Security Software Engineer

This is a hands-on role for an engineer who breaks things, then builds the fix. You’ll attack the company’s AI platform, APIs and cloud infrastructure before adversaries do, and turn what you find into engineering changes that harden the product at its core.

You won’t be gatekeeping releases with manual reviews. Instead, you’ll build agentic tooling that scales offensive testing, and you’ll contribute directly to the codebase.

What you’ll do

• Run continuous penetration testing and red-team assessments across the applications, APIs, AI/ML pipelines and cloud environments, not just during annual engagements.
• Build agentic security tooling that finds, validates and patches vulnerabilities end to end, across code review, dependencies and infrastructure as code.
• Develop custom offensive tooling, exploit chains and attack simulations tailored to an AI platform.
• Test AI-specific attack surfaces, including prompt injection, model manipulation, data poisoning, agent workflows and tenant isolation.
• Hunt for the logic flaws, auth bypasses and chained exploits that scanners miss.
• Run threat-modelling sessions with engineering, and get fixes shipped in the same sprint.
• Fix critical vulnerabilities yourself, harden authentication and authorisation flows, and build security primitives into the platform.
• Lead purple-team exercises, and own the relationship with external pen-test firms through to remediation.

• Professional penetration testing across web apps, APIs and cloud, ideally including AI/ML systems. You’ve written real exploits, not just run scanners.
• Development experience in a strongly typed language (Rust, Go, Java or C++), plus Python or Bash for tooling and exploit development.
• Fluency with Burp Suite, Nuclei, Semgrep and custom fuzzing, and the instinct to build your own tools when off-the-shelf ones fall short.
• Experience integrating SAST, DAST and SCA into CI/CD so developers get fast, actionable feedback. xrbllit
• Comfort with Terraform and Kubernetes, and the ability to spot misconfigurations and attack paths in AWS and GCP.
• Working knowledge of threat modelling, cryptography fundamentals and frameworks such as SOC 2, ISO 27001/42001 and NIST CSF.

Bonus

• OSCP, OSWE, GXPN, GWAPT, CPTS or similar certifications
• Cloud pen testing in AWS or GCP: privilege escalation, cross-account attacks, metadata abuse
• Kubernetes attack experience: RBAC abuse, container escapes, admission controller bypasses
• Testing multi-tenant SaaS in regulated industries, especially financial services
• Bug bounty record, published CVEs or security research
• Customer-facing pen-test debriefs and security architecture reviews

A Series D AI company in New York is hiring a Security Software Engineer to be its in-house offensive security capability. The company builds an AI platform used by analysts and dealmakers at many of the world’s leading investment banks, private equity firms and investment funds. It has strong product-market fit, top-tier venture backing, and a security team that is growing quickly.