Senior AI Security Engineer – LLM Vulnerability

About the Role

We are looking for experienced GenAI Security Engineers to create and evaluate security tasks for generative AI applications. In this role, you will source or build GenAI applications, create vulnerable and patched versions, document security findings, and write tests for each vulnerability mechanism. Where possible, you will also demonstrate the relevant behavior using a live model.

What You’ll Do

• Source or build GenAI applications, including agent and RAG systems.
• Create vulnerable versions and secure, patched counterparts.
• Document findings with exact code-line spans, traps, control status, and recommendations.
• Trace data and action flows across files, callbacks, registries, and background jobs, explaining when and why a control misses a route.
• Define authorization contexts, including actors, trust boundaries, tenants, permitted data and actions, purposes, recipients, and document-level access.
• Write exploit and reproduction tests that demonstrate weaknesses in vulnerable versions and confirm that patches prevent them.
• Demonstrate relevant model behavior using a live model when possible.

What We’re Looking For

• At least 3 years of experience in application security, product security, secure code review, penetration testing, or vulnerability research.
• Strong data-flow reasoning and the ability to trace a source to a sink across files, callbacks, registries, and background jobs.
• Strong knowledge of authentication, authorization, least privilege, tenant isolation, trust boundaries, and approval flows.
• Knowledge of the OWASP Top 10 for LLM Applications, particularly sensitive information disclosure and excessive agency, along with familiarity with prompt injection and tool abuse.
• Ability to map findings to relevant CWEs, including exposure, sensitive data in logs, access control, and excessive privilege weaknesses.
• Experience writing exploit and reproduction tests that distinguish vulnerable behavior from patched behavior.
• Experience with CodeQL or Semgrep, SARIF, and the limitations of pattern-based scanners for logic and authorization flaws.
• Hands-on experience with LLM tool calling, agents, MCP, RAG, memory, and tracing using tools such as LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and OpenTelemetry.
• Production coding experience and strong engineering fundamentals, including Docker, Git, security patches, commit history, and clear technical English.

Engagement Details

• Remote contractor assignment.
• Open to candidates in Bangladesh, Brazil, Colombia, Egypt, Ghana, India, Indonesia, Nigeria, Turkey, and the United States.
• Four-week engagement with an immediate start.
• Full-time or part-time commitment of 40 or 20 hours per week, including at least four hours of PST overlap.
• Compensation: $15 per hour.
• 35 positions available.