Member of Technical Staff, Product Security

Overview Inferact's mission is to grow vLLM as the world's AI inference engine and accelerate AI progress by making inference cheaper and faster. Founded by the creators and core maintainers of vLLM, we sit at the intersection of models and hardware, a position that took years to build. About the Role We're looking for a Member of Technical Staff, Product Security with deep infrastructure security expertise to secure the Inferact platform as it moves from early deployments to production use by large enterprise customers. Customers trust Inferact with their models, prompts, and production traffic, often inside their own cloud accounts. You'll own the security architecture of the systems that serve them: the inference platform and its APIs, the control plane and the data plane, our bring-your-own-cloud (BYOC) deployments, the cloud and Kubernetes infrastructure underneath, and the way we build and ship software. This is a hands-on, senior technical role. You'll advise on the design of our BYOC product and the separation between our control plane and customers' data planes. You'll lead our SOC 2 and other compliance work, and be the technical voice in enterprise security and IT reviews, from security questionnaires to deep architecture sessions with customers' security teams. You'll also be the tech lead for vLLM vulnerability management, guiding the engineer who owns that program. You'll work closely with the inference, infrastructure, product, and forward-deployed engineering teams, set the direction for security at Inferact, and carry the work from design review to shipped fix. Skills and Qualifications Minimum qualifications: Deep, hands-on infrastructure security experience on production systems that customers depend on: cloud IAM, network segmentation, Kubernetes, secrets management, and infrastructure as code. Experience designing or reviewing multi-tenant and hybrid architectures, including control plane and data plane separation, deployments into customer-owned cloud accounts, authentication, authorization, and data isolation. Hands-on experience taking a company through SOC 2 or a similar framework (ISO 27001, HIPAA, FedRAMP), including building the technical controls, not only the paperwork. Experience leading enterprise security and IT reviews: you can speak credibly with a large customer's CISO and security architects, answer hard technical questions, and push back on requirements that add cost without adding real security. Strong software engineering ability: you read and write production code, review pull requests, and can ship a fix and the test that proves it. Experience as the technical lead for other security engineers: setting priorities, reviewing their work, and raising their bar. Sound risk judgment: you can separate a real, reachable risk from a theoretical one and choose controls that fit the stage of the company. Clear written and verbal communication with engineers, leadership, and customers' security teams, and discretion with sensitive information. Preferred qualifications: Experience building or securing a BYOC, managed-service, or customer-hosted product at a cloud infrastructure or data platform company. Experience securing AI / ML infrastructure, model serving, GPU workloads, or developer platforms. Experience running or leading a vulnerability management program, including open-source vulnerability disclosure and coordinated security releases. Experience securing software supply chains and CI/CD: dependency risk, build integrity, artifact signing, and container image hardening. Familiarity with security risks specific to inference systems, such as untrusted model loading, tenant isolation on shared hardware, and handling of prompts and outputs. Bonus points if you have: Credited CVEs, security fixes, or security tooling in widely used open-source infrastructure. Built a security and compliance function from the ground up at an early-stage infrastructure company. Offensive security or security research experience that you turned into lasting engineering fixes. Contributions to vLLM, PyTorch, or other inference and ML infrastructure projects. Logistics Location: This role is based in San Francisco, California. Will consider remote in the US for exceptional candidates. Compensation: Depending on background, skills, and experience, the expected annual salary range for this position is $200,000 - $400,000 USD + equity. Visa sponsorship: We sponsor visas on a case-by-case basis. Benefits: Inferact offers generous health, dental, and vision benefits as well as 401(k) company match. Inferact, Inc. is an E-Verify company, and you may review the Notice of E-Verify Participation and the Right to Work posters in English and Spanish .