Software Engineer, Security
Embeds security into product development by partnering with teams on threat modeling, implementing controls like auth and input validation, building automation tools, and mitigating AI-specific risks in a collaborative environment.
About the job
What You’ll Do
- Partner with product and research teams to embed security into the development lifecycle: threat modeling, design reviews, and secure defaults for new features.
- Design and implement security controls across our product stack (authentication, authorization, session management, input validation, etc.).
- Build and maintain security tooling and automation for engineers: secure frameworks and templates, CI/CD checks, dependency management, and vulnerability detection.
- Collaborate with researchers to identify and mitigate AI-specific product risks, such as model abuse, prompt injection, data leakage, or misuse of capabilities.
- Improve observability and detection for security-relevant events: access anomalies, abuse patterns, and suspicious behavior in production.
Skills and Qualifications
Minimum qualifications:
- Bachelor’s degree or equivalent experience in computer science, engineering, or similar.
- Proficiency in at least one backend language (we use Python or Rust).
- Strong generalist software engineering background and ability to review production code for security risks.
- Hands-on experience securing web apps and APIs especially auth flows, access control, secrets management, input validation, and data protection.
- Familiarity with common vulnerability classes and prevention frameworks; experience hardening prototypes into production.
- Comfort with modern cloud infrastructure and understanding how application concerns intersect with infrastructure.
- Comfort operating across the stack and owning projects end-to-end.
- Thrive in a highly collaborative environment involving many, different cross-functional partners and subject matter experts.
- A bias for action with a mindset to take initiative to work across different stacks and different teams where you spot the opportunity to make sure something ships.
Preferred qualifications:
- Experience securing AI‑powered products or working with ML/LLM APIs and their unique threat models.
- Background in human-computer interaction, especially where security or trust plays a central role in the user experience.
- Strong skills in rapid prototyping and iteration, with a habit of turning ad-hoc fixes into reusable patterns and tools.
- Open‑source security work, bug bounty write‑ups, or published tooling.
Logistics
Compensation: Depending on background, skills and experience, the expected annual salary range for this position is $350,000 - $475,000 USD.
Benefits: Thinking Machines offers generous health, dental, and vision benefits, unlimited PTO, paid parental leave, and relocation support as needed.
Skills
Python, Rust, Security, Threat Modeling, Authentication, Authorization, Secrets Management, Input Validation, CI/CD, Cloud Infrastructure, Vulnerability Detection, Prompt Injection, Access Control
Similar jobs
Security Engineering jobs
Greptile
San Francisco, CA
Build Greptile’s security product, including code scanning, vulnerability detection and reproduction, security-focused pull-request workflows, and agent infrastructure. The role requires a computer science degree, software or DevOps experience, JavaScript/TypeScript expertise, and hands-on security experience.
Flexport
San Francisco, CA
Build and operate corporate security controls across identity, endpoints, SaaS applications, and automation. The role requires 2–5 years of security engineering experience, hands-on endpoint and EDR expertise, identity protocol knowledge, and scripting ability.
Sentry
San Francisco, CASecurity engineer responsible for detection engineering, investigations, incident response, identity and access management, and preventative security controls across corporate and production environments. Requires 2+ years of security engineering experience, programming ability, and familiarity with cloud and defensive security tooling.
Sentry
San Francisco, CASecurity Engineer focused on application and platform security, security reviews, threat modeling, vulnerability management, and secure development practices. The role requires at least two years of relevant experience, programming ability, and familiarity with cloud security technologies.
Harvey
San Francisco, CA
Build and operate foundational security services spanning identity, access, secrets, privileged access, and secure AI-agent infrastructure. The role requires at least two years of production software engineering experience, cloud expertise, and experience translating security requirements into reliable automated systems.