Security Engineer

WhyHireWrong?; Województwo mazowieckie; Sur place; PLN 180 000 - 300 000; Plein temps

Résumé du poste

WhyHireWrong? is seeking a senior security professional to identify and exploit attack paths in LLM-based features, build automated testing tooling, and work closely with engineering to remediate findings.

You will strengthen authentication, access control, and data protection across integrations and CI/CD processes. Responsibilities include threat modeling, risk assessments for new features, and supporting customer security reviews.

Qualifications

• 5+ years of experience in offensive security, application security, security engineering or related field.
• Experience attacking or assessing LLM-based systems like prompt injection, red teaming, security tooling, bug bounties, or CVEs.

Responsabilités

• Design and execute red team exercises against LLM-based features.
• Build, configure, fine-tune, and operate open-source models for automated security testing.
• Review code to identify vulnerabilities and implement fixes with engineers.
• Own and improve security controls for authentication, authorization, and data protection.
• Strengthen security across IAM, endpoint, CI/CD, and incident response readiness.
• Conduct threat modeling and risk assessments for new features and integrations.
• Support customer security reviews, audits, and security discussions.
• Track AI security threats and translate into practical testing scenarios.
• Document findings, prioritize remediation by risk, verify fixes work.

Connaissances

Offensive security

Application security

Security engineering

Security testing

Threat modeling

Outils

Open-source LLMs

Agent frameworks

Retrieval-augmented generation

Tool calling

Multi-agent systems

Description du poste

You will identify realistic attack paths, build automated testing and attack tooling, work directly with engineering teams to remediate findings, and help strengthen security across authentication, access control, integrations, CI/CD, and incident readiness.

What You Will Do

• Design and execute red team exercises against LLM-based features, including prompt injection, indirect prompt injection through emails and documents, tool-use abuse, data exfiltration, and multi-step attack chains.
• Build, configure, fine-tune, and operate open-source models to develop automated security testing and adversarial tooling.
• Review application code, identify security vulnerabilities, and implement fixes in collaboration with software engineers.
• Own and improve security controls for authentication, authorization, permissions, third-party integrations, and customer data protection.
• Strengthen organizational security, including identity and access management, endpoint and device security, CI/CD security, and incident response readiness.
• Conduct threat modeling and risk assessments for new features, integrations, and AI-driven workflows.
• Support customer security reviews, questionnaires, audits, and technical discussions related to product and data security.
• Track emerging AI security threats, attack techniques, and defensive practices, translating them into practical controls and testing scenarios.
• Document findings clearly, prioritize remediation based on risk, and verify that fixes are effective.

Requirements:

• 5+ years of experience in offensive security, application security, security engineering, or a closely related field.
• Demonstrated experience attacking or assessing LLM-based systems, such as prompt injection research, AI red teaming, security tooling, published write-ups, CVEs, bug bounty findings, or internal attack-chain work.
• Strong software engineering skills, including the ability to understand unfamiliar codebases, identify vulnerabilities, and ship secure fixes.
• Hands-on experience with open-source LLMs, including running, fine-tuning, or building agents and evaluation tooling.
• Solid understanding of web and API security fundamentals, including authentication, authorization, injection vulnerabilities, session management, and access control.
• Practical experience securing cloud-based systems, developer workflows, CI/CD pipelines, and internal infrastructure.
• Ability to work across product security and organizational security, not only within a single application.
• Strong analytical skills, intellectual honesty, and a collaborative, low-ego working style.
• Fluent English, both written and spoken.

Nice to Have

• Public security research, conference talks, CVEs, bug bounty achievements, or open-source security tools.
• Experience with agent frameworks, retrieval-augmented generation, tool calling, or multi-agent systems.
• Experience supporting customers in regulated or security-sensitive industries.
• Familiarity with security frameworks and standards such as OWASP, NIST, ISO 27001, or SOC 2.
• Experience with purple teaming, detection engineering, or incident response.

Offer

• A senior role with direct influence over AI security strategy, engineering practices, and organizational security.
• The opportunity to work on challenging problems at the intersection of applied AI, offensive security, and product engineering.
• A collaborative environment where security findings lead to real engineering improvements.