Reflection is an AI company building open model weights for businesses, labs, and governments.
OUR MISSION Reflection is a research lab making intelligence open and accessible for everyone to use, customize, and build on. We build open models that let anyone control their intelligence and help shape the future of AI. Our mission: make intelligence open and accessible to all. ROLE OVERVIEW Reflection.AI http://Reflection.AI is looking for a Member of Technical Staff - Security Software Engineer to build our Application Security function from the ground up while contributing to a broad array of projects across the entire Security Engineering organization. You will have a high level of autonomy to architect solutions and drive them through both technical and organizational adversity. This role is ideal for an engineer who thrives in high-ownership, low-structure environments and has a strong "0 to 1" mindset. KEY RESPONSIBILITIES - Contribute engineering cycles to a broad array of key projects across the Security organization ranging from our agentic AI incident detection & response SOC to long-running internal AI agents - Implement security controls around AI agents, including sandboxes, identity, and authorization systems - Define software supply chain security strategy, tooling, and infrastructure including SCA/SBOM analysis - Roll out controls to rapidly ingest and act on emerging supply chain attacks - Develop and maintain a comprehensive threat model of our software stack - Drive our pentesting program with prioritization guided by your threat model - Define and socialize foundation secure coding practices and architecture patterns relevant to AI/ML systems - Integrate SAST tools into CI/CD pipelines for continuous vulnerability analysis - Define and implement a comprehensive Secure Software Development Lifecycle REQUIRED QUALIFICATIONS - Strong proficiency with Python or Golang - Track record of architecting and building complex software systems - Familiarity with common application logic exploit vectors - Experience implementing and rolling out cross-functional projects that impact many teams - AI-native engineering workflow - Experience working with Kubernetes - Experience working with AWS and/or GCP - A strong interest in growing in multiple sub-specialties within security, including infrastructure security, incident detection & response, and digital forensics - Willingness to flex into cross-functional projects across multiple pillars of Security as needed - Experience building programs from 0 to 1 WHAT WE OFFER: We believe that to make intelligence open and accessible to all, you need to start at the foundation. Joining Reflection means building from the ground up as part of a talent-dense team. You will help define our future as a company, and help define the future of open foundational models. We want you to do the most impactful work of your career with the confidence that you and the people you care about most are supported. - Top-tier compensation: Salary and equity structured to recognize and retain our talent globally. - Stock options: Everyone who joins and contributes to Reflection's success gets to share in the upside through stock options. - Health & wellness: Comprehensive medical, dental, vision, and life, with an annual wellness allowance. - Meals: Lunch and dinner are provided in the office daily. - Life & family: 22 weeks paid parental leave for all new birthing and non-birthing parents, including adoptive and surrogate journeys. - Vacation days: Unlimited paid time off in the U.S. and 30 days in the U.K. - Sponsorship support: We sponsor visas to help exceptional talent join our team and support long-term immigration pathways where applicable. - Team building: We have regular off-sites, happy hours, and team celebrations. Export Control Notice: This position may require access to technology or source code subject to the U.S. Export Administration Regulations. Any offer of employment for this role may be conditioned on the Company's ability to provide the candidate with access to such technology or source code in compliance with applicable U.S. export control laws, which may require the Company to seek government authorization.