Adversary Emulation & AI Security Engineer

Theory Ventures; New York, Northern (NY, KY); Hybrid; USD 180,000 - 220,000; Full time

Job summary

Artemis is building the future of AI-driven defense, helping organizations detect and defend themselves in an era where AI fights AI on the cyber battlefield. Our team includes engineers, AI researchers, and security experts from top tech and security companies, backed by leading investors.

We seek builders to expand our customer base and advance defensive capabilities. Responsibilities span developing scalable emulations, validating detections, researching AI and data-plane attacks, and

Qualifications

• 5+ years of hands-on cybersecurity experience, with substantial offensive security, red teaming, adversary emulation, or security research work; equivalent demonstrated expertise is welcome.
• Strong Python skills and a track record building reusable security tools with APIs, SDKs, Git, code review, and automated testing.
• Deep practical expertise in at least one cloud or identity ecosystem, with an understanding of permissions, service identities, sessions, and data access.
• Practical web/API security knowledge and experience chaining weaknesses across authorization boundaries into meaningful attack paths.
• Experience reproducing attacks in controlled environments and connecting the resulting behavior to audit logs, detection logic, and investigation evidence.
• Experience assessing AI applications or agent workflows, or demonstrated offensive research into these systems.
• Sound judgment in sensitive environments: define scope, anticipate side effects, limit impact, protect data, and verify cleanup.
• Clear communication and the ability to own work from research through implementation, operational use, and verified outcomes.
• Bonus: Experience with Atomic Red Team, MITRE ATT&CK and ATLAS, purple teaming, or continuous security validation.
• Bonus: Experience with SQL, detection-as-code, and cloud, identity, SaaS, or endpoint telemetry.
• Bonus: Hands-on work with MCP servers, RAG systems, model gateways, or repeatable AI evaluations.
• Bonus: Experience assessing data warehouses, object storage, Kubernetes, CI/CD systems, or software supply chains.
• Bonus: Contributions to offensive tooling, emulation frameworks, detection content, or published security research.
• Bonus: Experience building isolated labs and enabling customers to operate security tooling.

Responsibilities

• Build scalable adversary emulation – Develop reusable scenarios and automation that reproduce attacker behaviors and multi-stage attack chains across cloud, identity, endpoint, SaaS, AI, and data environments. Prioritize work using threat intelligence, customer risk, and detection coverage gaps.
• Validate detections end to end – Trace emulated activity through collection, normalization, enrichment, detection, and investigation. Verify expected findings and evidence, identify missed detections and visibility gaps, and distinguish successful prevention from successful detection.
• Research attacks against AI systems – Investigate prompt injection, MCP and tool abuse, retrieval poisoning, excessive agent privileges, and unauthorized actions. Chain weaknesses across applications, agents, and integrations to establish realistic impact and identify detection opportunities.
• Research attacks against data planes – Explore abuse of service identities, integration tokens, permissions, and data access across databases, warehouses, object storage, and AI retrieval systems. Turn access, staging, export, and cross-platform attack paths into repeatable scenarios.
• Reproduce emerging exploits – Assess relevant vulnerability disclosures and exploit research in isolated labs. Establish prerequisites, practical impact, and observable behavior, then translate findings into detection hypotheses and bounded emulations.
• Enable safe testing in customer environments – Build authorized emulations and control checks with clear scope, preflight checks, least-privilege access, execution limits, stop controls, and verified cleanup. Document prerequisites, expected effects, and which scenarios require an isolated lab.
• Build continuous validation – Integrate scenarios with detector tests and engineering workflows. Develop AI evaluation harnesses with attack variations, multi-turn tests, and benign controls, measuring outcomes as models, tools, permissions, and detections change.
• Turn research into defensive improvements – Contribute detections, hunt logic, telemetry requirements, and regression tests. Partner with engineering and customer owners to drive findings through remediation and retesting, verifying fixes against malicious and benign behavior.
• Partner with the SOC and customers – Run purple-team exercises, explain findings and limitations, and give analysts the evidence and guidance needed to investigate emulated behaviors. Use AI to accelerate research and tooling while independently verifying generated actions and conclusions.

Skills

Cybersecurity experience

Python

Cloud / IAM

Web/API security

Attack replication

AI security

Communication

Research

Tools

APIs

SDKs

Git

Job description

Artemis is building the future of AI-driven defense, helping organizations detect and defend themselves in an era where AI fights AI on the cyber battlefield. Our team includes engineers, AI researchers, and security experts from top tech and security companies, backed by leading investors.

We seek builders to expand our customer base and advance defensive capabilities. Responsibilities span developing scalable emulations, validating detections, researching AI and data-plane attacks, and