Offensive security engineer in cloud infrastructure

Nebius; United States; Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Гибкий удаленный режим

Доля в капитале/акции

Карьерный рост и обучение

Job summary

Nebius Group ищет инженера по Offensive Security для дизайна и проведения adversarial simulations на нашей облачной платформе. Вы будете атаковать инфраструктуру, связанную с данными и инференсом, и превращать выводы в измеримые улучшения безопасности.

Требуется 6+ лет опыта в секьюрити, владение Python/Go и умение писать отчеты с бизнес-контекстом. Гибкая удалённая культура и возможность работать в международной команде.

Qualifications

• Очевидный опыт не менее 6 лет в offensive security: тестирование на проникновение, red-teaming или моделировании угроз.
• Глубокий опыт атак на облачные окружения Kubernetes, IAM и виртуализацию/контейнеризацию.
• Сильные навыки по жизненному циклу атаки: начальный доступ, устойчивость, перемещение по сети, выкачка данных.
• Умение писать инструментальные средства и постэксплоитационные возможности (Python, Go и т.п.).
• Опыт проведения purple-team упражнений и тесного взаимодействия с blue-командами.
• Умение представлять риски бизнес-контекстом в отчетах для инженеров и руководства.

Responsibilities

• Проводить и расширять Secure SDLC threat models через постоянное тестирование на проникновение.
• Автоматизировать рутинные проверки и ограничиться ручными анализами для сложных случаев.
• Планировать и выполнять red team-ограничения против Nebius облачной платформы: вычисления, хранение, инференс и управление сетями.
• Определять угрозы, влияющие на операции организации, и работать с Detection & Response.
• Проводить purple-team упражнения, оценивать покрытие обнаружения и закрывать пробелы совместно.
• Исследовать новые атаки против GPU-инфраструктуры и стека инференса; оценивать безопасность платформы.
• Оценивать границы tenant-изоляции и тестировать их на низкоуровневом стеке.
• Проводить целевые оценки новых продуктов и изменений до их выпуска.
• Готовить понятные отчеты с приоритетными выводами и рекомендациями для руководства и инженеров.
• Устанавливать процессы red team, инструменты и масштабируемую методологию.

Skills

Offensive security

Penetration testing

Red team

Cloud-native environments

Purple team

Технический доклад

Tools

Python

Go

Job description

Описание

Nebius is leading a new era in cloud infrastructure for the global AI economy. We’re building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. We’re hiring an Offensive Security Engineer to join us at Nebius. You'll design and execute adversarial simulation across our cloud platform - attacking the same infrastructure our customers depend on - and translate findings into measurable security improvements.

Задачи

Validate and extend early-stage Secure SDLC threat models via continuous penetration testing, assessing threat severity and mitigation status while challenging assumptions made during threat modeling and system development. Automate routine validations to keep pace with increasing feature flow, reserving manual analysis for genuinely complex cases. Plan and execute full-scoped red team engagements against Nebius cloud platform - including compute, storage, inference, networking, orchestration layers, and internal tooling. Identify threats, which are able to impact an organization’s operations. Work closely with Detection & Response and other security engineering teams to run purple team exercises, validate detection coverage, and close gaps collaboratively. Research novel attacks against GPU infrastructure (e.g., closed-source firmware and vendor driver binaries, device passthrough exploits, SR-IOV/IOMMU misconfigurations, RDMA/InfiniBand fabric attacks, etc.), the inference stack (e.g., vLLM, TRT-LLM), and AI platform managed services (e.g., managed Slurm). Assess tenant-isolation boundaries and how they can be broken at the low-level stack Conduct targeted assessments of new products and infrastructure changes before they ship. Deliver clear, actionable reports for both technical audiences and leadership - with prioritized findings and remediation guidance. Establish red team processes, tooling, and a methodology that scales as the platform grows.

Требования

• 6+ years in offensive security - penetration testing, red teaming, or adversary simulation
• Deep experience attacking cloud-native environments: Kubernetes privilege escalation, cloud IAM abuse, virtualization and container escapes.
• Strong fundamentals across the attack lifecycle: initial access, persistence, lateral movement, data exfiltration.
• Proficiency developing custom tooling and post-exploitation capabilities (Python, Go, or similar).
• Experience running purple team exercises and working constructively with blue teams.
• Ability to write clear, senior-level reports with business-contextualized risk (not just raw findings) that engineers can easily use.
• Будет плюсом: Experience attacking ML infrastructure, model serving pipelines, or GPU clusters; Reverse engineering and exploits development experience; Application security experience; Familiarity with eBPF bypass techniques or kernel-level exploitation; Background in vulnerability research or CVE discovery; Experience with cloud provider internals (hypervisor/networking layers); Presenting your security research at conferences like BlackHat/DefCon, etc

Условия

Attack surface that’s genuinely novel - GPU clusters, AI platforms, multi-tenant cloud at scale. Work alongside world-class engineers on infrastructure that powers frontier AI. Competitive compensation with equity upside in a Nasdaq-listed, high-growth company. Flexible, remote-first culture Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI