Member of Technical Staff, Vulnerability Management

The role

You will own the vulnerability management process for vLLM. You will investigate vulnerability reports, analyze technical findings, and coordinate fixes and security advisories.

What you will do

• Own Inferact's side of vLLM's vulnerability-management process.
• Investigate vulnerability reports independently.
• Turn technical findings into actionable work for the core team.
• Collaborate with vLLM maintainers, Red Hat counterparts, security firms, and researchers.
• Drive reports from initial triage through analysis and resolution.
• Coordinate fixes, security advisories, and releases.
• Identify practical security best practices to strengthen vLLM.
• Document evidence, affected behavior, remediation needs, and next steps.

Required qualifications

• Hands-on product security experience with a strong orientation toward infrastructure software and the security of complex software systems.
• Ability to read source code, debug unfamiliar systems, reproduce reported issues, and explain root cause and practical security impact.
• Strong systems reasoning, including the ability to understand architecture, trust boundaries, deployment assumptions, and software component interactions.
• Ability to learn vLLM's core architecture and independently manage vulnerability investigations.
• Sound prioritization and risk-assessment judgment.
• Strong written and verbal communication.
• Discretion with sensitive reports.
• Ability to work constructively with engineers, researchers, and external security collaborators.

Nice to have

• Experience with vulnerability management and security best practices for open-source infrastructure software.
• Experience coordinating vulnerability resolution across reporters, maintainers, security teams, and software releases.
• Familiarity with vLLM, inference engines, ML infrastructure, or similarly complex distributed software.
• Prior vLLM contributions.
• Experience preparing security advisories, assessing affected versions, and working with CVE and coordinated-disclosure workflows.
• Experience translating security findings into practical architecture reviews, regression tests, secure development practices, or deployment guidance.
• Helped resolve vulnerabilities in an open-source infrastructure project.
• Built security tooling or automation that improved investigation quality or reduced repetitive triage work.
• Turned recurring vulnerability patterns into maintainable fixes, tests, or documentation.

Benefits

• Applicable benefits will be confirmed based on the final role location.

Before you apply

• We sponsor visas on a case-by-case basis.

About the company

Inferact's mission is to grow vLLM as the world's AI inference engine and accelerate AI progress. Founded by the creators and core maintainers of vLLM, the company sits at the intersection of models and hardware.