Devoteam Cyber Trust | AI Engineer

Description

The company is the cybersecurity unit of the company Group, with more than 800 specialists across EMEA. It aims to make security support business success rather than block it, and it protects mid-size and large companies in all sectors.

The Portugal team has provided managed security services since 2009, combining its own expertise and proprietary technology to lower clients' cyber risk. Services cover penetration testing, ISO 27001, PCI-DSS, consulting, GRC, and third-party risk management. The company holds ISO 27001 and ISO 9001 certification, is a PCI-QSA, and is a member of CREST and CIS. It serves clients in more than 20 countries.

You will join the Offensive Engineering and Innovation team, which builds new technical capabilities to extend and scale offensive security services.

The team is building an autonomous penetration testing platform on agentic systems. It will automate large parts of the pentesting lifecycle, follow methods such as the OWASP Web Security Testing Guide (WSTG), and connect to existing security tools, using agents and LLMs.

The platform is meant for production use in client delivery work, not as a side experiment.

Success means agents produce useful, actionable output, execution stays predictable and controllable, unsafe or unexpected behaviour is rare, the platform fits real pentesting workflows, and it keeps evolving without unmanageable complexity.

Responsibilities

• Design and evolve the architecture of autonomous pentesting agents.
• Build controlled execution pipelines covering tasking, tool use, and feedback loops.
• Design and improve planning, state management, tool orchestration, and the validation and control of agent runs.
• Integrate and tune LLM-based components inside agent workflows.
• Define and validate tool-calling interfaces and integrations with pentesting tools.
• Make sure the platform follows established methodologies such as OWASP WSTG.
• Test agent behaviour in real-world scenarios.
• Find, analyse, and reduce system failures and edge cases.
• Help shape internal standards, engineering practices, and design patterns.

Requirements

• Required: strong Python skills.
• Required: experience with APIs and distributed systems.
• Required: practical experience using, integrating, and working around the limits of LLMs.
• Required: understanding of agent-based systems.
• Highly important: ability to design complex, non-deterministic systems.
• Highly important: experience with task decomposition and planning, state management and keeping execution going, tool orchestration, and output validation with evidence handling.
• Highly important: strong debugging skills for deep system-level troubleshooting.
• Highly important: ability to check how a system behaves, not just whether the code is correct.
• Differentiator: experience with agent frameworks.
• Differentiator: background in application security (AppSec).
• Differentiator: experience with security testing automation.
• Differentiator: exposure to several LLM models and providers.
• Strong critical thinking.
• Comfortable working with imperfect, changing systems.
• An experimental, outcome-focused approach.
• A strong focus on control, reliability, and predictability.
• High autonomy and a sense of ownership.

Conditions

The company works to ensure equal opportunities, promotes people on merit, and opposes all forms of discrimination. All vacancies are open to people with disabilities.

Benefits

• Investment in your growth and development.
• Recognition and support for your career.
• Work at a company that keeps growing and changing.
• A culture built on collaboration, sharing, flexibility, integrity, and low ego.