Senior Security Researcher - Red Team (Contract)

pindropsecurity; United States; Remote; USD 96,000 - 165,000; Full time

Benefits offered by this job

Remote-first culture

Competitive compensation

Job summary

Pindrop Security is seeking a contract security professional to lead hands-on red team work focused on AI-enabled products, cloud systems, applications, and APIs. The role blends offensive security, generative AI attack simulations, voice and deepfake testing, and collaboration with security, product, and ML teams in a remote-first setup.

You will plan and run red team exercises against LLM services, test prompt injections, model extraction, data leakage, and poisoning; build attack chains

Qualifications

• 3+ years of practical penetration-testing experience.
• Hands-on experience attacking AI systems with an attacker mindset.
• Ability to work independently in ambiguous, fast-changing environments.
• Clear communication for technical and executive audiences.

Responsibilities

• Plan and run red team exercises against LLM services, retrieval-augmented systems, agents, APIs, SaaS products, and cloud environments.
• Test for prompt injection, jailbreaks, model extraction, data leakage, poisoning, inference abuse, and manipulated outputs.
• Use voice synthesis and deepfake techniques to probe authentication and detection systems.
• Build realistic attack chains spanning AI components, identity, applications, APIs, and infrastructure.
• Conduct penetration tests and support vulnerability disclosure programs; review architectures, code, and threats involving AI/ML.
• Automate offensive testing and reporting, then work with defensive teams to improve detections and remediation.

Skills

Penetration testing

AI security testing

Python scripting

Tools

Python

Job description

Role overview

Lead hands-on red team work to uncover weaknesses in AI-enabled products, cloud systems, applications, and APIs before attackers can exploit them. The role combines offensive security, generative AI attack simulation, voice and deepfake testing, and close work with security, product, and machine-learning teams. It is a contract engagement with a remote-first setup.

Responsibilities

• Plan and run red team exercises against LLM services, retrieval-augmented systems, agents, APIs, SaaS products, and cloud environments.
• Test for prompt injection, jailbreaks, model extraction, data leakage, poisoning, inference abuse, and manipulated outputs.
• Use voice synthesis and deepfake techniques to probe authentication and detection systems.
• Build realistic attack chains spanning AI components, identity, applications, APIs, and infrastructure.
• Conduct penetration tests and support vulnerability disclosure programs; review architectures, code, and threats involving AI/ML.
• Automate offensive testing and reporting, then work with defensive teams to improve detections and remediation.

Requirements

• At least three years of practical penetration-testing experience; the listing is truncated, so further mandatory qualifications are not available.
• Demonstrated hands-on experience attacking AI systems, with an attacker's mindset and the ability to validate security weaknesses.
• Ability to work independently in ambiguous, fast-changing environments.
• Clear communication skills, including explaining findings and priorities to technical and executive audiences.
• Scripting ability, such as Python, for security automation is relevant to the described work.

Nice to have

• Experience in adversarial machine learning, LLM security, or voice and audio deepfake detection.
• Security certifications such as OSCP, GPEN, GWAPT, GXPN, CEH, or equivalent.
• Background in voice biometrics, AI security, fraud prevention, or another high-risk product area.

Benefits and work setup

• competitive compensation, equity, unlimited paid time off, and a remote-first culture.

The position is described as a contract role.