fal is seeking a Staff Security Engineer to set the technical direction for security across fal.ai. This role will define and drive security architecture while building practical controls spanning GPU compute, multi-cloud and Kubernetes environments, inference APIs, and AI systems, with strong day-to-day AI fluency.
Role Overview
You will own the security architecture and roadmap for fal’s highest-risk areas. The work includes designing secure isolation for multi-tenant workloads, protecting model weights and customer data, hardening critical infrastructure and delivery pipelines, and establishing repeatable security patterns that engineering teams can adopt without waiting on security reviews.
Key Responsibilities
- Design isolation for multi-tenant GPU workloads, customer code, and model execution
- Protect model weights, customer data, and inference endpoints using identity, encryption, and access controls
- Harden cloud, Kubernetes, CI/CD, and the software supply chain
- Threat model inference and agentic workflows, including risks such as prompt injection, data leakage, and model supply chain threats
- Build AI and agent guardrails, including scoped permissions, sandboxing, and audit logging
- Use LLMs and agents to automate security reviews, vulnerability triage, and remediation
- Own security architecture and roadmap coverage for top-risk areas
- Lead design reviews and publish secure patterns for broader adoption
- Run vulnerability management from discovery through prioritization and fixes
- Mentor engineers and raise the security bar across the company
Required Qualifications
- AI fluency, using LLMs, agents, and AI coding tools daily to build, review, and automate security work
- 8+ years of engineering experience, including 5+ years in hands-on security engineering
- Deep knowledge of cloud security (AWS/GCP), Kubernetes, Linux, and identity and access systems
- Strong ability in Python or Rust, with experience writing and shipping production code
- Demonstrated record of security improvements that engineering teams adopted
- Ability to explain security risk in business terms to engineers and executives
- Experience securing GPU infrastructure, ML platforms, or multi-tenant compute
- Experience with securing LLM-based systems or agent frameworks, or AI red teaming
- Experience with sandboxing and isolation technologies such as gVisor, Firecracker, or Kata
- Experience supporting SOC 2 or ISO 27001 audits
Technologies
AWS, GCP, Kubernetes, Linux, Python, Rust, LLMs, agents, CI/CD, gVisor, Firecracker, Kata, SOC 2, ISO 27001
Compensation and Equity
Salary: USD 180,000 - 250,000 per year
Equity: Offers Equity
Total package: $180,000 - $250,000 + equity + comprehensive benefits package
Benefits
- Offers Equity
- Health, dental, and vision insurance (US)
- Regular team events and offsites
- Visa sponsorship and relocation support to San Francisco
Location and Employment
- Location: San Francisco, CA (onsite)
- Employment type: Full time
- Department: Engineering
