Penetration Tester / ML Data Collection

Autoroboto LLC

98d•Hybrid

About The Position

AutoRoboto is an engineering and management consulting firm that has delivered projects for some of the largest technology companies in the San Francisco Bay Area. Our work spans mechanical, electrical, and software design; data collection and quality assurance; and validation testing for new hardware and software. We're deliberately small. That means our engineers work directly with client teams, see their work reach production quickly, and move between problem domains as our customers' priorities shift. If you want a narrow lane and a long approval chain, this isn't the place. If you want range and ownership, read on. This is a hybrid position that sits at the intersection of offensive security and machine learning data work — two areas where our clients increasingly need the same person in the room. On the security side, you'll take a proactive, offensive role: performing authorized penetration tests against client systems, using a range of tools and techniques to find the gaps an attacker would exploit. You'll document every action in detail and produce clear reports covering what you attempted, what succeeded, what it means for the client's risk posture, and how to fix it. On the ML side, you'll help design and run the data collection efforts that support our clients' model development and evaluation — including adversarial and edge-case data, where your security instincts are a direct advantage. You'll also apply the same rigor to data quality that you apply to security findings: reproducible process, documented methodology, defensible results. You'll typically be embedded with one or two client teams at a time, with engagements that shift as their roadmaps do.

Requirements

3+ years in penetration testing, offensive security, red teaming, or security assessment work
Hands-on command of the standard offensive toolkit and, more importantly, the judgment to know which tool the situation actually calls for
Working knowledge of common vulnerability classes and how they show up in real systems (web, API, network, authentication and authorization flows)
Scripting proficiency in Python or a comparable language, sufficient to automate your own workflow
Exceptional written communication — you can turn a messy engagement into a report a client executive will read and act on
Familiarity with ML/AI workflows and what makes a dataset good or useless
Comfort with ambiguity and client-facing work; you'll be representing AutoRoboto directly
Authorization to work in the United States and ability to work on-site or hybrid in Mountain View, CA

Nice To Haves

Relevant certifications (OSCP, GPEN, CEH, or similar)
Experience with adversarial ML, model red-teaming, or AI safety evaluation work
Background in hardware or embedded security
Prior consulting or agency experience

Responsibilities

Plan and execute authorized penetration tests across web applications, APIs, internal networks, and hardware-adjacent systems, working within clearly defined scope and rules of engagement
Identify, validate, and prioritize vulnerabilities by real-world exploitability and business impact, not just scanner severity
Write detailed technical findings and remediation guidance, and present results to both engineering teams and non-technical stakeholders
Retest remediated findings and confirm fixes hold
Contribute to our internal testing methodology, checklists, and tooling so engagements get faster and more consistent over time
Design and run data collection efforts against client specifications, including adversarial, edge-case, and failure-mode data
Build and maintain QA processes that catch labeling errors, coverage gaps, and dataset drift before they reach a training run
Write and maintain scripts and tooling to automate collection, validation, and reporting
Document collection methodology and dataset provenance to a standard that holds up under client audit
Partner with client ML teams to translate model evaluation needs into concrete collection plans
Keep meticulous records — in this role, the report is the deliverable
Operate strictly within authorized scope and client agreements, and escalate immediately when a finding falls outside it
Adapt as client priorities change, which they will