Senior Offensive Security Engineer, Vulnerability Operations
About The Position
NVIDIA's Product Security organization is seeking a Senior Offensive Security Engineer to improve AI-driven offensive security systems. The role focuses on building and enhancing autonomous and semi-autonomous language model agents that audit source code and test live web applications across NVIDIA-owned targets. The engineer will develop new attack capabilities and target coverage, increase true-positive rates, and make agent autonomy safer. This is a hands-on position combining offensive security expertise with agentic systems engineering. The role involves extending agent harnesses across runtimes and model providers, translating operator tradecraft into agent prompts, tools, and playbooks, and building exploit-confirmation systems that validate findings before human review. It also includes engineering safeguards for agents with offensive capabilities, evaluating frontier models, partnering with the human red team, and mentoring engineers.
Requirements
- Bachelor's degree or equivalent experience.
- 12 or more years of experience in security engineering, including at least 4 years in offensive security such as penetration testing, red teaming, exploit development, or vulnerability research.
- Deep hands-on exploitation skills in at least one of web application, cloud/Kubernetes, or systems/binary security, including the ability to build and prove an exploit chain.
- Strong Python software engineering skills and experience shipping production code.
- Practical experience building with LLMs, such as agent frameworks, tool use/function calling, multi-agent orchestration, or coding agents.
- Sound judgment regarding autonomous offensive tooling, including scoping, authorization, and blast-radius considerations.
- A respectful and responsible approach to offensive testing.
Nice To Haves
- Published security research, CVEs, conference talks, or notable CTF results.
- Certifications such as OSWE, OSEP, OSCP, or GXPN.
- Experience with SAST/DAST internals, fuzzing, or program analysis.
- Experience red-teaming AI systems, including prompt injection, jailbreaks, or model evaluation, or contributing to AI-security research.
- Familiarity with Kubernetes/OpenShift, GitOps, and operating worker fleets at scale.
Responsibilities
- Build autonomous and semi-autonomous red team agents for reconnaissance, hypothesis-driven exploitation, and evidence capture against NVIDIA-owned targets.
- Extend agent harnesses, including multi-phase orchestration, parallel specialist subagents, judge/verifier stages, and out-of-band callback infrastructure, across multiple agent runtimes and model providers.
- Encode offensive security tradecraft in prompts, tools, and playbooks, including web application exploitation, authentication bypass, SSRF and deserialization chains, and cloud and Kubernetes attack paths.
- Build exploit-confirmation harnesses that establish whether findings are real and reduce false positives.
- Develop safety controls for autonomous offensive tools, including sandboxing, scope enforcement, tool allowlists and blocklists, credential isolation, and prompt-injection defenses.
- Evaluate and benchmark frontier models for offensive security tasks.
- Partner with the human red team to convert engagement experience into repeatable agent capabilities.
- Mentor team engineers and set the technical bar for agentic offensive tooling.
Benefits
- Equity.
- Benefits package.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
