Senior Security Researcher, Voice Agent Red Team

Hamming AI; Oregon; Híbrido; USD 140.000 - 220.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Competitive compensation

Equity

Health, dental, vision coverage

AI tools access

Conferences sponsorship

Flexible PTO

Remote in US

Descripción de la vacante

Hamming AI is seeking a security practitioner to run authorized assessments of production voice and chat agent systems for major banks and health care clients. You will model threats, execute controlled, reproducible attacks, and document findings with clear remediation steps to prevent future exploits.

You will work hands-on with AI attack techniques, including prompt injection and data exfiltration risks, while maintaining safe, auditable procedures in production environments.

Formación

• 5+ years in offensive security and authorized assessments of production applications, APIs, or agent systems.
• Hands-on AI attack work: prompt injection, jailbreak chains, tool and function-call abuse, data exfiltration via model outputs.
• Application security fundamentals: authentication/authorization bypass, injection, session and identity handling.

Responsabilidades

• Own the assessment: threat model, scope, test identities, stopping conditions, and evidence required for findings.
• Follow the full path: conversation, retrieved content, identity checks, and tool permissions up to the point the agent crosses a line.
• Work carefully in production: approved scenarios, controlled data, customer informed, hard stop at the limit.
• Prove what's exploitable: preconditions, reproduction, impact, and the fix, with honest severity.
• Verify remediation: turn case into regression coverage and teach the harness what was found by hand.

Conocimientos

Offensive security

AI attack techniques

App security fundamentals

Python/TypeScript automation

Herramientas

Python

TypeScript

Descripción del empleo

About HammingHamming is the security layer for voice and chat agents. Banks, health systems, and other enterprises are putting agents on phone lines where anyone can reach them, and where the agent can verify identity, read an account, and act. We attack those agents before criminals do, with the owner's permission, show what they fall for, and keep every fix tested on every release.We are one of the fastest engineering teams in the world. We prod deploy 4x / day.Devin Case StudyRanked #1 Eng teamOpenAI Dev Day 100billion token list

The role

You run authorized assessments of production voice and chat agents at banks, health systems, and other enterprises. You scope the engagement with the owner, run it through a harness that makes thousands of calls, decide which results are security failures with a real consequence, and write the finding the owner fixes the same day. Then you rerun it, because a fix is a claim until the same attack fails again. Findings become permanent tests; the work you can share goes out through responsible disclosure and on stage.

What you'll do

• Own the assessment. Threat model, scope, test identities, stopping conditions, and the evidence a finding needs.
• Follow the whole path. Conversation, retrieved content, identity checks, and tool permissions, to the point where the agent crosses a line.
• Work carefully in production. Approved scenarios, controlled data, the customer informed, a hard stop at the agreed limit.
• Prove what's exploitable. Preconditions, reproduction, impact, and the fix, with severity stated honestly.
• Verify the remediation. Turn the case into regression coverage, and teach the harness what you found by hand.

What you'll bring

• 5+ years in offensive security, with authorized assessments of production applications, APIs, or agent systems.
• Hands-on AI attack work: prompt injection, jailbreak chains, tool and function-call abuse, data exfiltration through model outputs.
• Application security fundamentals: authentication and authorization bypass, injection, session and identity handling.
• Reports a developer can reproduce and a CISO can defend, and Python or TypeScript to make your work repeatable.

Nice to have

• Assessments of voice or telephony systems
• Engagements with banks or health systems
• Published research, a CVE, or a conference talk

How we work

We start with the customer problem, ship daily, and let evidence decide what comes next. Use AI tools to move faster and own the result. Direct, low ego, serious work.

Benefits and perks

• Competitive salary and meaningful equity
• Health, dental, and vision coverage
• Every frontier AI tool, fully paid, from day one
• Conferences and events we sponsor
• Flexible PTO
• Offices in San Francisco and Austin; remote in the United States for most roles