Security Researcher, Codex Security

Rozgoo; San Francisco (CA); On-site; USD 180,000 - 260,000; Full time

Job summary

OpenAI in San Francisco is seeking a security lead to map, characterize, and prioritize cross-layer vulnerabilities in advanced AI systems—from data pipelines to training runtimes and supply chains. You will drive offensive research, produce technical deliverables, and help expand the Codex Security product line in collaboration with external partners.

You will thrive if you have strong vulnerability research experience, can operate independently, and communicate clearly with experts and

Qualifications

• Experience in vulnerability research, exploit development, or offensive security.
• Deep experience with cutting edge offensive-security techniques.
• Fluent across AI/ML infrastructure and threat-model end-to-end.
• Operate independently, align diverse teams, and deliver on tight timelines.
• Communicate clearly with experts and decision-makers.
• Care deeply about improving security of widely used software and open-source infrastructure.

Responsibilities

• Conduct deep security research to discover vulnerabilities across large codebases and distributed architectures.
• Investigate and validate vulnerabilities discovered by AI-driven security agents, including proofs-of-concept and exploit demonstrations.
• Partner with engineering teams to improve automated vulnerability discovery, validation, and remediation workflows.
• Build high quality security datasets and evals to advance model cybersecurity capabilities; train AI models for vulnerability discovery and remediation.
• Publish technical writeups and vulnerability analyses that advance the state of application security.

Skills

Vulnerability research

Exploit development

Offensive security

AI/ML security

Threat modeling

Technical communication

Job description

About the Team:

Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. Codex Security is OpenAI’s first security agent, built to scan GitHub Cloud repositories, validate real vulnerabilities, and integrate with Codex to help generate fixes.

About the Role:

Lead an effort to map, characterize, and prioritize cross-layer vulnerabilities in advanced AI systems – spanning data pipelines, training/inference runtimes, system and supply chain components. You’ll drive offensive research, produce technical deliverables, enhance the Codex Security product line, and serve as OpenAI’s primary technical counterpart for select external partners (including potential U.S. government stakeholders).

What you’ll do:

• Conduct deep security research on real‑world software systems to discover complex vulnerabilities across large codebases and distributed architectures.
• Investigate and validate vulnerabilities discovered by AI‑driven security agents, including building proofs‑of‑concept and exploit demonstrations.
• Partner with engineering teams to improve automated vulnerability discovery, validation, and remediation workflows as part of product development.
• Build high quality security datasets and evals that will help advance model’s cybersecurity capabilities Train and improve AI models used for vulnerability discovery, validation, and automated remediation by developing datasets, evaluations, and feedback loops grounded in real‑world security research.
• Publish technical writeups, research insights, and vulnerability analyses that advance the state of application security.

You may thrive if you:

• Have strong experience in vulnerability research, exploit development, or offensive security.
• Have deep experience with cutting edge offensive‑security techniques Are fluent across AI/ML infrastructure (data, training, inference, schedulers, accelerators) and can threat‑model end‑to‑end.
• Operate independently, align diverse teams, and deliver on tight timelines.
• Communicate clearly and concisely with experts and decision‑makers.
• Care deeply about improving the security of widely used software and open‑source infrastructure.
• Are a strong developer who can work in a small energetic team

Goals & impact:

Build AI‑driven systems that can discover high‑impact vulnerabilities in widely deployed systems and open‑source software before attackers do.

Improve the precision and effectiveness of AI‑driven security agents by grounding them in real‑world vulnerability research.

Key technical challenges:

• System‑level vulnerability discovery — identifying complex vulnerabilities that span multiple services, trust boundaries, or components.
• High‑confidence validation — distinguishing real exploitable vulnerabilities from speculative or theoretical issues.
• Scaling security research with AI agents — guiding automated systems to analyze millions of commits while maintaining research‑level rigor.
• Automated exploit and proof‑of‑concept generation — building reproducible demonstrations of vulnerabilities within sandboxed environments.
• Building large systems that work within OpenAI's enterprise architecture

About OpenAI

OpenAI is an AI research and deployment company dedicated to ensuring that general‑purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core, and to achieve our mission, we must encompass and value the many different perspectives, voices, and experiences that form the full spectrum of humanity. We are an equal opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, sex, sexual orientation, age, veteran status, disability, genetic information, or other applicable legally protected characteristic. For additional information, please see OpenAI’s Aff…[truncated]. Background checks for applicants will be administered in accordance with applicable law, and qualified applicants with arrest or conviction records will be considered for employment consistent with those laws, including the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, for US‑based candidates. For unincorporated Los Angeles County workers: we reasonably believe that criminal history may have a direct, adverse and negative relationship with the following job duties, potentially resulting in the withdrawal of a conditional offer of employment: protect computer hardware entrusted to you from theft, loss or damage; return all computer hardware in your possession (including the data contained therein) upon termination of employment or end of assignment; and maintain the confidentiality of proprietary, confidential, and non-pub