> Markdown version of [/jobs/ext/1935958-ai-security-architect-for-offensive-automation](https://www.wearedevelopers.com/jobs/ext/1935958-ai-security-architect-for-offensive-automation). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Ai Security Architect For Offensive Automation - **Company:** Neurons Lab - **Location:** Valencia, Spain - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Software System Penetration Testing, Burp Suite, Information Technology Consulting, Python (Programming Language), Kali Linux, Nmap, Pattern Recognition, Security Information and Event Management, Large Language Models, Metasploit, GPT, Vulnerability Analysis - **Published:** August 5, 2026 - **Apply:** https://www.buscojobs.com.es/ai-security-architect-for-offensive-automation-en-valencia-ID-365475971 ## About the Role Skills (hands-on First)Hands-on offensive security: vulnerability research, exploit development and chaining, web + network penetration testing; fluent with Nmap, Nuclei, Katana, Acunetix, Metasploit, Burp Suite and Kali tooling.Building and operating LLM agents for security work - agentic tool-use, sandbox orchestration, prompt / flow design for recon and exploitation, guardrails for autonomous exploitation.Local / self-hosted open models: running and tuning open weights (Kimi, GPT-OSS, MiniMax, DeepSeek) on rented or private GPU; quantization, throughput and the agentic-performance trade-offs that matter for security automation.Exploit & threat intelligence: sourcing and validating exploits (including from underground / forum sources), CVE triage, exploitability and severity assessment.Runtime detection: designing intrusion / privilege-escalation pattern detection, anomaly detection, and automated response.Cloud security (AWS preferred): sandboxing, container isolation, secure inference hosting.Writes their own code (Python + shell) and can explain methodology to non-security executives.KnowledgeModern offensive-security methodology and the current exploit / zero-day landscape.Strengths and limits of frontier vs. local LLMs for security automation (agentic tool-use, reasoning depth, cost-per-task). Data-egress / sovereignty constraints: why IP and recon-enabling data must stay in-perimeter; private-cloud (AWS Bedrock) vs. rented-hardware trade-offs.iGaming / regulated-infrastructure context and certification constraints (build-time vs. run-time AI) - strong plus.Defensive side - SIEM, anomaly detection, incident response - plus.ExperienceKey characteristics (ideally 4/4):Hands-on offensive securityBuilt or operated AI / LLM-driven security automation (agents, pipelines), not just used a chatbotCloud hyperscaler experience (AWS preferred)Technology consulting / client-facing delivery - can lead a CISO-level technical conversationRole-specific characteristics:3+ years hands-on offensive security / vulnerability research / red-teamDemonstrable exploit development and chaining; comfortable with zero-day research and exploit intelligenceHas wired LLMs into real security workflows (recon, exploitation, triage)Has run self-hosted / local open models in a real engagement, with a view on cost and hardwareComfortable being the sole domain expert in the room and owning the methodologyTerms & conditionsAllocation: ~********** FTE initially (discovery/advisory + joint CISO sessions), scaling with the engagement ## Description About The Project (description, Duration, Stage)Hands-on AI-for-Security engagement with a regulated iGaming / online-gaming group.The client's security team is genuinely advanced: they already run an AI-driven offensive-security capability - continuous external-perimeter scanning feeding an LLM agent that plans exploitation, sources and validates exploits, and executes them in sandboxed environments - plus a runtime anomaly-detection layer watching for intrusion and privilege-escalation patterns across their products.They built this themselves and have explicitly asked us to challenge and improve it, not just rubber-stamp it.What You'll Actually Do (example Tasks)Join joint working sessions with the client's hands-on security engineers; challenge and harden their AI-driven offensive pipeline end-to-end (recon ? verification ? AI-planned exploitation ? sandboxed execution).Design and refine the exploitation agent: how the LLM plans attack paths, selects and validates exploits, and orchestrates parallel sandboxes safely and reproducibly.Optimise cost-per-finding of the existing exploitation pipeline: benchmark local / sovereign open models (Kimi, GPT-OSS, MiniMax, DeepSeek) against frontier models for the recon, exploitation and analysis loops; quantify accuracy / latency / cost trade-offs