Offensive AI Security Engineer (Remote)

OpenKrill; United States; Remote; USD 225,000 - 300,000; Full time

Benefits offered by this job

Best-in-class benefits

Remote-friendly company

Office in Williamsburg, NY

Job summary

The Browser Company is seeking a Staff Security Researcher to advance offensive security for Dia, a browser project. You will probe the client, agent runtime, and services, prioritizing prompt injection, exfiltration, and bypass techniques.

You will model threats, build automated discovery, and collaborate with engineers to raise the bar for security across our codebase and infrastructure. This role requires 8+ years in security and strong coding skills in Go, TypeScript, Python, or Swift, and a

Qualifications

• 8+ years in offensive security — vulnerability research, exploit development, red teaming, or product security testing — with a record of finding real bugs in software other people had already reviewed.
• Depth in at least one hard surface: LLM agent systems, browser or Chromium internals, OS sandboxing and native clients, or backend and cloud infrastructure — and the excitement to learn the rest.
• Practical fluency using LLMs as instruments, not just as targets, plus a working sense of when their output is noise.
• You write production-quality code in one or more of Go, TypeScript, Python, or Swift. You'd rather build the thing that finds a bug a thousand times than find it once.
• You write findings engineers act on, and you can stay in the fix conversation and push for the durable version without owning the remediation yourself.
• You thrive in a high-trust, high-ambiguity environment: you seek feedback, but you don't need hand-holding.
• You resonate with our company values https://thebrowser.company/values/.
• We're primarily focused on hiring in North American time zones and require that folks have 4+ hours of overlap time with team members in Eastern Time Zone.

Responsibilities

• Run original offensive research against Dia, its agent, and backend services, focusing on prompt injection and indirect exfiltration, tool-call abuse, permission and provenance bypass, sandbox escape, cross-profile data access, quota and abuse-scoring bypass.
• Threat model new surface areas with the teams building them, and review features before they ship, identifying what is exploitable, what it costs an attacker, and what would have to be true to launch.
• Design and build automated vulnerability discovery including model-driven code and infrastructure scanning, fuzzing harnesses, and agentic hunting pipelines that keep working after the engagement ends.
• Eliminate entire classes of bugs in collaboration with the engineers who own the fix, then make the same issue structurally hard to reintroduce through an enforced invariant, a fail-closed default, a test, a lint, or a platform change.
• Set the standard for what \"security tested\" means before a feature ships, and raise the ceiling on what the whole team can find.
• Continuous AI-assisted vulnerability discovery (first project). You'll survey commercial scanning services, frontier models, open-source security models, and stand up a working mix against our codebase, our infrastructure, and the agent runtime.
• Agent red teaming. Plan and run regular AI-assisted red team exercises against Dia and our infrastructure, and build the attack corpus and harness that make each round cheaper than the last.
• Pre-launch review as a practice. New tools and integrations, agent capabilities, enterprise controls, platform expansion. Enhanced with platforms to assist with testing
• Structural fixes that eliminate classes of vulnerability. Define, with the product engineers, the changes that take a whole bug class off the table instead of fixing the same issue one report at a time.
• Future tools and systems. The state of the art in vulnerability hunting is evolving faster than it ever has. We expect this person to track it and keep BCNY best in class, which means therea re opportunities to build far beyond the scope described above.

Skills

Offensive security

Vulnerability research

Red teaming

Go/TypeScript/Python/Swift

LLM tooling

Job description

The Browser Company is seeking a Staff Security Researcher to advance offensive security for Dia, a browser project. You will probe the client, agent runtime, and services, prioritizing prompt injection, exfiltration, and bypass techniques.

You will model threats, build automated discovery, and collaborate with engineers to raise the bar for security across our codebase and infrastructure. This role requires 8+ years in security and strong coding skills in Go, TypeScript, Python, or Swift, and a