MTS, Technology & Security Engineering
Reflection · New York, NY · 1 mo ago
On-siteEngineeringFull-time
We need to output HTML fragment with sections: About the role? The posting includes "Our Mission Reflection..." then "Role Overview". We need headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include only sections with real content. No Pay or Schedule if not present. Benefits present. Responsibilities present (What You'll Do). Requirements/Qualifications/Skills: there is "What We're Looking For" with subsections: Experience & Background, Skills & Capabilities, Mindset & Approach. We need to map to appropriate headings: Requirements, Qualifications, Skills. Could combine. We must not repeat job title. No metadata like Job ID. Remove boilerplate: Export Control Notice maybe keep? It's not boilerplate? It's a notice but could be considered legal; but it's specific to role. Might keep as a paragraph under maybe Benefits? But it's not benefit. Might keep as a paragraph under maybe "Additional Information". But we only allowed headings list; we could put it as a for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It suggests we can use those headings; but we could also have other headings? It says use those for section headings; likely we should stick to those. So we need to fit content into those categories.
We have:
- About the role: could be the mission and role overview paragraph.
- Responsibilities: "What You'll Do" bullet points.
- Requirements: maybe "Experience & Background" (7+ years etc.)
- Qualifications: maybe "Experience leading vendor risk..." etc. But could combine.
- Skills: "Skills & Capabilities" and "Mindset & Approach".
- Benefits: "What We Offer" bullet list.
- Pay: not present (no salary specifics). So omit.
- Schedule: not present (no schedule). Omit.
We must not include filler like "commensurate with experience". Not present.
We need to preserve all substantive info. So we need to convert bullet lists into
under maybe "About the role" or separate section not in list? The instruction: "Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It suggests we can use those headings; but we could also have other headings? It says use those for section headings; likely we should stick to those. So we need to fit content into those categories.
We have:
- About the role: could be the mission and role overview paragraph.
- Responsibilities: "What You'll Do" bullet points.
- Requirements: maybe "Experience & Background" (7+ years etc.)
- Qualifications: maybe "Experience leading vendor risk..." etc. But could combine.
- Skills: "Skills & Capabilities" and "Mindset & Approach".
- Benefits: "What We Offer" bullet list.
- Pay: not present (no salary specifics). So omit.
- Schedule: not present (no schedule). Omit.
We must not include filler like "commensurate with experience". Not present.
We need to preserve all substantive info. So we need to convert bullet lists into - . Also paragraphs.
We need to remove duplicated lines. Ensure no repetition.
Let's extract content.
Mission paragraph: "Our Mission Reflection is a research lab making intelligence open and accessible for everyone to use, customize, and build on. We build open models that let anyone control their intelligence and help shape the future of AI. Our mission: make intelligence open and accessible to all."
Role Overview paragraph: "As a MTS for Technology & Security Engineering is responsible for architecting and operating the security engineering foundation that protects the organization’s corporate environment, multi-cloud research infrastructure, and multi-million-dollar GPU training capacity. This leader owns the full technical security stack — from end-user compute and zero-trust access to cloud and container security, detection engineering, and security-as-code — ensuring the organization can move at research speed without sacrificing rigor. Sitting at the intersection of security engineering, infrastructure, and research operations, this role is uniquely positioned to define how a frontier AI company protects its most sensitive assets — model weights, training data, and GPU capacity — while preserving the low-friction environment researchers and engineers need to do their best work. The ideal candidate brings deep, hands-on technical depth alongside the executive presence to lead a security engineering function, represent the organization’s security posture to auditors and enterprise customers, and negotiate vendor and contractual risk. This is a high-visibility, high-impact role that operates across engineering, infrastructure, legal, and physical security. Success requires the ability to design guardrails rather than gates, build systems that assume compromise, and operate credibly as both an executive leader and a hands-on builder."
We can combine mission and role overview into About the role.
