Remote Red Team Security Engineer (AI-Driven)

WebHosting; Colombia; Remote; COP 411,327,000 - 632,811,000; Full time

Job summary

Backblaze is seeking a Red Team Security Engineer to continuously validate whether vulnerabilities, configurations, identities, and AI-enabled systems can be exploited by realistic adversaries. The role blends traditional offensive security with AI-assisted adversary emulation to validate exposure and improve defensive controls.

Key responsibilities include emulating attackers, mapping attack paths across web apps, APIs, cloud, and identity systems, and testing AI applications for prompt

Responsibilities

• Emulate external attackers, malicious insiders, compromised identities, and autonomous adversarial agents.
• Validate whether vulnerabilities and configuration weaknesses identified are reachable and practically exploitable.
• Develop and execute realistic attack paths across web applications, APIs, cloud infrastructure, identity systems, endpoints, and other enterprise services.
• Use AI-assisted and agentic techniques for reconnaissance, vulnerability analysis, attack-path discovery, and controlled offensive testing.
• Test AI applications and agents for prompt injection, tool abuse, excessive privilege, identity compromise, and other emerging attack classes.
• Validate compensating controls and mitigations before or after deployment.
• Conduct purple-team exercises with Security Analytics and Security Operations to validate telemetry, detection, and response effectiveness.
• Translate offensive findings into actionable improvements to architecture, configuration, detections, and response capabilities.

Job description

Backblaze is seeking a Red Team Security Engineer to continuously validate whether vulnerabilities, configurations, identities, and AI-enabled systems can be exploited by realistic adversaries. The role blends traditional offensive security with AI-assisted adversary emulation to validate exposure and improve defensive controls.

Key responsibilities include emulating attackers, mapping attack paths across web apps, APIs, cloud, and identity systems, and testing AI applications for prompt