You will identify realistic attack paths, build automated testing and attack tooling, work directly with engineering teams to remediate findings, and help strengthen security across authentication, access control, integrations, CI/CD, and incident readiness.

What You Will Do

• Design and execute red team exercises against LLM-based features, including prompt injection, indirect prompt injection through emails and documents, tool-use abuse, data exfiltration, and multi-step attack chains.

• Build, configure, fine-tune, and operate open-source models to develop automated security testing and adversarial tooling.

• Review application code, identify security vulnerabilities, and implement fixes in collaboration with software engineers.

• Own and improve security controls for authentication, authorization, permissions, third-party integrations, and customer data protection.

• Strengthen organizational security, including identity and access management, endpoint and device security, CI/CD security, and incident response readiness.

• Conduct threat modeling and risk assessments for new features, integrations, and AI-driven workflows.

• Support customer security reviews, questionnaires, audits, and technical discussions related to product and data security.

• Track emerging AI security threats, attack techniques, and defensive practices, translating them into practical controls and testing scenarios.

• Document findings clearly, prioritize remediation based on risk, and verify that fixes are effective.

Requirements:

• 5+ years of experience in offensive security, application security, security engineering, or a closely related field.

• Demonstrated experience attacking or assessing LLM-based systems, such as prompt injection research, AI red teaming, security tooling, published write-ups, CVEs, bug bounty findings, or internal attack-chain work.

• Strong software engineering skills, including the ability to understand unfamiliar codebases, identify vulnerabilities, and ship secure fixes.

• Hands-on experience with open-source LLMs, including running, fine-tuning, or building agents and evaluation tooling.

• Solid understanding of web and API security fundamentals, including authentication, authorization, injection vulnerabilities, session management, and access control.

• Practical experience securing cloud-based systems, developer workflows, CI/CD pipelines, and internal infrastructure.

• Ability to work across product security and organizational security, not only within a single application.

• Strong analytical skills, intellectual honesty, and a collaborative, low-ego working style.

• Fluent English, both written and spoken.

Nice to Have

• Public security research, conference talks, CVEs, bug bounty achievements, or open-source security tools.

• Experience with agent frameworks, retrieval-augmented generation, tool calling, or multi-agent systems.

• Experience supporting customers in regulated or security-sensitive industries.

• Familiarity with security frameworks and standards such as OWASP, NIST, ISO 27001, or SOC 2.

• Experience with purple teaming, detection engineering, or incident response.

Offer

• A senior role with direct influence over AI security strategy, engineering practices, and organizational security.

• The opportunity to work on challenging problems at the intersection of applied AI, offensive security, and product engineering.

• A collaborative environment where security findings lead to real engineering improvements.