Senior AI Cybersecurity Engineer

Job Overview

You will build agentic offensive security tools: AI agents that find, validate and exploit vulnerabilities in applications, source code, cloud environments and infrastructure, the way a skilled red teamer would.

Responsibilities

• Design and build production agentic systems that carry out security testing autonomously, covering planning, tool use, memory and multi-agent orchestration.
• Turn attacker tradecraft into agent capability: translate attack techniques into tools, prompts, workflows and decision logic.
• Build the tooling agents rely on, such as exploit harnesses, sandboxed execution environments, browser and API automation, and code analysis.
• Build evaluation harnesses and benchmarks that measure how well agents find real vulnerabilities, how many false positives they raise, and what each run costs.
• Reproduce and triage what the agents report, then feed the lessons back into the system.
• Build in the controls that keep agents safe to run: target scoping, guardrails, human approval points and audit logging.
• Ship and operate the software end to end: services, APIs, user interfaces, CI/CD, tests and observability.
• Use AI coding assistants and agents in your own daily work, and raise the team's practice in doing so.
• Lead technical design, review code and mentor other engineers.
• Keep current with new attack techniques and with developments in LLMs and agent tooling.

Requirements

Software Engineering

• At least 5 years of professional software engineering experience, building and operating production systems.
• Strong in Python and TypeScript/JavaScript.
• Solid grounding in backend services, APIs, data stores, containers and CI/CD, on at least one major cloud platform.
• Good engineering habits: automated testing, code review, clear system design and documentation.

Agentic AI

• Hands-on experience building and shipping at least one agentic or LLM-powered application.
• Practical command of the building blocks: tool calling, context management, multi-step orchestration, structured outputs and agent protocols such as MCP.
• Experience evaluating LLM systems, including writing evals, iterating on prompts and managing cost and latency.
• Awareness of how these systems fail, including hallucination, non-determinism and prompt injection, and how to design around it.
• Routine use of AI tools in your own engineering workflow.

Offensive Security

• Working knowledge of attack techniques across all four domains below, with hands-on experience in at least two.
• Web and API: OWASP Top 10, authentication and authorisation flaws, injection, SSRF and business logic abuse.
• Whitebox testing: reading source code to find vulnerabilities, trace them to an entry point and prove they are exploitable.
• Cloud: IAM misconfiguration, privilege escalation and service abuse on AWS, Azure or GCP.
• Infrastructure and red team operations: network attacks, Active Directory, lateral movement, command and control, and the MITRE ATT&CK framework.
• Ability to write proof-of-concept exploits and explain findings clearly to engineers.

Nice to Have

• Time spent on a penetration testing or red team.
• Offensive security certifications such as OSCP or OSWE.
• A track record in CTFs, bug bounty programmes or published CVEs.
• Contributions to open-source security or agent tooling.
• Experience securing AI systems themselves, such as agent sandboxing and prompt injection defence.
• Front-end experience with a modern framework such as React