Senior Security Researcher – Red Team

This is a fully remote position, open to applicants in Ukraine.

📋 Description

• Design and implement red team operations targeting Pindrop’s GenAI systems, LLM pipelines, RAG architectures, autonomous agents, APIs, SaaS products, and cloud environments.

• Execute adversarial testing for various threats including prompt injection, indirect prompt attacks, jailbreaking, model extraction, training-data poisoning, data leakage, inference abuse, and unauthorized output manipulation.

• Utilize deepfake generation, voice synthesis, and spoofing techniques to assess voice authentication and deepfake detection capabilities.

• Create attack chains that integrate GenAI vulnerabilities with weaknesses in infrastructure, applications, identity, and APIs.

• Plan and carry out penetration tests while supporting bug bounty initiatives across web applications, APIs, SaaS products, and AWS/GCP environments.

• Conduct architecture reviews, security code assessments, and threat modeling with a focus on AI/ML vulnerabilities and services interfacing with LLMs.

• Develop automation for offensive security workflows, testing, compliance checks, alerting, and reporting through Python or similar scripting languages.

• Collaborate with SecOps and security engineering teams to enhance detection, response workflows, remediation efforts, and defensive strategies.

• Stay updated on GenAI security research, adversarial ML techniques, threat intelligence, and regulatory changes, applying insights to Pindrop’s security framework.

⛳️ Requirements

• Minimum of 3 years of practical experience in penetration testing and red teaming across SaaS applications, cloud infrastructure, APIs, and web applications.

• Proven experience in attacking GenAI or LLM-based systems, addressing prompt injection, jailbreaking, indirect prompt attacks, model extraction, or generating adversarial inputs.

• Hands-on experience with deepfake tools, voice synthesis, or audio/visual spoofing technologies in an offensive or research capacity.

• Strong expertise with offensive security tools such as Burp Suite, OWASP ZAP, Nmap, Metasploit, Cobalt Strike, or comparable frameworks.

• Experience in configuring and utilizing SAST and DAST tools and integrating them within CI/CD pipelines.

• Proficiency in at least one scripting or programming language, preferably Python, for developing custom attack tools and automating workflows.

• Familiarity with AI-specific security tools or frameworks like Garak, PyRIT, Claude Security, or other adversarial ML tooling.

• In-depth understanding of cloud security architecture, container security, API security, and standard security protocols such as ISO 27001/27002, NIST, CIS, PCI DSS, OWASP, and SOC 2.

• Prior experience in software development or secure architecture, showcasing the ability to analyze production code across various programming languages.

• Background in research, publication, or practical expertise in adversarial machine learning, LLM security, or voice/audio deepfake detection.

• Relevant certifications such as OSCP, GPEN, GWAPT, GXPN, CEH, or equivalent qualifications are preferred.

• Previous experience in voice biometrics, AI security, fraud prevention, or similarly sensitive product environments.

🏝️ Benefits

• Competitive salary, including equity options for all employees.

• Unlimited Paid Time Off (PTO).

• Remote-first work culture.