Magic’s mission is to build safe AGI that accelerates humanity’s progress on the world’s most important problems. We believe the most promising path to safe AGI lies in automating research and code generation to improve models and solve alignment more reliably than humans can alone. Our approach combines frontier-scale pre-training, domain-specific RL, ultra-long context, and inference-time compute to achieve this goal.
About the role:
As our first dedicated Defensive Security Engineer at Magic, you will build the software, automation, and infrastructure that protect our models, systems, and engineering organization from both traditional and frontier AI cyber threats. You will respond to security threats, help us build good practices around security incident/threat response.
The role sits at the intersection of software engineering, infrastructure, and security. You will work closely with researchers, infrastructure engineers, and platform teams to reduce risk while considering the productivity impact. You will help us make the secure path the easy, productive path.
The threat landscape is changing, supply chain attacks are a major concern, prompt injections and other LLM-native attack vectors are worrying. As frontier AI systems become increasingly capable, security is evolving beyond defending infrastructure alone. Modern models can autonomously discover vulnerabilities, chain exploits across multiple systems, manipulate agents through prompt injection, and escape “secure” containment.
AI safety is extremely important to us at Magic. You will collaborate with our alignment team on whatever they might need to ensure that Magic's models are a safe net-benefit to the world.
What you might work on:
Design, build, and maintain security tooling and automation used by Magic's engineering teams
Secure developer infrastructure, CI/CD pipelines, build systems, and production services and make the platform tools easy to use
Support our sandboxes team with building secure sandboxing and isolation for untrusted code, agent and model execution
Build guardrails against emerging AI attack vectors, including prompt injection, tool abuse, exploit chaining, and autonomous model behavior
Protect model weights, research artifacts, datasets, and production infrastructure from unauthorized access, lateral movement, and exfiltration
Respond to security incidents and live threats
What we’re looking for:
Software engineering skills with experience building production systems in Rust, Go, Python, C++, Kotlin, TypeScript, or similar languages
A very good understanding of modern MITRE att&ck techniques
Actively engaged in the role of LLMs in securing and attacking software systems
On-call readiness 24/7, assisted by our team
Experience securing distributed systems, cloud infrastructure, or large-scale production environments
Ability to develop high-complexity cloud Linux-based exploits
Deep understanding of UNIX or other operating systems, networking, authentication, authorization, and modern security architecture
Experience building automation and tooling to secure fast paced organizations
Track record of exceptional personal integrity, accountability and trustworthiness in high autonomy environments
Compensation, benefits, and perks (US):
Annual salary ranges between $225K - $550K based on experience
Equity is a significant part of total compensation, in addition to salary
401(k) plan with 6% salary matching
Generous health, dental and vision insurance for you and your dependents
Unlimited paid time off
Visa sponsorship and relocation stipend to bring you to SF, if possible
A small, fast-paced, highly focused team
Magic strives to be the place where high-potential individuals can do their best work. We value quick learning and grit just as much as skill and experience.
Our culture
Integrity. Words and actions should be aligned
Hands-on. At Magic, everyone is building
Teamwork. We move as one team, not N individuals
Focus. Safely deploy AGI. Everything else is noise
Quality. Magic should feel like magic