Now Responsibilities: list under "What You'll Do". Items:
- High-Performance End User Compute (EUC) Design and manage a highly resilient corporate device fleet spanning Linux, macOS, Windows and specialized hardware such as NVIDIA GPU workstations.
- Shift the fleet away from restrictive MDM policies toward intelligent posture verification and cryptographic device binding, reducing friction without reducing assurance.
- Secure diverse local toolchains and developer environments without breaking the workflows researchers and engineers depend on.
- Securing the Research & Training Boundary
- Architect cloud-native security controls across multi-cloud environments that contain multi-million-dollar GPU clusters.
- Establish IAM governance, network segmentation, and isolation boundaries appropriate to the scale and sensitivity of training infrastructure and model assets.
- Partner with infrastructure and research teams to ensure security controls scale with GPU capacity rather than constrain it.
- Phishing-Resistant Zero-Trust Access
- Implement continuous, context-aware authorization using modern mesh networks and proxies (e.g., Tailscale, Cloudflare One).
- Enforce hardware-backed authentication (WebAuthn/FIDO2 keys) across every corporate and production plane.
- Eliminate standing and persistent access in favor of just-in-time, verifiable authorization.
- Security as Code (SaC)
- Ensure 100% of infrastructure, endpoint configurations, IAM policies, and cloud environments are declared in code (Terraform/Pulumi).
- Eliminate configuration drift through automated CI/CD validation and continuous compliance checks.
- Build repeatable, auditable deployment pipelines that make security posture provable rather than assumed.
- Behavioral Detection Engineering
- Build telemetry pipelines that ingest high-fidelity logs into a cloud-native data lake to support detection at scale.
- Detect sophisticated post-exploitation techniques, lateral movement, and living-off-the-land attacks across corporate and production environments.
- Continuously tune detection coverage against an assumed-breach threat model, prioritizing time-to-detect and blast-radius containment.
- Compliance, Audit & Vendor Risk
- Support SOC 2, ISO 27001, FedRAMP, ISO 22237, ISO 22301, NIST CSF, customer audits, and enterprise security reviews.
- Lead vendor risk assessments, procurement security reviews, and security-related legal contract negotiations.
- Own front-line defenses for a frontier AI company, including physical security and data center security operations.
We need to keep as bullet list; sub-bullets maybe just flatten? Could keep nested ul but spec says use
- for any list. Could have nested lists. We'll keep top-level li with sub-ul.
Now Requirements: "Experience & Background" bullet points:
- 7+ years of deep engineering experience at high-valuation companies, or in defense-grade environments.
- Battle-tested technical leadership with a track record of building and operating security engineering functions at scale.
- Experience supporting SOC 2, ISO 27001, FedRAMP, ISO 22237, ISO 22301, NIST CSF, customer audits, and enterprise security reviews.
- Experience leading vendor risk, procurement security reviews, and legal contract negotiations.
- Experience with front-line defenses for an AI company, including physical security and data center security operations.
Qualifications: maybe none separate; but we could treat "Skills & Capabilities" as Skills, and "Mindset & Approach" as Qualifications? Or Qualifications could be combination of experience and skills. But we need to avoid empty sections. We'll assign:
- Requirements: Experience & Background.
- Qualifications: maybe "Experience leading vendor risk..." etc? But that's already in Requirements. Could shift some to Qualifications: maybe "Experience supporting SOC 2..." etc. But we need to avoid duplication. Better: Requirements = Experience & Background. Qualifications = maybe none; but we must not create empty heading. So we could omit Qualifications if no distinct content. However we have Skills & Capabilities and Mindset & Approach; we can map Skills to Skills section, and Mindset & Approach to Qualifications? Qualifications often about qualifications like certifications, degrees. But we can treat Mindset & Approach as Qualifications (though it's more mindset). But we need to follow instruction: use those headings only when posting has real specific content. It does have Mindset & Approach content, so we can use Qualifications heading for that. Skills heading for Skills & Capabilities.
Thus:
- Requirements: Experience & Background.
- Qualifications: Mindset & Approach.
