Senior Offensive AI Security Engineer

Zoom

6d•$124,000 - $271,200•Remote

About The Position

This role combines offensive security research and applied AI to identify critical risks across Zoom’s products, applications, services, and infrastructure before they become incidents. The engineer uses target knowledge, threat analysis, and AI models to form and test hypotheses about complex systems, validate exploitability, and trace attack paths that routine testing may miss. The position emphasizes hands-on research and impactful, verified findings rather than vulnerability volume, scanning, or prompt engineering. Research directions are chosen in collaboration with Security Assurance teams, while most work is self-directed and highly autonomous. Zoom’s Offensive Security team researches vulnerabilities across products, applications, and infrastructure, focusing on high-impact issues that escape standard secure-development processes and routine testing. The team is evolving toward AI-native research, using models to extend experienced engineers’ reach alongside sound research strategy, target knowledge, and rigorous verification.

Requirements

At least 5 years of hands-on vulnerability research, offensive security, application security, or penetration testing experience.
A demonstrated record of selecting targets, forming and revising hypotheses, and establishing exploitability and impact in complex software or production systems.
Hands-on experience conducting offensive workflows with frontier and open-weight models, including selecting models when refusal behavior would otherwise prevent legitimate exploit development.
Experience assessing AI-driven research quality, including identifying false positives, missed vulnerabilities, unstable results, and reproducibility gaps.
Sound judgment about agent architecture trade-offs, including when constrained, orchestrated pipelines provide reproducible results and when open-ended tool-using agents justify their nondeterminism.
Deep technical expertise in at least one security domain: web applications and APIs, Java applications, cloud or service infrastructure, client software, operating systems, or reverse engineering.
Strong programming and debugging skills, including reading unfamiliar code, building research tooling, writing proofs of concept, and tracing behavior across system boundaries.
Strong intuition for attack surfaces, trust boundaries, exploitability, and security impact.
Persistence and ability to work independently on open-ended research without a guaranteed path or outcome.
Ability to communicate findings clearly to technical and nontechnical audiences, explaining what evidence shows, what remains uncertain, and why it matters.

Responsibilities

Leverage AI to research vulnerabilities across Zoom products, applications, services, and infrastructure, focusing on high-impact issues, subtle vulnerabilities, confirmed exploitability, and attack paths crossing component and trust boundaries.
Use experience, threat analysis, architecture knowledge, source code, and observed system behavior to select targets and guide investigations.
Apply frontier and open-weight models, agents, and other AI capabilities throughout reconnaissance, code analysis, hypothesis generation, exploit development, and verification.
Design and tune research harnesses that provide models with appropriate context, tools, execution environments, and feedback for investigating real targets.
Develop custom tooling such as analysis utilities, fuzzers, agents, test harnesses, proofs of concept, and full exploits when useful to answer research questions.
Turn promising model output into defensible security evidence by reproducing findings, ruling out false claims, establishing preconditions, and distinguishing possible weaknesses from demonstrated vulnerabilities with real impact.
Improve the reliability and reach of AI-driven research by addressing false positives, false negatives, context limits, nondeterminism, and reproducibility.
Work with Engineering and Product Security to communicate findings, support remediation, surface related risks, and verify fixes.
Share tools, techniques, and lessons learned to help Security Assurance and the broader Security organization improve processes through AI.