Senior AI Security Researcher

Agoda Company Pte. Ltd.; Singapore; On-site; SGD 102,000 - 153,000; Full time

Job summary

Agoda is seeking a Senior AI Security Researcher based in Singapore to lead offensive security initiatives around AI systems. You will identify exploitable vulnerabilities, publish CVEs, and drive security improvements across AI products and infrastructure.

You will build autonomous agents that research and test on the fly, develop guardrails, and collaborate with product and engineering teams to turn findings into practical mitigations.

Qualifications

• 4+ years in offensive security including API testing and red teaming.
• At least one published CVE or verified bug bounty finding.
• Published security research or equivalent demonstration (blog/conference).

Responsibilities

• Identify and exploit vulnerabilities in internet-facing and internal systems with PoCs.
• Perform offensive security testing of AI products and infrastructure, including jailbreaks.
• Develop AI-assisted security research workflows and automation.
• Document findings and communicate risk to stakeholders.

Skills

Offensive security

API security testing

Penetration testing

Red teaming

Vulnerability research

Education

Bachelor's degree or equivalent

Tools

HackerOne

CVEs databases

AI research tooling

Job description

Senior AI Security Researcher

Singapore

About Agoda

At Agoda, we bridge the world through travel. Our story began in 2005, when two lifelong friends and entrepreneurs, driven by their passion for travel, launched Agoda to make it easier for everyone to explore the world.

Today, we are part of Booking Holdings [NASDAQ: BKNG], with a diverse team of over 7,000 people from 90 countries, working together in offices around the globe. Every day, we connect people to destinations and experiences, with our great deals across our millions of hotels and holiday properties, flights, and experiences worldwide.

No two days are the same at Agoda. Data and technology are at the heart of our culture, fueling our curiosity and innovation. If you're ready to begin your best journey and help build travel for the world, join us.

Get to Know Our Team

The Security Department oversees security, compliance, GRC, and security operations for all Agoda. We are vigilant in ensuring there is no breach or vulnerability threatening our company or endangering our employees in order to keep Agoda safe and protected. This would be a great challenge for those who want to work with the best technology in a dynamic and advanced environment.

The Opportunity

We are looking for an AI Security Researcher with a strong offensive security mindset, published CVEs, and the ability to use AI as a hacking tool. The core of this role is finding real exploitable issues before attackers do, prioritizing external (internet-facing) exploits, then internal ones.

You will build autonomous agents that research and hack on the fly by interacting with AI, and you will jailbreak AI systems.

The ideal candidate has a strong offensive security background, has already shifted to using AI to find bugs, and is already hands-on and comfortable working this way.

What You Will Do

• Proactively identify and exploit vulnerabilities in internet-facing and internal systems, delivering working proofs of concept, clear impact assessments, and actionable findings.
• Conduct offensive security testing of AI products and infrastructure, including jailbreaks, prompt injection, model evasion, data exfiltration, API abuse, and MCP, plugin, and tool-calling integrations.
• Build and automate AI-assisted security research workflows and agents that use models, APIs, and tools to continuously discover and validate vulnerabilities.
• Research weaknesses in models and surrounding infrastructure, producing high-quality findings, including CVE-ready research where appropriate.
• Design, implement, and evaluate guardrails and other defensive controls-such as filtering, policy enforcement, monitoring, and anomaly detection-to reduce AI security risks.
• Partner with product and engineering teams to turn findings into practical requirements, fixes, and mitigations.
• Document and communicate technical findings, risk, and impact to cross-functional teams and senior stakeholders; share emerging AI attack and defense techniques.

What You Will Bring

• Bachelor's degree in computer science or a related field, or equivalent practical experience.
• 4+ years of offensive security experience, including API security testing, penetration testing, red teaming, or adversarial testing.
• At least one published CVE(s) or verified HackerOne bug-bounty finding.
• Must have published security research, presented at a conference, or maintained a personal technical blog demonstrating relevant cybersecurity expertise.

It is Great if You Have

• At least 1 year of hands-on AI security testing experience, including jailbreaks, prompt injection, role confusion, data leakage, or safety bypasses.
• Examples of using AI models or agents to discover or exploit vulnerabilities.
• Experience building autonomous agents that interact with AI to attack or test systems on the fly.
• Already using AI in day-to-day offensive work to find bugs, and comfortable with that shift.
• Ability to collaborate across teams and communicate risk and impact to technical and non-technical stakeholders, including senior leaders.
• Fluent spoken and written English, with the ability to explain technical findings clearly to diverse audiences.
• Experience developing and maintaining production-quality code.

Salary and Location

This role is based in Singapore.

Monthly base salary: SGD 9,100-13,700

Equal Opportunity Employer

At Agoda, we pride ourselves on being a company represented by people of all different backgrounds and orientations. We prioritize attracting diverse talent and cultivating an inclusive environment that encourages c