GenAI Security Engineer: Vulnerability Testing

HumanitApp; United States; Remote; USD 170,000 - 243,000; Full time

Job summary

Turing, based in San Francisco, is seeking experienced GenAI Security Engineers to create and evaluate security tasks for GenAI applications. You will source or build GenAI apps, craft vulnerable and patched versions, document findings with precise code references, and write tests to validate each vulnerability and its remediation.

Role requires 3+ years in security fields; senior roles expect 5+ years and leadership experience.

Qualifications

• 3+ years in application or product security, secure code review, penetration testing, or vulnerability research.
• For senior reviewers: 5+ years of experience, including leading code reviews.
• Strong data-flow reasoning across files, callbacks, registries, and background jobs.
• Strong authorization knowledge, including authentication, authorization, least privilege, tenant isolation, trust boundaries, and approval flows.
• Knowledge of the OWASP Top 10 for LLM Applications, especially LLM02 and LLM03.
• Ability to map findings to CWEs such as CWE-200/201, CWE-532, CWE-284/285/862/863, CWE-250/269.
• Experience writing exploit and reproduction tests that distinguish vulnerable behavior from patched behavior.
• Experience using CodeQL or Semgrep, SARIF, and understanding limitations of scanners.
• Hands-on experience with LLM tool calling, agents, MCP, RAG, memory, tracing; familiarity with LangChain, LlamaIndex, OpenAI/Anthropic SDKs, OpenTelemetry.
• Production coding experience with Docker, Git, reading security patches, and clear technical English.

Responsibilities

• Source or build GenAI applications, including agent and RAG systems.
• Create vulnerable versions and patched counterparts.
• Document findings with exact code line spans, traps, control status, and recommendations.
• Trace data and action flows across files, callbacks, registries, and background jobs; explain when and why a control misses a route.
• Define authorization contexts, including actors, trust boundaries, tenants, permitted data and actions, purposes, recipients, and document-level access.
• Write per-mechanism exploit and reproduction tests that demonstrate the weakness and verify the patch prevents it.
• Demonstrate the relevant model path using a live model when possible.

Skills

GenAI security

Security testing

Threat modeling

Code review

Education

Bachelor's in CS or related field

Tools

CodeQL

Semgrep

LangChain

OpenAI SDK

Job description

Turing, based in San Francisco, is seeking experienced GenAI Security Engineers to create and evaluate security tasks for GenAI applications. You will source or build GenAI apps, craft vulnerable and patched versions, document findings with precise code references, and write tests to validate each vulnerability and its remediation.

Role requires 3+ years in security fields; senior roles expect 5+ years and leadership experience.