- Skills: Skills & Capabilities.
Now Benefits: "What We Offer" bullet list:
- Top-tier compensation: Salary and equity structured to recognize and retain our talent globally.
- Stock options: Everyone who joins and contributes to Reflection's success gets to share in the upside through stock options.
- Health & wellness: Comprehensive medical, dental, vision, and life, with an annual wellness allowance.
- Meals: Lunch and dinner are provided in the office daily.
- Life & family: 22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys.
- Vacation days: Unlimited paid time off in the U.S. and 30 days in the U.K.
- Sponsorship support: We sponsor visas to help exceptional talent join our team and support long-term immigration pathways where applicable.
- Team building: We have regular off-sites, happy hours, and team celebrations.
Also Export Control Notice: maybe include as a paragraph under Benefits? It's not a benefit but a notice. Could be placed after Benefits as a paragraph without heading? Might be considered boilerplate? It's specific legal notice. I'd include as a
after Benefits, maybe under a heading "Additional Information"? But not allowed. Could incorporate into Benefits as a note? Might be okay to add a
after Benefits list without heading. The instruction: Output ONLY the HTML fragment. It didn't forbid extra paragraphs outside headings. It said use
for section headings (e.g...). It didn't say you cannot have other paragraphs. So we can add a
for Export Control Notice after Benefits.
Now we need to ensure we don't repeat job title. Not used.
Now produce HTML.
Structure:
About the role
...mission and role overview combined...
Responsibilities
- High-Performance End User Compute (EUC) Design and manage a highly resilient corporate device fleet spanning Linux, macOS, Windows and specialized hardware such as NVIDIA GPU workstations.
- Shift the fleet away from restrictive MDM policies toward intelligent posture verification and cryptographic device binding, reducing friction without reducing assurance.
- Secure diverse local toolchains and developer environments without breaking the workflows researchers and engineers depend on.
- Securing the Research & Training Boundary
- Architect cloud-native security controls across multi-cloud environments that contain multi-million-dollar GPU clusters.
- Establish IAM governance, network segmentation, and isolation boundaries appropriate to the scale and sensitivity of training infrastructure and model assets.
- Partner with infrastructure and research teams to ensure security controls scale with GPU capacity rather than constrain it.
- Phishing-Resistant Zero-Trust Access
- Implement continuous, context-aware authorization using modern mesh networks and proxies (e.g., Tailscale, Cloudflare One).
- Enforce hardware-backed authentication (WebAuthn/FIDO2 keys) across every corporate and production plane.
- Eliminate standing and persistent access in favor of just-in-time, verifiable authorization.
- Security as Code (SaC)
- Ensure 100% of infrastructure, endpoint configurations, IAM policies, and cloud environments are declared in code (Terraform/Pulumi).
- Eliminate configuration drift through automated CI/CD validation and continuous compliance checks.
- Build repeatable, auditable deployment pipelines that make security posture provable rather than assumed.
- Behavioral Detection Engineering
- Build telemetry pipelines that ingest high-fidelity logs into a cloud-native data lake to support detection at scale.
- Detect sophisticated post-exploitation techniques, lateral movement
- for any list. Could have nested lists. We'll keep top-level li with sub-ul.
Now Requirements: "Experience & Background" bullet points:
- 7+ years of deep engineering experience at high-valuation companies, or in defense-grade environments.
- Battle-tested technical leadership with a track record of building and operating security engineering functions at scale.
- Experience supporting SOC 2, ISO 27001, FedRAMP, ISO 22237, ISO 22301, NIST CSF, customer audits, and enterprise security reviews.
- Experience leading vendor risk, procurement security reviews, and legal contract negotiations.
- Experience with front-line defenses for an AI company, including physical security and data center security operations.
Qualifications: maybe none separate; but we could treat "Skills & Capabilities" as Skills, and "Mindset & Approach" as Qualifications? Or Qualifications could be combination of experience and skills. But we need to avoid empty sections. We'll assign:
- Requirements: Experience & Background.
