{"id":3362397,"url":"https://alion.io/job/thinking-machines-lab-security-engineer-detection-response","title":"Security Engineer, Detection & Response","company":{"id":14382,"name":"Thinking Machines Lab","domain":"thinkingmachines.ai","url":"https://alion.io/company/thinking-machines-lab","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":300000,"max":350000,"currency":"USD","period":"year","gross":null,"usd_annual":350000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"ClickHouse","optional":false},{"name":"GCP","optional":false},{"name":"Google BigQuery","optional":false},{"name":"Kubernetes","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Rust","optional":false},{"name":"SIEM","optional":false},{"name":"Snowflake","optional":false},{"name":"Splunk","optional":false},{"name":"Apache Kafka","optional":true},{"name":"Flink","optional":true}],"status":"live","first_seen_at":"2026-10-27T18:51:47Z","employer_posted_date":"2026-10-27","last_verified_at":"2026-11-02T19:14:23Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"About Thinking Machines\nThe mission of Thinking Machines is to build AI that extends human will and judgment. We are training frontier models with Inkling, developing Tinker to let people make models their own, and crafting interfaces that broaden human-AI communication. We believe the future worth building is human, and we're hiring people who want to build it.\nAbout the Role\nWe’re looking for a detection and response engineer to build how we find, investigate, and stop threats against our company, platforms, models, and data. You’ll own the pipelines that turn raw telemetry into high-fidelity detections, lead the response when real incidents happen, and run a threat intelligence practice that keeps our defenses focused on the adversaries who actually target frontier AI labs. You’ll partner closely with security, infrastructure, research, and product teams so that detection and response scale with the company instead of slowing it down.\nWhat You’ll Do\nLead incident response end-to-end: triage, scoping, containment, eradication, recovery, and blameless postmortems that turn lessons into new detections and controls.\n\nDesign, build, and operate the security data pipelines and tooling that power detection and response: collecting, normalizing, enriching, and storing telemetry from cloud, Kubernetes, identity, endpoint, SaaS, and application sources.\n\nAuthor, deploy, and maintain high-fidelity detections across SIEM, endpoint, cloud, and security tooling\n\nBuild and run our threat intelligence practice: track actors and campaigns relevant to AI labs such as espionage, model weight theft, supply chain compromise, and credential abuse. Turn that intel into hunts, detections, and hardening recommendations.\n\nProactively hunt for threats across our environment, and build automation and response tooling: enrichment, playbooks, automated containment that shortens time to detect and respond.\n\nCollaborate with researchers and product teams to detect AI-specific threats in production.Develop and exercise incident response plans, on-call processes, and tabletop exercises with engineering, research, legal, and leadership.\n\nParticipate in an on-call pager rotation for security incidents.\n\nSkills and Qualifications\nMinimum qualifications\nBachelor’s degree or equivalent experience in computer science, engineering, or similar.\n\nProficiency in Python or Rust for building data pipelines, detections, and internal tools.\n\nA track record responding to real security incidents in production environments, including leading investigations and coordinating across teams under pressure.\n\nHands-on experience building and operating security data pipelines at scale: log ingestion, parsing and normalization, enrichment, and storage and query in a SIEM or data lake (e.g., Splunk, Elastic, Panther, BigQuery, Snowflake, or ClickHouse).\n\nExperience producing and consuming threat intelligence: tracking adversary TTPs, mapping them to frameworks like MITRE ATT&CK, and translating intel into detections and hunts.\n\nStrong understanding of cloud, AWS, GCP, or Azure, Kubernetes, and identity provider telemetry, and how attackers move through these environments.\n\nFamiliarity with host and network forensics, including endpoint telemetry, memory and disk analysis, and network logs.\n\nComfort operating across the stack and owning projects end-to-end.\n\nClear communication: incident reports, intel briefs, and postmortems for both technical and non-technical audiences.\n\nPreferred qualifications\nDetection and response experience at an AI lab, cloud provider, or other high-threat environment targeted by sophisticated actors.\n\nExperience detecting AI-specific abuse, such as prompt injection, model extraction, or anomalous API usage.\n\nFamiliarity with ML infrastructure telemetry: GPU clusters, training jobs, and model artifact storage.\n\nExperience with stream processing (e.g., Kafka, Flink, Vector) and cost-aware log management at high volume.\n\nMalware analysis or reverse engineering experience.\n\nTalks, blogs, open-source detection content, or published threat research.\n\nLogistics\nLocation: This role is based in San Francisco, California.\n\nCompensation: Depending on background, skills and experience, the expected annual salary range for this position is $300,000 - $350,000 USD.\n\nVisa sponsorship: We sponsor visas. While we can't guarantee success for every candidate or role, if you're the right fit, we're committed to working through the visa process together.\n\nBenefits: Thinking Machines offers generous health, dental, and vision benefits, unlimited PTO, paid parental leave, and relocation support as needed.","description_format":"text","description_chars":4637,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Parental leave","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":true,"industries":["Multimodal AI","Foundation Models","AI Research Labs","AI Development Tools"],"lifecycle":[{"event":"open","at":"2026-10-27T21:48:40Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 30","filings_12m":30,"filings_prev_12m":8,"green_card_filings_12m":0,"median_offered_wage_usd":192500,"route":null,"cap_exempt":false,"checked_at":"2026-10-29T16:27:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":2}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":5,"expected_fill_days":29,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-11-02T06:13:15Z"},"pay":{"stated_usd_annual":350000,"is_top_pay":true},"html_url":"https://alion.io/job/thinking-machines-lab-security-engineer-detection-response","json_url":"https://alion.io/job/thinking-machines-lab-security-engineer-detection-response.json","meta":{"generated_at":"2026-11-02T23:35:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":33087,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":14382},"rest":"https://alion.io/mcp/rest/get_company?id=14382"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fthinking-machines-lab-security-engineer-detection-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fthinking-machines-lab-security-engineer-detection-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fthinking-machines-lab-security-engineer-detection-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/thinking-machines-lab-security-engineer-detection-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fthinking-machines-lab-security-engineer-detection-response"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3362397}},{"tool":"search_jobs","arguments":{"company":"thinkingmachines.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3362397},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}