GenAI & LLM Security Penetration Lead

International Turnkey Systems - ITS; Kuwait City; On-site; KWD 20,000 - 33,000; Full time

Job summary

International Turnkey Systems - ITS in Kuwait seeks an AI Penetration Tester to join the VMPT team and lead hands-on security testing for LLM/GenAI, ML, and AI-enabled applications such as chatbots, RAG, AI agents, and model APIs.

The role blends traditional penetration testing with secure code review and vulnerability assessment, focusing on prompt injection and insecure output handling per OWASP Top 10 for LLM applications.

Qualifications

• Bachelor’s degree in computer science, cybersecurity, software engineering, or related field.
• 3–7 years in penetration testing / application security / red teaming.
• Experience testing LLM/GenAI systems (prompt injection, jailbreaks, data exfiltration).
• Strong Python for security automation and test harness development.
• Practical experience with Azure security concepts (identity, networking, secrets, logging).
• Strong report writing and remediation communication.

Responsibilities

• Plan and execute AI penetration tests for LLM/GenAI and ML solutions across the bank.
• Design tests aligned to OWASP Top 10 for LLM Applications (prompt injection, insecure output handling).
• Perform adversarial testing using threat-informed techniques (MITRE ATLAS).
• Validate security of agentic workflows and ensure least privilege.

Skills

Penetration testing

Secure code review

Threat modeling

Adversarial testing

Education

Bachelor’s degree in Computer Science / Cybersecurity / Software Engineering

Tools

Python

Git

CI/CD

Azure security concepts

Azure OpenAI / Foundry deployments

Job description

International Turnkey Systems - ITS in Kuwait seeks an AI Penetration Tester to join the VMPT team and lead hands-on security testing for LLM/GenAI, ML, and AI-enabled applications such as chatbots, RAG, AI agents, and model APIs.

The role blends traditional penetration testing with secure code review and vulnerability assessment, focusing on prompt injection and insecure output handling per OWASP Top 10 for LLM applications.