- Qualifications: maybe "Experience leading vendor risk..." etc? But that's already in Requirements. Could shift some to Qualifications: maybe "Experience supporting SOC 2..." etc. But we need to avoid duplication. Better: Requirements = Experience & Background. Qualifications = maybe none; but we must not create empty heading. So we could omit Qualifications if no distinct content. However we have Skills & Capabilities and Mindset & Approach; we can map Skills to Skills section, and Mindset & Approach to Qualifications? Qualifications often about qualifications like certifications, degrees. But we can treat Mindset & Approach as Qualifications (though it's more mindset). But we need to follow instruction: use those headings only when posting has real specific content. It does have Mindset & Approach content, so we can use Qualifications heading for that. Skills heading for Skills & Capabilities.
Thus:
- Requirements: Experience & Background.
- Qualifications: Mindset & Approach.
- Skills: Skills & Capabilities.
Now Benefits: "What We Offer" bullet list:
- Top-tier compensation: Salary and equity structured to recognize and retain our talent globally.
- Stock options: Everyone who joins and contributes to Reflection's success gets to share in the upside through stock options.
- Health & wellness: Comprehensive medical, dental, vision, and life, with an annual wellness allowance.
- Meals: Lunch and dinner are provided in the office daily.
- Life & family: 22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys.
- Vacation days: Unlimited paid time off in the U.S. and 30 days in the U.K.
- Sponsorship support: We sponsor visas to help exceptional talent join our team and support long-term immigration pathways where applicable.
- Team building: We have regular off-sites, happy hours, and team celebrations.
Also Export Control Notice: maybe include as a paragraph under Benefits? It's not a benefit but a notice. Could be placed after Benefits as a paragraph without heading? Might be considered boilerplate? It's specific legal notice. I'd include as a
after Benefits, maybe under a heading "Additional Information"? But not allowed. Could incorporate into Benefits as a note? Might be okay to add a
after Benefits list without heading. The instruction: Output ONLY the HTML fragment. It didn't forbid extra paragraphs outside headings. It said use
for section headings (e.g...). It didn't say you cannot have other paragraphs. So we can add a
for Export Control Notice after Benefits. Now we need to ensure we don't repeat job title. Not used. Now produce HTML. Structure:
About the role
...mission and role overview combined...
Responsibilities
- High-Performance End User Compute (EUC) Design and manage a highly resilient corporate device fleet spanning Linux, macOS, Windows and specialized hardware such as NVIDIA GPU workstations.
- Shift the fleet away from restrictive MDM policies toward intelligent posture verification and cryptographic device binding, reducing friction without reducing assurance.
- Secure diverse local toolchains and developer environments without breaking the workflows researchers and engineers depend on.
- Securing the Research & Training Boundary
- Architect cloud-native security controls across multi-cloud environments that contain multi-million-dollar GPU clusters.
- Establish IAM governance, network segmentation, and isolation boundaries appropriate to the scale and sensitivity of training infrastructure and model assets.
- Partner with infrastructure and research teams to ensure security controls scale with GPU capacity rather than constrain it.
- Phishing-Resistant Zero-Trust Access
- Implement continuous, context-aware authorization using modern mesh networks and proxies (e.g., Tailscale, Cloudflare One).
- Enforce hardware-backed authentication (WebAuthn/FIDO2 keys) across every corporate and production plane.
- Eliminate standing and persistent access in favor of just-in-time, verifiable authorization.
- Security as Code (SaC)
- Ensure 100% of infrastructure, endpoint configurations, IAM policies, and cloud environments are declared in code (Terraform/Pulumi).
- Eliminate configuration drift through automated CI/CD validation and continuous compliance checks.
- Build repeatable, auditable deployment pipelines that make security posture provable rather than assumed.
- Behavioral Detection Engineering
- Build telemetry pipelines that ingest high-fidelity logs into a cloud-native data lake to support detection at scale.
- Detect sophisticated post-exploitation techniques, lateral movement