Member of Technical Staff – Security

Alkonos, Inc.; San Francisco (CA); On-site; USD 150,000 - 210,000; Full time

Job summary

Wakefield, a security-focused applied research lab in San Francisco, seeks an experienced security engineer to shape offensive and defensive testing with our agents and ensure customer data safety.

On the offensive side, you will shape attack classes and report bugs; on the defensive side, you will ensure tests stay within approved scopes and prioritize data protection. We sponsor visas and offer meaningful equity along with a competitive salary.

Qualifications

• 2+ years of offensive security, product security or security engineering experience, or equivalent depth from research, CTFs, bug bounties or personal projects
• Experience at a fast-growing startup
• You've found and reported real vulnerabilities in real applications
• You've designed and built security systems, not just audited them
• Strong fundamentals: web application security, identity and access, cloud security, networking
• You use coding agents every day and still understand every line you ship
• You break and build things for fun because you genuinely care about how systems fail

Responsibilities

• Teaching agents new classes of attack: broken access control, business logic, authentication, and privilege escalation across tenants.
• Reproducing hard findings by hand, and writing up the ones that need a person's judgment.
• Scope enforcement: agents touch only approved targets, through one path, with a full record of every request.
• Identity and credentials for agents: short-lived and scoped, so agents never hold raw secrets.
• Defenses against prompt injection and tool misuse from the applications our agents test.
• Our SOC 2 program and the security reviews our customers put us through.

Skills

Offensive security

Security engineering

Product security

Web security fundamentals

Identity and access

Cloud security

Coding agents

Job description

We find and fix every vulnerability in our customers' applications. When a new AI model is released, we run it against their applications before attackers do, and close what it finds.

About Wakefield

Wakefield is an applied research lab working on AI-native security services. We build security agents and publish how they work. Our methods, benchmark and raw data are public so anyone can check them.

• Source code optional: blackbox agents sign in as every role and test the running app. Whitebox agents read the code on every pull request.

• If Wakefield can't prove it, the customer never sees it: agents replay each finding in a real browser and record it. Then Wakefield writes the fix, ready to open as a pull request, and retests it. We have SLAs for zero false positives.

• One service that replaces DAST, SAST, SCA, SBOM, and the tests companies run in-house or buy in.

The role

Security is what we sell, and what we have to get right ourselves. On the offensive side, you'll shape the attacks our agents know how to run and the bugs they report. On the defensive side, you'll keep our agents inside the scope each customer approved and keep customer data safe.

What you'll work on

• Teaching agents new classes of attack: broken access control, business logic, authentication, and privilege escalation across tenants.

• Reproducing hard findings by hand, and writing up the ones that need a person's judgment.

• Scope enforcement: agents touch only approved targets, through one path, with a full record of every request.

• Identity and credentials for agents: short-lived and scoped, so agents never hold raw secrets.

• Defenses against prompt injection and tool misuse from the applications our agents test.

• Our SOC 2 program and the security reviews our customers put us through.

Requirements

• 2+ years of offensive security, product security or security engineering experience, or equivalent depth from research, CTFs, bug bounties or your own projects

• Time at a fast-growing startup

• You've found and reported real vulnerabilities in real applications

• You've designed and built security systems, not just audited them

• Strong fundamentals: web application security, identity and access, cloud security, networking

• You use coding agents every day and still understand every line you ship

• You break and build things for fun because you genuinely care about how systems fail

Nice to have

• Agent or LLM security experience: prompt injection, sandbox escapes, red-teaming models or agents

• Published advisories or CVEs. A CTF or bug bounty background is a plus.

How we hire

1. Meet the co-founders.

2. A one-week paid trial with us in the office.

3. Offer.

Logistics

• Location: San Francisco, in person. Most of the team is in the office every day.

• Compensation: Competitive salary and meaningful equity.

• Visa: We sponsor visas and support you through the immigration process.