.
• Relocation support is available as needed.
• Health, dental, and vision benefits.
• Unlimited PTO and paid parental leave.