See how candidates think and approach the work this role demands, before the phone screen. We'll build a video challenge from this posting, and you can edit or share it before it goes live.
A generative media platform that runs multi-tenant GPU inference for outside customers is treating model weights, customer code, and inference endpoints as high-value assets that need security architecture of their own, a sign that its business is shifting from a developer tool toward a hosted infrastructure layer that enterprises must trust with proprietary models and data.
fal is the generative media ecosystem powering the next generation of AI products. We build the infrastructure, tools, and model access that teams need to move from idea to production, and do it at scale without compromise. For developers and enterprises, fal is the foundation that makes generative media not just possible, but practical: a unified platform where high-performance inference, orchestration, and observability come together to unlock new categories of AI-native products.
As generative media reshapes industries across a market projected to grow by hundreds of billions over the next decade, fal is becoming the ecosystem that ambitious teams build on.
We’re hiring a Staff Security Engineer to set the technical direction for security across fal.ai. You’ll work across our GPU compute fleet, multi-cloud and Kubernetes environments, inference APIs, and the AI systems our teams build and use. You’ll design the security architecture, build the controls yourself, and make secure-by-default the easiest path for every engineer. Proficiency in building with and using AI is central to this role.
Secure the Platform
Design isolation for multi-tenant GPU workloads, customer code, and model execution
Protect model weights, customer data, and inference endpoints with strong identity, encryption, and access controls
Harden cloud, Kubernetes, CI/CD, and the software supply chain
Secure AI Systems
Threat model inference, agentic workflows, and internal AI tools, including prompt injection, data leakage, and model supply chain risks
Build guardrails for agents and AI tools, such as scoped permissions, sandboxing, and audit logging
Use LLMs and agents to automate security reviews, vulnerability triage, and remediation
Set the Technical Direction
Own the security architecture and the roadmap for our highest-risk areas
Run design reviews and publish secure patterns that teams can adopt without waiting on security
Run vulnerability management from discovery through prioritization and fix
Mentor engineers and raise the security bar across the company
AI fluency: you use LLMs, agents, and AI coding tools daily to build, review, and automate security work
8+ years of engineering experience, including 5+ in hands-on security engineering
Deep knowledge of cloud security (AWS/GCP), Kubernetes, Linux, and identity and access systems
Strong in Python or Rust; you write and ship production code
A record of security improvements that engineering teams adopted, led without formal authority
Explains security risk in business terms to engineers and executives alike
Experience with GPU infrastructure, ML platforms, or multi-tenant compute
Securing LLM-based systems or agent frameworks, or AI red teaming
Sandboxing and isolation technologies such as gVisor, Firecracker, or Kata
Experience supporting SOC 2 or ISO 27001 audits
Interesting and challenging work
A lot of learning and growth opportunities
We offer visa sponsorship and will help you relocate to San Francisco.
Health, dental, and vision insurance (US)
Regular team events and offsites
$180,000 - $250,000 + equity + comprehensive benefits package
U.S. EQUAL EMPLOYMENT OPPORTUNITY INFORMATION:
fal provides equal employment opportunities to applicants and employees without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, disability, or any other classification protected by applicable law.
fal:c3442fcd-8679-41a3-ad16-b1e1883d916cfal-aiThis posting hasn't been probed by our closure verifier yet. Stream C runs on a rolling schedule against postings approaching the close-decision threshold.
See how we measure for definitions, or our corrections log for known issues. Found something wrong? Flag a correction.