> Markdown version of [/jobs/ext/2707282-senior-offensive-security-engineer-vulnerability-operations](https://www.wearedevelopers.com/jobs/ext/2707282-senior-offensive-security-engineer-vulnerability-operations). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Offensive Security Engineer, Vulnerability Operations - **Company:** NVIDIA Corporation - **Location:** Santa Clara, CA, United States - **Experience:** Expert - **Salary:** $170,000.0 - $190,000.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Software System Penetration Testing, Encodings, Fuzz Testing, Python (Programming Language), OpenShift, Program Analysis, Red Team (Cyber Security), Software Engineering, Web Applications, Large Language Models, Multi-Agent Systems, Software Security, Model Validation, Kubernetes, Production Code, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing - **Published:** September 4, 2026 - **Apply:** https://www.jofdav.com/jobs/59554640-senior-offensive-security-engineer-vulnerability-operations ## About the Role * Bachelor's degree or equivalent experience * 12+ years in security engineering, with at least 4 years in offensive security: penetration testing, red teaming, exploit development, or vulnerability research * Deep, hands-on exploitation skill in at least one domain (web application, cloud/Kubernetes, or systems/binary) - you can build and prove an exploit chain, not just run a scanner * Strong software engineering ability in Python; you ship production code, not just PoCs * Practical experience building with LLMs: agent frameworks, tool use/function calling, multi-agent orchestration, or coding agents (Claude Code, Codex CLI, or similar) * Sound judgment about autonomous offensive tooling - scoping, authorization, and blast-radius thinking are second nature * Respectful, responsible approach to offensive testing - we break things carefully and fix them fast Ways to stand out from the crowd: * Published security research, CVEs, conference talks, or notable CTF results * Certifications like OSWE, OSEP, OSCP, or GXPN * Experience with SAST/DAST internals, fuzzing, or program analysis * Experience red-teaming AI systems themselves (prompt injection, jailbreaks, model evaluation) or contributing to AI-security research * Familiarity with Kubernetes/OpenShift, GitOps, and operating worker fleets at scale ## Description NVIDIA's Product Security organization is looking for a Senior Offensive Security Engineer to push the frontier of AI-driven offensive security. We already run language model agents that audit source code and attack live web applications at fleet scale. These include multi-agent orchestration, adversarial verification, exploit-confirmation harnesses, and sandboxed execution. Your job is to make these agents meaningfully better attackers: new attack capabilities, new target classes, higher true-positive rates, and safer autonomy. This is a hands-on role for someone who is both a strong offensive security practitioner and a builder of agentic systems. Join us! What you'll be doing: * Crafting and building new red team agents: autonomous and semi-autonomous LLM agents that perform reconnaissance, hypothesis-driven exploitation, and evidence capture against NVIDIA-owned targets * Extending our existing agent harnesses (multi-phase orchestration, parallel specialist subagents, judge/verifier stages, out-of-band callback infrastructure) across multiple agent runtimes and model providers * Encoding real operator tradecraft into prompts, tools, and playbooks - web app exploitation, auth bypass, SSRF/deserialization chains, cloud and Kubernetes attack paths - so agents find what a skilled human would * Building the verification layer: exploit-confirmation harnesses that prove findings are real before a human ever sees them, driving false-positive rates down * Engineering the safety side of autonomy: sandboxing, scope enforcement, tool allowlists/blocklists, credential isolation, and prompt-injection defenses for agents operating with offensive capability * Evaluating and benchmarking frontier models for offensive tasks; partnering with our human red team to turn their engagements into repeatable agent capabilities * Mentoring engineers on the team and setting the technical bar for agentic offensive tooling ## Related Videos - [A Brief History of Data Storage](https://www.wearedevelopers.com/videos/974-a-brief-history-of-data-storage) - [This Is Not Your Father's .NET](https://www.wearedevelopers.com/videos/967-this-is-not-your-father-s-net) - [Understanding Kubernetes in a visual way](https://www.wearedevelopers.com/videos/100085-understanding-kubernetes-in-a-visual-way) - [Building, securing and governing AI infrastructure in the Era of Agentic AI](https://www.wearedevelopers.com/videos/100129-building-securing-and-governing-ai-infrastructure-in-the-era-of-agentic-ai) - [JSON and Beyond](https://www.wearedevelopers.com/videos/968-json-and-beyond) - [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again) - [Dev Digest 129 - Now that's what I call private data!](https://www.wearedevelopers.com/magazine/468-dev-digest-129-now-that-s-what-i-call-private-data) - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)