GenAI Security Evaluation Engineer

HumanitApp; United States; Remote; USD 170,000 - 243,000; Full time

Job summary

Turing, based in San Francisco, is seeking experienced GenAI Security Engineers to create and evaluate security tasks for GenAI applications. You will source or build GenAI apps, craft vulnerable and patched versions, document findings with precise code references, and write tests to validate each vulnerability and its remediation.

Role requires 3+ years in security fields; senior roles expect 5+ years and leadership experience.

Qualifications

• 3+ years in application or product security, secure code review, penetration testing, or vulnerability research.
• For senior reviewers: 5+ years of experience, including leading code reviews.
• Strong data-flow reasoning across files, callbacks, registries, and background jobs.
• Strong authorization knowledge, including authentication, authorization, least privilege, tenant isolation, trust boundaries, and approval flows.
• Knowledge of the OWASP Top 10 for LLM Applications, especially LLM02 and LLM03.
• Ability to map findings to CWEs such as CWE-200/201, CWE-532, CWE-284/285/862/863, CWE-250/269.
• Experience writing exploit and reproduction tests that distinguish vulnerable behavior from patched behavior.
• Experience using CodeQL or Semgrep, SARIF, and understanding limitations of scanners.
• Hands-on experience with LLM tool calling, agents, MCP, RAG, memory, tracing; familiarity with LangChain, LlamaIndex, OpenAI/Anthropic SDKs, OpenTelemetry.
• Production coding experience with Docker, Git, reading security patches, and clear technical English.

Responsibilities

• Source or build GenAI applications, including agent and RAG systems.
• Create vulnerable versions and patched counterparts.
• Document findings with exact code line spans, traps, control status, and recommendations.
• Trace data and action flows across files, callbacks, registries, and background jobs; explain when and why a control misses a route.
• Define authorization contexts, including actors, trust boundaries, tenants, permitted data and actions, purposes, recipients, and document-level access.
• Write per-mechanism exploit and reproduction tests that demonstrate the weakness and verify the patch prevents it.
• Demonstrate the relevant model path using a live model when possible.

Skills

GenAI security

Security testing

Threat modeling

Code review

Education

Bachelor's in CS or related field

Tools

CodeQL

Semgrep

LangChain

OpenAI SDK

Job description

Future projects, not immediate vacancies. Check each network's country and experience requirements.

Create and evaluate security tasks for GenAI applications and vulnerabilities.

About Turing

Based in San Francisco, California, Turing is the world’s leading research accelerator for frontier AI labs and a trusted partner for global enterprises deploying advanced AI systems. Turing supports customers in two ways: first, by accelerating frontier research with high-quality data, advanced training pipelines, plus top AI researchers who specialize in coding, reasoning, STEM, multilinguality, multimodality, and agents; and second, by applying that expertise to help enterprises transform AI from proof of concept into proprietary intelligence with systems that perform reliably, deliver measurable impact, and drive lasting results on the P&L.

Required commitment: At least 4 hours per day, minimum 20 hours per week, with 4 hours of overlap with Pacific Time.

Engagement type: Contractor

Engagement length: Up to 2 weeks

About the Role

We’re looking for experienced GenAI Security Engineers to create and evaluate security tasks for GenAI applications.

As a Security Task Engineer, you’ll source or build GenAI applications, create vulnerable and patched versions, document security findings, and write tests for each vulnerability mechanism. Where possible, you’ll also demonstrate the relevant behavior using a live model.

What You’ll Do

Source or build GenAI applications, including agent and RAG systems.

Create vulnerable versions and patched counterparts.

Document findings with exact code line spans, traps, control status, and recommendations.

Trace data and action flows across files, callbacks, registries, and background jobs; explain when and why a control misses a route.

Define authorization contexts, including actors, trust boundaries, tenants, permitted data and actions, purposes, recipients, and document-level access.

Write per-mechanism exploit and reproduction tests that demonstrate the weakness in the vulnerable version and confirm the patch prevents it.

Demonstrate the relevant model path using a live model when possible.

What We’re Looking For

3+ years in application or product security, secure code review, penetration testing, or vulnerability research.

For senior reviewers: 5+ years of experience, including leading code reviews.

Strong data-flow reasoning and the ability to trace a source to a sink across files, callbacks, registries, and background jobs.

Strong authorization knowledge, including authentication, authorization, least privilege, tenant isolation, trust boundaries, and approval flows.

Knowledge of the OWASP Top 10 for LLM Applications, especially LLM02 Sensitive Information Disclosure and LLM03 Excessive Agency. Familiarity with prompt injection and tool abuse.

Ability to map findings to relevant CWEs, such as CWE-200/201 for exposure, CWE-532 for sensitive data in logs, CWE-284/285/862/863 for access control, and CWE-250/269 for excessive privilege.

Experience writing exploit and reproduction tests that distinguish vulnerable behavior from patched behavior.

Experience using CodeQL or Semgrep, reading SARIF, and understanding why pattern-based scanners can miss logic and authorization flaws.

Hands-on experience with LLM tool calling, agents, MCP, RAG, memory, and tracing, using tools such as LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and OpenTelemetry.

Production coding experience and engineering fundamentals, including Docker, Git, reading upstream security patches and commit history, and clear technical English.

Nice to Have

SWE, OSCP, GWAPT, CSSLP, or similar credentials.

CVE credits, bug bounty experience, or published security research.

Experience with AI red teaming or LLM evaluation.

Source: Turing official job description, checked 2026-11-09. Turing decides selection and final terms. Referral rewards are separate from applicant compensation.

Compensation context

Compensation is not stated in the current feed. Confirm the rate and workload before accepting an assessment or project.

• Ability to map findings to relevant CWEs, such as CWE-200/201 for exposure, CWE-532 for sensitive data in logs, CWE-284/285/862/863 for access control, and CWE-250/269 for excessive privilege.

Pay up to $150/hr depending on internal evaluation and location.

Remote · Country eligibility: check the official listing · Work type not specified

Remote - location not specified · Contract

Remote - location not specified · Contractor

Remote - location not specified · Contractor