AI Security Researcher

Description

The company is an applied AI lab building AI agents for cybersecurity, aimed at attacks that now run at machine speed and scale. Its AI Taskforce reviews petabytes of enterprise data to fix issues before serious breaches happen.

The applied lab works alongside the core product team and partners with Fortune 500 companies to secure complex production environments. The company is backed by Greylock and Bain Capital Ventures.

The team includes people from Stanford, Berkeley, Penn, Duke, Carnegie Mellon, Waterloo, Scale AI, Databricks, Stripe, Tesla, Coinbase, Wiz, Abnormal AI, Zscaler, DeepMind and SAIL.

This role sits in Research and builds the offensive side: the attacker the defensive agents must beat. You will turn real red team skill into autonomous capability.

Responsibilities

• Build the red team agents: the harness, the tools and Model Context Protocol (MCP) servers they call, and the skills that capture how an operator works, from scoping and reconnaissance through payload development, delivery, Command and Control (for example Mythic) and post-exploitation. Make these repeatable for the offensive agent and review its runs to close gaps.
• Extend current application and code coverage into full attack chains: initial access, delivery and evasion, Command and Control, privilege escalation and lateral movement across Windows, Active Directory and on-prem. Work with the cloud security researchers to add cloud (identity and access management, misconfiguration, continuous integration and delivery) and network.
• Build detection-evasion methods into the agents and test harness, plus a detonation and detection loop that checks them against real Endpoint Detection and Response (EDR).
• Design and run cyber ranges with realistic defenses such as EDR, Security Information and Event Management and logging. Build them in-house and with vendors like Ludus, starting Windows and Active Directory heavy, then adding cloud and hybrid with the cloud team. The agents are trained, benchmarked and verified there.
• Turn attack paths into evaluation tasks with verifiable success criteria, feeding benchmarks such as IntrusionBench, so every change can be measured.
• Verify critical and high-severity attack paths in real customer environments and feed the findings back into the agents and detections.
• Represent the company in the offensive security community through research, talks and open-source work.

Requirements

• 6+ years in offensive security, red team operations or adversary emulation.
• Hands-on operator who has run full-chain operations from initial access through post-exploitation across Windows, Active Directory and on-prem environments.
• Deep knowledge of Command and Control frameworks (for example Mythic) and payload development, with real EDR evasion experience.
• You write code, such as Python, to turn manual tradecraft into repeatable, automated capability rather than one-off work.
• You have built and operated realistic test environments or cyber ranges with production defenses such as EDR, SIEM and logging.
• Bonus points: attack experience in cloud (identity and access management, misconfiguration, CI/CD) or network.
• Bonus points: you have built evaluations or benchmarks that measure security capability.
• Bonus points: offensive security open-source tooling, conference talks or published research.
• Bonus points: you have worked with AI agents, LLM tooling or agentic workflows.