Security Engineer, Threat Intelligence
Fluidstack · New York, NY
About this role
**About Fluidstack** Fluidstack exists to make humanity more free. We’re building civilization-scale AI infrastructure—acquiring, designing, and operating data centers to deliver **10 to 100s of GW of compute faster** than anyone else. Speed and scale are our differentiators, and our security team helps ensure the frontier doesn’t “walk out the door.” --- **How We Operate** - **Be a barrel:** Full autonomy. Own things end to end. - **Insane urgency:** Move fast and push forward. - **Reason from first principles:** Challenge assumptions; the best idea wins. - **Love of the game:** High intensity, long hours, meaningful work. - **Build something that actually matters:** Spend your time on impact. --- **The Security Team** Key problems we’re working on: - **Secure the frontier of AI:** Protect the most valuable and targeted artifacts—model weights and training infrastructure. - **Build the security program from scratch:** Bare metal to boardroom, as we scale across continents. - **Threat surface measured in gigawatts:** Protect physical and logical security for customers building consequential technology. --- **Role Scope** - Track **nation-state and advanced criminal actors** targeting frontier AI infrastructure, turning their tooling and tradecraft into intelligence that improves detection and hunting. - Build and run pipelines to **collect, enrich, and correlate indicators**, then push them into detection and agentic triage so intelligence becomes operational immediately. - Lead **intelligence-led hunts** across enterprise, cloud, identity, data center IT, and OT telemetry; convert findings into **high-fidelity detections authored as code**. - Perform hands-on analysis of **malware, phishing infrastructure, and attacker tooling** to extract indicators, TTPs, and attribution signals in near real time. - Curate inbound intelligence from **commercial feeds, open source, government, and peer relationships**, prioritizing what matters to the threat model. - Build and maintain **external intelligence-sharing relationships** (ISACs, peer AI/cloud security teams, government partners). --- **What We’re Looking For** - You’ve tracked specific **nation-state or advanced criminal actors** and understand their tooling, infrastructure, and targeting well enough to anticipate next moves. - You write **production-quality Python (or similar)** and have built end-to-end automation and data pipelines. - You’ve done hands-on **malware, infrastructure, and log analysis** to develop and validate findings. - You’ve authored detection logic (e.g., **YARA, Sigma, or SIEM-native queries**) that shipped to production and held up against real adversary activity. - You’ve worked closely with detection engineers and incident responders to turn intelligence into **detections, hunting hypotheses, and incident context** while events are still live. - Your intelligence writing is actionable—distilling complex campaigns into decisions and next steps. **Bonus** - Active network in the threat intelligence community and a habit of sharing. - Experience defending **large-scale GPU/AI compute**, data centers, or multi-tenant cloud. - Applying **LLMs/agentic tooling** to accelerate collection, enrichment, and analysis. - Public research, conference talks, or open-source CTI contributions. --- **Salary & Benefits** - Competitive total compensation (salary + equity) - Retirement/pension plan (local norms) - Health, dental, and vision insurance - Generous PTO (local no
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.