Senior Red Team Operator, AI/LLM

Armadin

7d•Remote

About The Position

Armadin is building autonomous proactive security systems that use specialized AI agents and custom models to discover, exploit, and chain vulnerabilities across external, internal, identity, cloud, and application attack surfaces. The Senior Red Team Operator will conduct hands-on operations and encode expert red-team tradecraft into the reasoning, techniques, and evaluation data used by those agents. The role involves pressure-testing end-to-end kill chains, identifying weaknesses in the swarm, and using AI tools to work more efficiently and thoroughly. The operator will focus on attacks against LLMs, agents, RAG pipelines, and surrounding applications, including prompt injection, tool abuse, integration flaws, agentic trust-boundary failures, AI supply-chain weaknesses, and model attacks. The role also includes code review, building offensive scripts and harnesses, researching emerging attack classes, and communicating attack narratives, business risks, and remediation guidance to clients and internal stakeholders. This is a remote position in the United States, with travel of up to 20% for on-site engagements or client meetings. Candidates must be eligible to work in the United States without sponsorship.

Requirements

Deep, hands-on experience exploiting LLMs and agents, including direct and indirect prompt injection, jailbreak chains, system prompt extraction, and data exfiltration through model outputs.
Depth in at least one additional AI attack surface: agentic systems; RAG and data pipelines; adversarial machine learning; or AI supply chain and infrastructure.
Strong web and API application-security exploitation skills, including authentication and authorization bypass and injection chains.
Fluency with offensive tools such as Burp Suite, Caido, Garak, PyRIT, promptfoo, and the Adversarial Robustness Toolbox, along with judgment to recognize when tools are wrong.
Strong understanding of LLMs, agent frameworks, and model-serving stacks and how weaknesses can be chained.
Proficiency across Linux, Windows, and macOS, and major cloud AI platforms; scripting ability in Python, Bash, or similar.
Experience using AI tools to accelerate reconnaissance, analysis, or tooling, and interest in expanding their use.
Ability to absorb new information quickly, make time-sensitive decisions under pressure, and explain reasoning to safety and engineering teams.
Self-directed, resourceful, and comfortable working amid ambiguity and shifting priorities in a startup environment.
Ability to explain complex AI attack chains to engineers, executives, and legal counsel during engagements and remediation debriefs.
Must be eligible to work in the United States without sponsorship.
Ability to travel up to 20% for on-site engagements or client meetings.

Nice To Haves

Hands-on experience building AI systems, including LLM fine-tuning, agentic frameworks such as LangChain or AutoGen, or ML pipelines.
Experience shipping offensive AI tooling, such as prompt-injection harnesses, jailbreak fuzzers, Burp or Caido extensions for LLM traffic, or AI red-team open-source projects.
Public AI security findings, CVEs in AI frameworks or model-serving platforms, AI CTF wins, or conference talks such as at DEF CON's AI Village.
Active participation in AI security challenges such as Gandalf, Crucible, HackAPrompt, or PortSwigger's LLM attack labs.
Working familiarity with MITRE ATLAS, the OWASP Top 10 for LLM Applications, and the NIST AI Risk Management Framework.
Relevant certifications such as OSWE, OSAI, Burp Suite Certified Practitioner, GWAPT, or emerging AI security credentials.

Responsibilities

Run full kill chains against LLMs, agents, RAG pipelines, and related applications, chaining prompt injection, tool abuse, and integration flaws.
Turn suspected model vulnerabilities into reproducible exploits with clear evidence of impact, distinguishing meaningful risk from refusal-bypass noise.
Trace attack paths from initial footholds through tools, credentials, identity, cloud resources, and data to determine potential blast radius.
Exploit tool and function calling, MCP servers, plugins, memory, and multi-agent handoffs, including excessive agency, confused-deputy flaws, and broken trust boundaries.
Attack the AI supply chain, including training and fine-tuning data, embeddings, vector stores, model weights, serialization formats, and MLOps infrastructure.
Review agent frameworks, orchestration logic, and model-serving code for injection paths, unsafe output handling, and insecure design, using AI-assisted analysis.
Use black-box probing, adversarial input generation, model extraction, and membership inference to assess model behavior and data leakage.
Translate AI attack tradecraft into techniques, decision logic, and evaluation data for the company's agents.
Pressure-test the company's models and agents, identify weaknesses or manipulability, and make human-in-the-loop decisions to keep autonomous operations safe and accurate.
Build scripts, harnesses, and tools to automate AI attacks at scale and use AI as a force multiplier in daily work.
Deliver reports and debriefs explaining attack narratives, business risks, and remediation to engineers, executives, and counsel.
Research emerging AI attack classes and incorporate findings into the platform.
Manage concurrent operations and internal research with autonomy while adapting to changing priorities.
Travel up to 20% for on-site engagements or client meetings.