AI Application Penetration Tester

TEKsystems•Dallas, TX

8d•$80 - $85•Hybrid

About The Position

Seeking a Cyber Security Research Engineer to support advanced application penetration testing efforts targeting Generative AI (GenAI), LLMs, and machine‑learning–powered applications. This role is part of the Application Security organization and focuses on identifying, exploiting, and documenting vulnerabilities specific to AI‑enabled systems and application-layer attack paths. The engineer will evaluate AI models and applications for weaknesses, simulate adversarial attack patterns, and perform both automated and manual exploitation attempts. The ideal candidate brings an AppSec‑oriented mindset, strong Python scripting skills, and hands‑on red‑team or penetration‑testing experience focused on modern AI and LLM environments. This team’s focus includes lateral movement techniques within AI ecosystems, prompt‑driven exploitation paths, and navigating emerging AI‑specific attack surfaces aligned with OWASP Top 10 for LLMs and AI systems.

Requirements

6–8+ years of offensive security or penetration testing experience.
Application Security Experience- Strong AppSec mindset and deep understanding of application-layer vulnerabilities.
4–5 years of Python development, including API-based testing and automation.

Responsibilities

Experience performing application penetration tests targeting GenAI applications, LLMs, ML pipelines, and agentic AI systems.
Evaluate AI‑related attack types including: Prompt injection & indirect prompt attacks Model evasion Inference abuse Misconfiguration of guardrails Vector Databases Lateral movement through AI‑connected systems
Conduct manual and automated testing using BurpSuite, custom scripts, and adversarial AI tools as well as Assess and test applications using the OWASP Top 10 and other security frameworks.
Ability to configure and use scanning tools and test harnesses and Manual exploitation skills to validate automated findings
Use Python to automate attacks, craft payloads, analyze model responses, and test bypass techniques.
Meeting with stakeholders to gather technical details and define scope for upcoming tests.
Communicate risks, attack paths, and findings clearly to technical and business partners.
Document vulnerabilities, exploitation steps, and recommendations in a clear and timely manner.
Produce high‑quality written reports summarizing vulnerabilities and remediation guidance.