Sr. Security Engineer, Operations

Description

The team is hiring a senior engineer to tackle hard security problems across the company's AI work.

The company builds and trains its own models, publishes them, and uses them across several products. The work covers model development and serving, large-scale compute, shared infrastructure, engineering systems, identity, data, and productivity services, which together make up the full operational stack behind large training, experimentation, and deployment.

In the past year the group went from research lab to full production model factory. The role suits someone who has built and run production engineering or security systems on their own and can do it again while the frameworks, operating methods, and secure defaults for frontier AI infrastructure are still being set up.

Candidates may come from product or software engineering, security operations, or infrastructure engineering, including detection and response in those fields. Your path matters less than solid building skills and sound practical risk judgment. You should be able to take an unfamiliar problem, reason from the evidence available, own a significant piece of work, and finish it with validated results.

The role is intentionally broad. Early work could include an automated control for the agent framework, better identity or secrets handling in training systems, end-to-end instrumentation and detection for a service, an attack path investigation, hardening a developer workflow, an AI-assisted security tool, or help for a platform team with a systemic risk. You do not need to be an expert in every area at the start. You will write code, analyze systems and data, build tools, test controls, and work with engineering teams through implementation and validation. You will use AI daily for research, coding, analysis, testing, investigation, and automation, and you stay accountable for the correctness, security, limits, and upkeep of its output.

The team earns trust by staying close to the systems it protects, shipping improvements instead of only reporting problems, stating its reasoning and tradeoffs, and being candid with partners about real risk, even when the news is unwelcome. The aim is faster, safer model and product delivery, not another blocker.

The problem sets the domain, so depth and adaptability count for more than one narrow specialty. You build rather than route work, and the expected output is a changed system, an adopted capability, or a validated risk reduction. You will help shape the team's tools, standards, and direction while it is still early.

Success looks like a material problem moved from ambiguity to a validated fix, a tool or control running in a real workflow, partner engineers operating without depending on you, faster AI-assisted work that stays testable and secure, incidents leading to system-level fixes, and stronger team practices and documentation.

Responsibilities

• Own security problems from start to finish: frame the problem, design, build, deploy, drive adoption, validate, measure, and refine.
• Find material risks and workable fixes using architecture analysis, threat modeling, code and config review, telemetry, adversarial testing, incident evidence, and data analysis.
• Build production-grade tools, services, integrations, controls, detections, automations, and reference implementations, not just findings or recommendations.
• Collaborate with the teams that run product, research, and infrastructure systems to ship changes inside those systems themselves.
• State tradeoffs openly, ship useful increments early, and update the solution as operational evidence reveals more about the problem.
• Early projects may include swapping a manual control for automation, detecting identity misuse in training infrastructure, or hardening a developer workflow many teams depend on. The first project will follow the highest-value problem at the time you join.
• Raise security across areas such as application and product security, cloud and platform, identity and secrets, developer systems, software supply chain, data protection, security telemetry, detection and response, and incident readiness.
• Turn repeated security needs into secure defaults, paved paths, shared libraries, automated checks, self-service workflows, or platform features.
• Instrument systems and controls so owners can see their health, coverage, adoption, and failures.
• Help with security incidents and exercises in your area. Find root causes, assist with containment and recovery, and turn lessons into system-wide fixes.
• Write technical standards, threat models, runbooks, architecture patterns, and docs so engineers can act without waiting on a security specialist.
• When a team needs a design review, access exception, or risk call, help it find a path that works and keep checking that the path holds, rather than acting as a pass or fail gate.
• Use models and agents to speed up coding, query writing, investigation, analysis, testing, documentation, and workflow automation.
• Verify AI output with tests, representative data, source evidence, peer review, and direct inspection matched to what the decision could affect.
• Build AI-based security features when they improve the system, with clear authority, data access, evaluation, monitoring, human review, and failure handling.
• Judge when deterministic code, conventional software, statistical methods, or human judgment fit better than a model.
• Share effective AI-assisted engineering methods and help the team move faster without lowering its quality or security bar.
• Help build the practices, tools, operating routines, and culture of a growing AI security team.
• Report progress, technical choices, uncertainty, dependencies, and blockers clearly. When escalating, bring evidence, options, and a specific decision to make.
• Seek expertise across organizational lines, mentor teammates where you are strong, and learn from principal and distinguished engineers.
• Use central company capabilities when they fit, and build AI-specific ones when the mission needs a different control point or operating model.
• Raise risks and disagreements directly and respectfully, even when staying quiet would be easier, and back the execution once the accountable owner decides.

Requirements

• A doctorate in Statistics, Mathematics, Computer Science, or a related field.
• Or a master's degree in one of those fields plus 3+ years in software development lifecycle, large-scale computing, threat modeling, cyber security, anomaly detection, SOC detection, threat analytics, SIEM, IT, or operations incident response.
• Or a bachelor's degree in one of those fields plus 4+ years in the same areas.
• Or equivalent experience.
• Preferred: a doctorate in those fields plus 3+ years in software development lifecycle, large-scale computing, threat modeling, cyber security, or anomaly detection, or a master's plus 6+ years, or a bachelor's plus 8+ years, or equivalent experience.
• Preferred: CISSP, CISA, CISM, SANS, OSCP, or Security+ certification.
• Preferred: strong software, infrastructure, or security engineering background, including writing, debugging, testing, and running production code or automation.
• Preferred: experience owning a hard technical problem from unclear requirements through implementation and ongoing use.
• Preferred: applied security judgment through threat modeling, architecture or code and config review, adversarial testing, detection engineering, incident investigation, or security data analysis.
• Preferred: experience implementing and validating changes in systems outside your own team, not only handing findings to others.
• Preferred: ability to work through unfamiliar systems, spot a high-value fix, and make progress without a set playbook.
• Preferred: experience using telemetry, tests, operational data, or other evidence to make and check technical decisions.
• Preferred: clear writing and the ability to explain technical work to technical and non-technical audiences.
• Preferred: experience securing cloud, distributed, identity, data, developer platform, AI, machine learning, or large-scale compute systems.
• Preferred: experience building security tools, platform features, automated controls, detections, integrations, or response workflows that reached sustained production use.
• Preferred: experience with incident response, threat hunting, adversary simulation, vulnerability research, product security, or infrastructure hardening.
• Preferred: experience using large language models or agents in engineering, security analysis, investigation, or automation, with proper validation and oversight.
• Preferred: experience contributing across more than one security or engineering domain.
• Preferred: experience defining scope and priorities for problems with no established solution or process.
• Preferred qualifications are not independent pass or fail gates, and candidates who meet some but not all are encouraged to apply.

Conditions

Level: Security Operations Engineering IC4.

Typical base pay across the US is USD $119,800 to $234,700 per year.

In the San Francisco Bay area and the New York City metropolitan area, base pay is USD $160,200 to $261,000 per year.

The posting will stay open for at least 5 days and accepts applications on an ongoing basis until the position is filled.

Benefits

• Some roles may be eligible for benefits and other compensation, with further pay and benefit details published separately.