> Markdown version of [/jobs/ext/1309121-manager-of-technology-security-engineering](https://www.wearedevelopers.com/jobs/ext/1309121-manager-of-technology-security-engineering). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Manager of Technology & Security Engineering - **Company:** REFLECTION LLC - **Location:** San Francisco, CA, United States - **Contract:** Permanent contract - **Skills:** Training Data, Kubernetes Security, Microsoft Windows, Artificial Intelligence, Apple Mac Systems, Cloud Computing, Computer Clusters, Cyber Security, Continuous Integration, Linux, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Mesh Networking, Network Segmentation, Cloud Services, Phishing, Zero Trust Network Access, Pulumi, Graphics Processing Unit (GPU), Delivery Pipeline, Multi-Cloud, Kubernetes, Cloudflare, Build Tools, Terraform - **Published:** July 17, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=e6c98ab3f57816fc ## About the Role * 20+ years of deep engineering experience at high-valuation companies, or in defense-grade environments. * Battle-tested technical leadership with a track record of building and operating security engineering functions at scale. * Experience supporting SOC 2, ISO 27001, FedRAMP, ISO 22237, ISO 22301, NIST CSF, customer audits, and enterprise security reviews. * Experience leading vendor risk, procurement security reviews, and legal contract negotiations. * Experience with front-line defenses for an AI company, including physical security and data center security operations. Skills & Capabilities * Deep familiarity with Linux and macOS internals, including how to secure specialized hardware (NVIDIA GPUs) without breaking developer environments. * Expert-level knowledge of public cloud architectures, IAM governance at scale, and Kubernetes/container isolation primitives. * Technical understanding of cloud and infrastructure security, Kubernetes and container security, zero-trust architectures, security operations at scale, identity and access management, detection and response technologies, and security automation and orchestration. * Ability to operate as both an executive leader and a hands-on builder, moving fluidly between strategy and implementation. Mindset & Approach * A "guardrails, not gates" philosophy - understands that blocking a researcher from pulling a Python library or mounting a filesystem means security has failed, and builds accordingly using virtualization, sandboxing, and data isolation. * An adversarial mindset that designs systems under the assumption the endpoint will be compromised, focusing defenses on limiting blast radius, eliminating persistent access, and detecting post-compromise activity immediately. * Motivated by building - comfortable operating in ambiguous, fast-moving environments where security infrastructure is maturing alongside a rapidly scaling research organization. ## Description The Head of Technology & Security Engineering is responsible for architecting and operating the security engineering foundation that protects the organization's corporate environment, multi-cloud research infrastructure, and multi-million-dollar GPU training capacity. This leader owns the full technical security stack - from end-user compute and zero-trust access to cloud and container security, detection engineering, and security-as-code - ensuring the organization can move at research speed without sacrificing rigor. Sitting at the intersection of security engineering, infrastructure, and research operations, this role is uniquely positioned to define how a frontier AI company protects its most sensitive assets - model weights, training data, and GPU capacity - while preserving the low-friction environment researchers and engineers need to do their best work. The ideal candidate brings deep, hands-on technical depth alongside the executive presence to lead a security engineering function, represent the organization's security posture to auditors and enterprise customers, and negotiate vendor and contractual risk. This is a high-visibility, high-impact role that operates across engineering, infrastructure, legal, and physical security. Success requires the ability to design guardrails rather than gates, build systems that assume compromise, and operate credibly as both an executive leader and a hands-on builder., * Design and manage a highly resilient corporate device fleet spanning Linux, macOS, Windows and specialized hardware such as NVIDIA GPU workstations. * Shift the fleet away from restrictive MDM policies toward intelligent posture verification and cryptographic device binding, reducing friction without reducing assurance. * Secure diverse local toolchains and developer environments without breaking the workflows researchers and engineers depend on. Securing the Research & Training Boundary * Architect cloud-native security controls across multi-cloud environments that contain multi-million-dollar GPU clusters. * Establish IAM governance, network segmentation, and isolation boundaries appropriate to the scale and sensitivity of training infrastructure and model assets. * Partner with infrastructure and research teams to ensure security controls scale with GPU capacity rather than constrain it. Phishing-Resistant Zero-Trust Access * Implement continuous, context-aware authorization using modern mesh networks and proxies (e.g., Tailscale, Cloudflare One). * Enforce hardware-backed authentication (WebAuthn/FIDO2 keys) across every corporate and production plane. * Eliminate standing and persistent access in favor of just-in-time, verifiable authorization. Security as Code (SaC) * Ensure 100% of infrastructure, endpoint configurations, IAM policies, and cloud environments are declared in code (Terraform/Pulumi). * Eliminate configuration drift through automated CI/CD validation and continuous compliance checks. * Build repeatable, auditable deployment pipelines that make security posture provable rather than assumed. Behavioral Detection Engineering * Build telemetry pipelines that ingest high-fidelity logs into a cloud-native data lake to support detection at scale. * Detect sophisticated post-exploitation techniques, lateral movement, and living-off-the-land attacks across corporate and production environments. * Continuously tune detection coverage against an assumed-breach threat model, prioritizing time-to-detect and blast-radius containment. Compliance, Audit & Vendor Risk * Support SOC 2, ISO 27001, FedRAMP, ISO 22237, ISO 22301, NIST CSF, customer audits, and enterprise security reviews. * Lead vendor risk assessments, procurement security reviews, and security-related legal contract negotiations. * Own front-line defenses for a frontier AI company, including physical security and data center security operations. ## Related Videos - [Passkeys: Truly Phishing-Resistant? Implementation and Pitfalls](https://www.wearedevelopers.com/videos/100156-passkeys-truly-phishing-resistant-implementation-and-pitfalls) - [Why segmenting your infrastructure into tiers makes your infrastructure design better](https://www.wearedevelopers.com/videos/1960-why-segmenting-your-infrastructure-into-tiers-makes-your-infrastructure-design-better) - [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) - [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company) - [Skynet wants your Passwords! The Role of AI in Automating Social Engineering](https://www.wearedevelopers.com/videos/770-skynet-wants-your-passwords-the-role-of-ai-in-automating-social-engineering) ## Related Articles - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)