and recommend hardware sizing.Shape the runtime anomaly-detection layer: define which intrusion / privilege-escalation precursor patterns are worth collecting (signal over raw-log volume), and design the missing pieces - automated response (kill a malicious process / disable an account on detection) and triage routing by criticality.Stand up a quick-win PoC to anchor the engagement - e.g. an automated dependency / PR vulnerability-scanning pass, or a head-to-head local-vs-frontier benchmark of the exploitation agent.Turn findings into a defensible technical proposal and roadmap; present methodology and trade-offs to a technical CISO / CTO audience.Keep all sensitive work build-time and in-perimeter - no pushing intellectual property, configs, or recon-enabling data to external model providers; respect regulated-gaming certification constraints (no uncertified AI in runtime-critical paths).Skills (hands-on First)Hands-on offensive security: vulnerability research, exploit development and chaining, web + network penetration testing; fluent with Nmap, Nuclei, Katana, Acunetix, Metasploit, Burp Suite and Kali tooling.Building and operating LLM agents for security work - agentic tool-use, sandbox orchestration, prompt / flow design for recon and exploitation, guardrails for autonomous exploitation.Local / self-hosted open models: running and tuning open weights (Kimi, GPT-OSS, MiniMax, DeepSeek) on rented or private GPU; quantization, throughput and the agentic-performance trade-offs that matter for security automation.Exploit & threat intelligence: sourcing and validating exploits (including from underground / forum sources), CVE triage, exploitability and severity assessment.Runtime detection: designing intrusion / privilege-escalation pattern detection, anomaly detection, and automated response.Cloud security (AWS preferred): sandboxing, container isolation, secure inference hosting.Writes their own code (Python + shell) and can explain methodology to non-security executives.KnowledgeModern offensive-security methodology and the current exploit / zero-day landscape.Strengths and limits of frontier vs. local LLMs for security automation (agentic tool-use, reasoning depth, cost-per-task).Data-egress / sovereignty constraints: why IP and recon-enabling data must stay in-perimeter; private-cloud (AWS Bedrock) vs. rented-hardware trade-offs.iGaming / regulated-infrastructure context and certification constraints (build-time vs. run-time AI) - strong plus.Defensive side - SIEM, anomaly detection, incident response - plus.ExperienceKey characteristics (ideally 4/4):Hands-on offensive securityBuilt or operated AI / LLM-driven security automation (agents, pipelines), not just used a chatbotCloud hyperscaler experience (AWS preferred)Technology consulting / client-facing delivery - can lead a CISO-level technical conversationRole-specific characteristics:3+ years hands-on offensive security / vulnerability research / red-teamDemonstrable exploit development and chaining; comfortable with zero-day research and exploit intelligenceHas wired LLMs into real security workflows (recon, exploitation, triage)Has run self-hosted / local open models in a real engagement, with a view on cost and hardwareComfortable being the sole domain expert in the room and owning the methodologyTerms & conditionsAllocation: ~********** FTE initially (discovery/advisory + joint CISO sessions), scaling with the engagement#J-*****-Ljbffr ## Related Videos - [How to Cause (or Prevent) a Massive Data Breach- Secure Coding and IDOR](https://www.wearedevelopers.com/videos/39-how-to-cause-or-prevent-a-massive-data-breach-secure-coding-and-idor) - [ Evaluating AI models for code comprehension](https://www.wearedevelopers.com/videos/1462-evaluating-ai-models-for-code-comprehension) - [Let’s write an exploit using AI](https://www.wearedevelopers.com/videos/1004-let-s-write-an-exploit-using-ai) - [Speak, Code, Deploy: Transforming Developer Experience with Voice Commands](https://www.wearedevelopers.com/videos/1159-speak-code-deploy-transforming-developer-experience-with-voice-commands) - [Agentic AI: building autonomous systems for developers](https://www.wearedevelopers.com/videos/100034-agentic-ai-building-autonomous-systems-for-developers) - [Streaming AI Responses in Real-Time with SSE in Next.js & NestJS](https://www.wearedevelopers.com/videos/1630-streaming-ai-responses-in-real-time-with-sse-in-next-js-nestjs) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [Dev Digest 137 - AI'm not sure about this](https://www.wearedevelopers.com/magazine/485-dev-digest-137-ai-m-not-sure-about-this) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)