Security engineer

You will identify realistic attack paths, build automated testing and attack tooling, work directly with engineering teams to remediate findings, and help strengthen security across authentication, access control, integrations, CI/CD, and incident readiness.

• Design and execute red team exercises against LLM-based features, including prompt injection, indirect prompt injection through emails and documents, tool-use abuse, data exfiltration, and multi-step attack chains.
• Build, configure, fine-tune, and operate open-source models to develop automated security testing and adversarial tooling.
• Review application code, identify security vulnerabilities, and implement fixes in collaboration with software engineers.
• Own and improve security controls for authentication, authorization, permissions, third-party integrations, and customer data protection.
• Strengthen organizational security, including identity and access management, endpoint and device security, CI/CD security, and incident response readiness.
• Conduct threat modeling and risk assessments for new features, integrations, and AI-driven workflows.
• Support customer security reviews, questionnaires, audits, and technical discussions related to product and data security.
• Track emerging AI security threats, attack techniques, and defensive practices, translating them into practical controls and testing scenarios.
• Document findings clearly, prioritize remediation based on risk, and verify that fixes are effective.

• 5+ years of experience in offensive security, application security, security engineering, or a closely related field.
• Demonstrated experience attacking or assessing LLM-based systems, such as prompt injection research, AI red teaming, security tooling, published write-ups, CVEs, bug bounty findings, or internal attack-chain work.
• Strong software engineering skills, including the ability to understand unfamiliar codebases, identify vulnerabilities, and ship secure fixes.
• Hands-on experience with open-source LLMs, including running, fine-tuning, or building agents and evaluation tooling.
• Solid understanding of web and API security fundamentals, including authentication, authorization, injection vulnerabilities, session management, and access control.
• Practical experience securing cloud-based systems, developer workflows, CI/CD pipelines, and internal infrastructure.
• Ability to work across product security and organizational security, not only within a single application.
• Strong analytical skills, intellectual honesty, and a collaborative, low-ego working style.
• Fluent English, both written and spoken.
• Будет плюсом: Public security research, conference talks, CVEs, bug bounty achievements, or open-source security tools; Experience with agent frameworks, retrieval-augmented generation, tool calling, or multi-agent systems; Experience supporting customers in regulated or security-sensitive industries; Familiarity with security frameworks and standards such as OWASP, NIST, ISO 27001, or SOC 2; Experience with purple teaming, detection engineering, or incident response

• A senior role with direct influence over AI security strategy, engineering practices, and organizational security.
• The opportunity to work on challenging problems at the intersection of applied AI, offensive security, and product engineering.
• A collaborative environment where security findings lead to real engineering improvements.