Staff AI Security Researcher

Agoda Company Pte. Ltd.; Singapore; On-site; SGD 122,000 - 182,000; Full time

Job summary

Agoda Company Pte. Ltd. seeks a Staff AI Security Researcher in Singapore to lead offensive AI security research, hunt for real vulnerabilities, and foster safe AI usage across products and models. You will set the research agenda, build autonomous agents, and test jailbreaks and data leakage.

You will collaborate with teams to prioritize risks, communicate findings, and drive fixes and guardrails, while contributing CVE-worthy research and governance metrics.

Qualifications

• Bachelor's degree or equivalent practical experience in CS or related field.
• 7+ years of offensive cybersecurity experience including API security testing and red teaming.
• 3+ published CVEs or verified bug-bounty findings leading to fixes.

Responsibilities

• Set AI security research agenda focusing on internet-facing risks.
• Lead vulnerability research from discovery to fixes.
• Build AI-assisted hunting capabilities and playbooks.
• Lead offensive testing of AI systems, including jailbreaks.
• Raise research quality and publish high-impact findings.
• Own guardrail strategy and program metrics.

Skills

Offensive security

AI security

Vulnerability research

CVEs published

Penetration testing

Red teaming

API security testing

Education

Bachelor's degree in Computer Science or related field

Equivalent practical experience

Job description

Staff AI Security Researcher

Singapore

About Agoda

At Agoda, we bridge the world through travel. Our story began in 2005, when two lifelong friends and entrepreneurs, driven by their passion for travel, launched Agoda to make it easier for everyone to explore the world.

Today, we are part of Booking Holdings [NASDAQ: BKNG], with a diverse team of over 7,000 people from 90 countries, working together in offices around the globe. Every day, we connect people to destinations and experiences, with our great deals across our millions of hotels and holiday properties, flights, and experiences worldwide.

No two days are the same at Agoda. Data and technology are at the heart of our culture, fueling our curiosity and innovation. If you're ready to begin your best journey and help build travel for the world, join us.

Get to Know Our Team

The Security Department oversees security, compliance, GRC, and security operations for all Agoda. We are vigilant in ensuring there is no breach or vulnerability threatening our company or endangering our employees in order to keep Agoda safe and protected. This would be a great challenge for those who want to work with the best technology in a dynamic and advanced environment.

The Opportunity

We are hiring a Staff AI Security Researcher with a strong offensive security mindset, published CVEs, and a proven ability to use AI as a hunting tool. This role finds real, exploitable issues before attackers do, with external (internet-facing) attack paths first and internal ones next.

You will set the AI security research agenda, build autonomous agents that hunt and iterate on the fly, and jailbreak AI systems. You will also build the workflows, quality bar, and controls that the rest of the company uses.

The ideal candidate has a deep offensive security background, has already shifted day-to-day work onto AI-assisted hunting, and is comfortable leading that shift across teams.

What You Will Do

• Set the AI security research agenda, prioritizing internet-facing attack paths and high-impact risks across products, models, agents, MCP, and third-party integrations.
• Lead vulnerability research from discovery through proof of concept, impact validation, engineering fixes, and verification.
• Build scalable AI-assisted hunting capabilities, including agents, playbooks, workflows, and standards for validating findings.
• Lead offensive testing of AI systems, APIs, models, and integrations, including prompt injection, jailbreaks, data exfiltration, and supply-chain risks.
• Raise research quality by reviewing findings, coaching researchers, and producing high-impact research, including CVE-quality discoveries.
• Own the AI guardrail strategy and program metrics, including time to verified fix, recurring vulnerability classes, and guardrail bypass rates; verify control effectiveness.
• Influence product, engineering, and senior stakeholders to prioritize risks and deliver fixes; communicate findings through clear briefings, documentation, and research.

What You Will Bring

• Bachelor's degree in Computer Science or a related field, or equivalent practical experience.
• 7+ years of offensive cybersecurity experience, including API security testing, penetration testing, red teaming, or adversarial testing, At least 1 year of AI security experience, with demonstrable examples of testing for jailbreaks, prompt injection, role confusion, data leakage, or safety bypasses.
• Demonstrated vulnerability research impact, evidenced by at least 3 published CVEs or multiple verified bug-bounty findings (e.g., HackerOne) that led to fixes or other security improvements.
• Must have published security research, presented at a conference, or maintained a personal technical blog demonstrating relevant cybersecurity expertise.

It is Great if You Have

• Ability to work with multiple teams, explain risk and impact, and present to different teams and C-level stakeholders.
• Fluent spoken and written English, with the ability to communicate technical findings clearly to both technical and non-technical audiences.
• Experience developing and maintaining production-level code.
• Experience using AI agents to find and exploit bugs, supported by write-ups or proofs of concept showing the model's contribution.
• Experience building autonomous or semi-autonomous hunting workflows using multiple models, tool-calling, or orchestration.
• Hands-on experience assessing the security of MCP-based systems.

Salary and Location

This role is based in Singapore.

Monthly base salary: SGD 10,900-16,300

Equal Opportunity Emplo