About the role

What will you do at Magic?

Magic’s mission is to build safe AGI that accelerates humanity’s progress on the world’s most important problems. We believe the most promising path to safe AGI lies in automating research and code generation to improve models and solve alignment more reliably than humans can alone. Our approach combines frontier-scale pre-training, domain-specific RL, ultra-long context, and inference-time compute to achieve this goal.

About the role

As our first dedicated Defensive Security Engineer at Magic, you will build the software, automation, and infrastructure that protect our models, systems, and engineering organization from both traditional and frontier AI cyber threats. You will respond to security threats, help us build good practices around security incident/threat response.

The role sits at the intersection of software engineering, infrastructure, and security. You will work closely with researchers, infrastructure engineers, and platform teams to reduce risk while considering the productivity impact. You will help us make the secure path the easy, productive path.

The threat landscape is changing, supply chain attacks are a major concern, prompt injections and other LLM-native attack vectors are worrying. As frontier AI systems become increasingly capable, security is evolving beyond defending infrastructure alone. Modern models can autonomously discover vulnerabilities, chain exploits across multiple systems, manipulate agents through prompt injection, and escape “secure” containment.

AI safety is extremely important to us at Magic. You will collaborate with our alignment team on whatever they might need to ensure that Magic's models are a safe net-benefit to the world.

What you might work on:

Design, build, and maintain security tooling and automation used by Magic's engineering teams

Secure developer infrastructure, CI/CD pipelines, build systems, and production services and make the platform tools easy to use

Support our sandboxes team with building secure sandboxing and isolation for untrusted code, agent and model execution

Build guardrails against emerging AI attack vectors, including prompt injection, tool abuse, exploit chaining, and autonomous model behavior

Protect model weights, research artifacts, datasets, and production infrastructure from unauthorized access, lateral movement, and exfiltration

Respond to security incidents and live threats

What we’re looking for:

Software engineering skills with experience building production systems in Rust, Go, Python, C++, Kotlin, TypeScript, or similar languages

A very good understanding of modern MITRE att&ck techniques

Actively engaged in the role of LLMs in securing and attacking software systems

On-call readiness 24/7, assisted by our team

Experience securing distributed systems, cloud infrastructure, or large-scale production environments

Ability to develop high-complexity cloud Linux-based exploits

Deep understanding of UNIX or other operating systems, networking, authentication, authorization, and modern security architecture

Experience building automation and tooling to secure fast paced organizations

Track record of exceptional personal integrity, accountability and trustworthiness in high autonomy environments

Compensation, benefits, and perks (US):

Annual salary ranges between $225K - $550K based on experience

Equity is a significant part of total compensation, in addition to salary

401(k) plan with 6% salary matching

Generous health, dental and vision insurance for you and your dependents

Unlimited paid time off

Visa sponsorship and relocation stipend to bring you to SF, if possible

A small, fast-paced, highly focused team

Magic strives to be the place where high-potential individuals can do their best work. We value quick learning and grit just as much as skill and experience.

Our culture

Integrity. Words and actions should be aligned

Hands-on. At Magic, everyone is building

Teamwork. We move as one team, not N individuals

Focus. Safely deploy AGI. Everything else is noise

Quality. Magic should feel like magic

Which skills does this role require?

Defensive securitySoftware engineeringRustGoPythonC++KotlinTypeScriptCloud infrastructureDistributed systemsLinuxSecurity automationIncident responseThreat modelingCI/CD securityAI safetyDefensive SecurityAGIMITRE ATT&CKLLMCloud InfrastructureCI/CDSecurity ArchitectureAutomationIncident ResponsePrompt InjectionDistributed SystemsAI SafetyModel WeightsSandboxingNetworkingAuthenticationAuthorizationSoftware EngineeringLLMs

Make your next move

Build a shortlist and prepare

Identify the requirements you can demonstrate, then choose examples from your work to discuss with the hiring team.

Build a focused shortlist before you applyCompare role requirements with your experience and give each application a clear reason.
Practice explaining your experience in an interviewRehearse your answers before meeting the hiring team.

Review the responsibilities and requirements before adding an opening to your shortlist.