Job description

OVERVIEW Inferact's mission is to grow vLLM as the world's AI inference engine and accelerate AI progress by making inference cheaper and faster. Founded by the creators and core maintainers of vLLM, we sit at the intersection of models and hardware, a position that took years to build. ABOUT THE ROLE We're looking for a Member of Technical Staff, Vulnerability Management to own Inferact's side of vLLM's vulnerability-management process and help keep a critical piece of AI infrastructure secure and production-grade. You'll develop a deep understanding of vLLM's architecture, independently investigate vulnerability reports, and turn technical findings into clear, actionable work for the core team. Working primarily in open source, you'll collaborate with vLLM maintainers, Red Hat counterparts, security firms, and researchers working with frontier AI models. You'll drive reports from initial triage through analysis and resolution, helping coordinate fixes, security advisories, and releases under the project's established process. You'll also identify practical security best practices that strengthen vLLM as it evolves. This is a hands-on product security role that combines technical investigation, sound judgment, and ownership of follow-through. vLLM's vulnerability-management process docs.vllm.ai SKILLS AND QUALIFICATIONS Minimum qualifications: - Hands-on product security experience, with a strong orientation toward infrastructure software and the security of complex software systems. - Ability to read source code, debug unfamiliar systems, reproduce reported issues, and explain root cause and practical security impact rather than simply forward findings. - Strong systems reasoning, including the ability to understand architecture, trust boundaries, deployment assumptions, and how different software components interact. - Ability to learn vLLM's core architecture and independently manage vulnerability investigations while bringing in maintainers where their expertise is needed. - Sound prioritization and risk-assessment judgment, with clear documentation of evidence, affected behavior, remediation needs, and next steps. - Strong written and verbal communication, discretion with sensitive reports, and the ability to work constructively with engineers, researchers, and external security collaborators. Preferred qualifications: - Experience with vulnerability management and security best practices for open-source infrastructure software. - Experience coordinating vulnerability resolution across reporters, maintainers, security teams, and software releases. - Familiarity with vLLM, inference engines, ML infrastructure, or similarly complex distributed software; prior vLLM contributions are helpful but not required. - Experience preparing security advisories, assessing affected versions, and working with CVE and coordinated-disclosure workflows. - Experience translating security findings into practical architecture reviews, regression tests, secure development practices, or deployment guidance. Bonus points if you have: - Helped resolve vulnerabilities in an open-source infrastructure project and can explain your technical contribution and coordination with maintainers. - Built security tooling or automation that improved investigation quality or reduced repetitive triage work. - Turned recurring vulnerability patterns into maintainable fixes, tests, or documentation that helped prevent similar issues. LOGISTICS - Location: This role is based in San Francisco, California. Will consider remote in the US for exceptional candidates. - Compensation: Depending on background, skills, and experience, the expected annual salary range for this position is $200,000 - $400,000 USD + equity. - Visa sponsorship: We sponsor visas on a case-by-case basis. - Benefits: Applicable benefits will be confirmed based on the final role location.

Requirements

Must-haves

Hands-on product security experience, with a strong orientation toward infrastructure software and the security of complex software systems.
Ability to read source code, debug unfamiliar systems, reproduce reported issues, and explain root cause and practical security impact rather than simply forward findings.
Strong systems reasoning, including the ability to understand architecture, trust boundaries, deployment assumptions, and how different software components interact.
Ability to learn vLLM's core architecture and independently manage vulnerability investigations while bringing in maintainers where their expertise is needed.
Sound prioritization and risk-assessment judgment, with clear documentation of evidence, affected behavior, remediation needs, and next steps.
Strong written and verbal communication, discretion with sensitive reports, and the ability to work constructively with engineers, researchers, and external security collaborators.
Familiarity with vLLM, inference engines, ML infrastructure, or similarly complex distributed software; prior vLLM contributions are helpful but not required.
Helped resolve vulnerabilities in an open-source infrastructure project and can explain your technical contribution and coordination with maintainers.
Built security tooling or automation that improved investigation quality or reduced repetitive triage work.
Turned recurring vulnerability patterns into maintainable fixes, tests, or documentation that helped prevent similar issues.
Location: This role is based in San Francisco, California. Will consider remote in the US for exceptional candidates.
Visa sponsorship: We sponsor visas on a case-by-case basis.
Benefits: Applicable benefits will be confirmed based on the final role location.

Nice-to-haves

Experience with vulnerability management and security best practices for open-source infrastructure software.
Experience coordinating vulnerability resolution across reporters, maintainers, security teams, and software releases.
Experience preparing security advisories, assessing affected versions, and working with CVE and coordinated-disclosure workflows.
Experience translating security findings into practical architecture reviews, regression tests, secure development practices, or deployment guidance.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aiml

Platform: ashby
Effort: quick