Research Lead - AI Cyber Testing & Evaluation

RAND • Pittsburgh, DC

2d • Hybrid

About The Position

RAND’s Center on AI, Security, and Technology (CAST), part of the Global and Emerging Risks Division, conducts research on transformative, high-impact technologies to shape policies that protect global security and advance the public good. The Research Lead will manage significant research budgets and personnel, oversee complex technical research and policy analysis projects, and lead multidisciplinary teams of policy researchers, engineers, and scientists.

The team will build systems to evaluate AI models across the attack lifecycle, including resource development, initial access, discovery, lateral movement, and defense evasion. Projects may include benchmarks for autonomous operations using scaffolding and tools, and for the uplift of novice and expert human operators. Potential benchmark environments and methods include CTF challenges, attack-graph reasoning, multi-stage operations, stealth and defense-evasion assessments, and time-sensitive operations at machine speed.

Many evaluations will be commissioned by government agencies, and their findings will inform responsible AI policy. The team will communicate results through detailed technical analyses, evaluation frameworks, and quick-turnaround policy briefs for senior government and industry leaders. The role is a three-year term appointment, with options to renew and explore longer-term employment at RAND. RAND emphasizes rigorous analysis, quality, and objectivity.

The position is offered at either the specialist or expert level. Hiring locations are San Francisco, Washington, DC, Santa Monica, Pittsburgh, and Boston, with a hybrid arrangement; fully remote work will also be considered. A writing sample or code sample is required. The stated salary range is $150,100–$268,500, with level-specific ranges of $150,100–$217,600 for Technical Specialist and $171,800–$268,500 for Technical Expert. RAND offers benefits including health insurance coverage, life and disability insurance, a savings plan, and paid time off.

Requirements

• At least 6 years of technical experience in security engineering, software engineering, firmware engineering, hardware engineering, or a related field.
• At least 6 years of technical management experience, including leading cross-functional teams, managing project budgets, and mentoring and developing team members.
• Demonstrated ability to lead complex projects to completion.
• Proficiency in Python, Java, C/C++, or another popular programming language.
• Experience with red team operations or offensive cyber capabilities development.
• Ability to develop rigorous, comprehensive threat models and identify potential system vulnerabilities.
• Strong English verbal and written communication skills.
• Ability to work effectively in a collaborative, multidisciplinary environment.
• Fluency with the MS Office suite.
• A writing sample or code sample.
• Ability to obtain and maintain a U.S. government clearance is preferred but not required.
• Education and experience must meet one of the stated specialist-level pathways: a PhD in a listed or similar field plus at least 3 years of relevant professional experience; a master’s degree in a listed or similar field plus at least 6 years; or a bachelor’s degree in a listed or similar field plus at least 8 years.

Nice To Haves

• Graduate of CNODP, RIOT, FORGE, or equivalent experience.
• Understanding of advanced persistent threat tactics, techniques, and procedures, and experience defending against them.
• Ability to think creatively about offensive and/or defensive techniques and strategies beyond compliance with existing regulations.
• Experience working on AI research, machine-learning model training, or model deployment.
• Master’s or PhD degree preferred.
• Ability to obtain and maintain a U.S. government clearance.

Responsibilities

• Manage significant research budgets and personnel.
• Oversee complex technical research and policy analysis projects.
• Lead multidisciplinary teams of policy researchers, engineers, and scientists.
• Build systems and benchmarks to evaluate AI models across the full attack lifecycle.
• Evaluate capabilities such as autonomous operations, human uplift, attack-graph reasoning, multi-stage operations, stealth, defense evasion, and time-sensitive operations.
• Communicate findings through technical analyses, evaluation frameworks, and policy briefs.
• Inform analysis delivered to senior government and industry leaders.

Benefits

• Health insurance coverage
• Life insurance
• Disability insurance
• Savings plan
• Paid time off
• RAND sabbatic pay, which provides additional compensation above base pay when vacation is taken

What This Job Offers

• Job Type: Full-time
• Career Level: Senior