Principal GenAI Security Research Engineer

Elastic; United States; On-site; USD 160,000 - 253,000; Full time

Benefits offered by this job

Health coverage for you and family

Flexible locations and schedules

Generous vacation days

Volunteer time off

Parental leave

Job summary

Elastic, the Search AI Company, is seeking a Principal Security Research Engineer to shape detection capabilities within the TRaDE team and strengthen security across AI-enabled products. You will work hands-on in detection engineering and threat research, focusing on AI security and rigorous testing.

You will apply penetration testing, red-team techniques, and LLM tooling to validate detections, triage findings, and communicate risks clearly to diverse audiences.

Qualifications

• Experience running pen tests or vulnerability assessments on web apps or APIs.
• Knowledge of OWASP Top 10 and MITRE ATLAS or related frameworks.
• Ability to triage findings and clearly communicate risks to technical and non-technical audiences.
• Hands-on experience using LLM tools for security testing, research, or daily tasks.

Responsibilities

• Design and run security tests for GenAI, agentic systems, and LLM-backed products.
• Investigate new multi-domain threat vectors and translate into protections (e.g., detection rules).
• Create and present findings to enhance team knowledge and community awareness.
• Apply AI-assisted techniques to expand coverage and accelerate validation of threat research and detections.

Skills

Penetration testing

Red Team operations

OWASP Top 10

LLM security testing

LLM tooling

AI/ML frameworks

Distributed teams

Threat detection

Detection engineering

Tools

Garak

PyRIT

PromptBench

Inspect AI

Job description

Elastic, the Search AI Company, is seeking a Principal Security Research Engineer to shape detection capabilities within the TRaDE team and strengthen security across AI-enabled products. You will work hands-on in detection engineering and threat research, focusing on AI security and rigorous testing.

You will apply penetration testing, red-team techniques, and LLM tooling to validate detections, triage findings, and communicate risks clearly to diverse audiences.