AI Red Team Engineer

ByLabs; Seattle (WA); On-site; USD 140,000 - 190,000; Full time

Job summary

ByLabs seeks a skilled Red Team Security Engineer to join our SOC. You will simulate adversary TTPs, including APT-level attacks, to validate detection and response while researching AI/LLM security risks.

You will work with blue teams, threat intel, and security engineering to improve our defensive posture. You will design end-to-end red team operations, replicate APT TTPs, and develop offensive tools and evasion techniques.

Qualifications

• 3+ years of hands-on red team or penetration testing experience.
• Proficiency with at least one mainstream C2 framework (e.g., Cobalt Strike, Sliver).
• Strong web application exploitation fundamentals (OWASP Top 10).
• Ability to map TTPs to MITRE ATT&CK techniques and design corresponding tests.
• Experience with LLM security, RAG/Agent/MCP architectures, and threat surfaces.
• Hands-on experience with Prompt Injection, jailbreaking, or model extraction attacks.
• Familiarity with MITRE ATLAS and AI/ML threat classification.
• Red team certifications such as OSCP, CRTO, CRTE (preferred).
• Web3/blockchain security background and on-chain attack analysis (preferred).
• CTF participation or published vulnerability research (preferred).

Responsibilities

• Design and execute end-to-end red team ops covering reconnaissance to data exfiltration.
• Replicate APT TTPs to validate detection and incident response capabilities.
• Develop offensive tools, C2 frameworks, and evasion techniques.
• Contribute to BAS playbooks across Windows, macOS, Linux.
• Research AI/LLM attack surfaces: prompt injection, model poisoning, adversarial examples.
• Evaluate AI/LLM security risks in applications and provide findings.
• Track AI security research and produce internal threat intelligence.
• Collaborate with blue team to translate findings into detections.
• Produce high-quality red team reports with remediation guidance.

Skills

Penetration testing

C2 frameworks

Web exploitation

MITRE ATT&CK mapping

LLM security

Prompt Injection

Model extraction

MITRE ATLAS

Red team certs

CTF experience

Job description

We are looking for a skilled Red Team Security Engineer to join our SOC team. You will simulate real-world adversary TTPs — including APT-level attacks — to validate our detection and response capabilities, while also conducting cutting-edge research into AI/LLM security risks. You will work closely with the blue team, threat intelligence, and security engineering to continuously strengthen our defensive posture.

Key Responsibilities

• Design and execute end-to-end red team operations covering the full attack chain: reconnaissance, initial access, lateral movement, privilege escalation, and data exfiltration
• Replicate APT group TTPs (e.g., Lazarus, APT41) to validate detection and incident response capabilities
• Develop and maintain custom offensive tools, C2 frameworks, and evasion techniques to simulate advanced threats
• Participate in BAS (Breach and Attack Simulation) playbook design and execution across Windows, macOS, and Linux platforms
• Research AI/LLM attack surfaces: Prompt Injection, model poisoning, adversarial examples, training data contamination, and AI Agent security risks
• Evaluate security risks in AI/LLM applications (RAG, MCP, Tool Use, Agentic workflows) and provide red team findings
• Track AI security research (MITRE ATLAS, OWASP LLM Top 10) and produce internal threat intelligence
• Collaborate with the blue team to translate red team findings into detection rules and defensive hardening
• Produce high-quality red team reports with actionable remediation recommendations

Major Requirements

• 3+ years of hands-on penetration testing or red team experience
• Proficiency with at least one mainstream C2 framework (Cobalt Strike, Sliver, Havoc, etc.)
• Strong vulnerability exploitation fundamentals: web (OWASP Top 10), internal network (AD attack chains), cloud environments
• Familiar with MITRE ATT&CK framework; able to map TTPs and design corresponding attack scenarios
• Understanding of LLM application architectures (RAG, Agent, MCP, Tool Use) and ability to identify attack surfaces
• Hands-on research or PoC experience with Prompt Injection, jailbreaking, or model extraction attacks
• Familiar with MITRE ATLAS framework and AI/ML threat classification
• (Preferred) Holds at least one major red team certification: OSCP, CRTO, CRTE
• (Preferred) Web3 / blockchain security background (smart contract audits, on-chain attack analysis)
• (Preferred) CTF experience (DEFCON CTF, GeekCon, etc.) or published vulnerability research (CVE, conference talks, technical blog)