Want to know if this job is worth applying to?
San Francisco, California, United States
Hybrid
Inferact's mission is to grow vLLM as the world's AI inference engine and accelerate AI progress by making inference cheaper and faster. Founded by the creators and core maintainers of vLLM, we sit at the intersection of models and hardware, a position that took years to build.
We're looking for a Member of Technical Staff, Product Security to secure the Inferact product as it moves from early deployments to production use by enterprise customers. Customers trust Inferact with their models, prompts, and production traffic. You'll own the security of the systems that serve them: the inference platform and its APIs, the control plane, the cloud and Kubernetes infrastructure underneath, and the way we build and ship software.
This is a hands-on engineering role. You'll threat-model new features with the engineers who build them, review and write code, find and fix vulnerabilities, and build secure defaults, tooling, and guardrails that let a small team move fast without adding risk. You'll work closely with the inference, infrastructure, product, and forward-deployed engineering teams, and with the engineer who owns vLLM vulnerability management when an upstream issue affects our product. You'll set the direction for product security at Inferact and carry the work from design review to shipped fix.
Minimum qualifications:
Hands-on product or application security experience on software that customers run or depend on, with a record of finding, fixing, and preventing real vulnerabilities, not only running scanners or tracking compliance.
Strong software engineering ability: you read and write production code, review pull requests, and can ship a fix and the test that proves it.
Experience threat-modeling and reviewing the design of distributed systems, APIs, and services, including authentication, authorization, multi-tenancy, data isolation, and secrets handling.
Working knowledge of cloud and container security: IAM, network boundaries, Kubernetes, and infrastructure as code.
Sound risk judgment: you can separate a real, reachable risk from a theoretical one and choose controls that fit the stage of the company.
Clear written and verbal communication with engineers, leadership, and customers' security teams, and discretion with sensitive information.
Preferred qualifications:
Experience securing AI / ML infrastructure, model serving, GPU workloads, or developer platforms.
Experience securing software supply chains and CI/CD: dependency risk, build integrity, artifact signing, and container image hardening.
Familiarity with security risks specific to inference systems, such as untrusted model loading, tenant isolation on shared hardware, and handling of prompts and outputs.
Experience building security tooling, paved roads, or secure-by-default libraries that engineers adopt.
Experience answering the technical part of enterprise customer security reviews and supporting customer deployments in their own cloud environments.
Bonus points if you have:
Credited CVEs, security fixes, or security tooling in widely used open-source infrastructure.
Built a product security function from the ground up at an early-stage company.
Offensive security or security research experience that you turned into lasting engineering fixes.
Contributions to vLLM, PyTorch, or other inference and ML infrastructure projects.
Location: This role is based in San Francisco, California. Will consider remote in the US for exceptional candidates.
Compensation: Depending on background, skills, and experience, the expected annual salary range for this position is $200,000 - $400,000 USD + equity.
Visa sponsorship: We sponsor visas on a case-by-case basis.
Benefits: Inferact offers generous health, dental, and vision benefits as well as 401(k) company match.
Inferact, Inc. is an E-Verify company, and you may review the Notice of E-Verify Participation and the Right to Work posters in English and Spanish.
