Offensive Security Engineer: Build AI-Powered PenTest Agents

Parameter ai; San Francisco (CA); Sur place; USD 180 000 - 250 000; Plein temps

Résumé du poste

Parameter builds AI agents that do offensive security work. Our agents run autonomous penetration tests against production applications and cloud environments, finding IDORs, broken access control, XSS, and infrastructure misconfigurations that scanners miss and that human pentest firms only look for once or twice a year.

We are not a theoretical security company. Our team has responsibly disclosed real, high-severity vulnerabilities to well-known technology companies, and our findings are the

Qualifications

• 3+ years of hands-on offensive security (web app pentesting, red teaming, or bug bounty).
• Deep knowledge of web vulnerabilities, access control, authentication, and business logic flaws.
• Cloud security experience across AWS or GCP; IAM and misconfiguration.
• Ability to write code and build tooling; TypeScript shop, but value is building.
• Strong written communication for engineers and executives.
• Bonus: OSCP, OSWE, CVEs, bug bounty podiums, or talks.

Responsabilités

• Run manual penetration tests against customer web applications, APIs, and cloud infrastructure.
• Translate your methodology into agent capabilities: new attack modules, detection logic, and verification steps.
• Validate and triage agent findings before they reach customers. You are the quality bar.
• Lead the technical side of customer engagements, including scoping calls and findings walkthroughs.
• Contribute to our vulnerability research and responsible disclosure work, a core part of our market approach.

Connaissances

Offensive security

Web app pentesting

Red teaming

Coding / tooling

Technical writing

Outils

AWS

GCP

TypeScript

Description du poste

Parameter builds AI agents that do offensive security work. Our agents run autonomous penetration tests against production applications and cloud environments, finding IDORs, broken access control, XSS, and infrastructure misconfigurations that scanners miss and that human pentest firms only look for once or twice a year.

We are not a theoretical security company. Our team has responsibly disclosed real, high-severity vulnerabilities to well-known technology companies, and our findings are the