Trail of Bits

Trail of Bits

Trail of Bits is a leading company specializing in computer and network security. Since 2012, they have been helping secure the world's most targeted organizations and products by combining high-end security research with a real-world attacker mentalit...

Internet Software & Services
51-250
Founded 2012

Description

  • Conduct comprehensive security assessments of large language model and agentic AI systems across the AI supply chain and application stack.
  • Examine vulnerabilities in LLM web applications, agentic coding tools, training data and inference pipelines, and guardrail mechanisms.
  • Develop, operationalize, and share prompt injection techniques for end-to-end application security reviews.
  • Identify and analyze novel attack vectors, vulnerabilities, and unauthorized access paths in AI and agentic environments.
  • Perform security assessments of client code bases using static analysis, dynamic testing, and manual code review.
  • Develop mitigation strategies for findings at the intersection of application security and agentic AI security.
  • Conduct threat modeling and risk assessments to identify future risks and prompt injection attack surfaces.
  • Work with client teams to review system code and architecture and help assure products through system analysis and modeling.
  • Deliver specialized training to clients on Agentic AI security concepts, including prompt injection, ML-specific attacks, and data pipeline threats.
  • Contribute to AI policy, regulatory frameworks, assurance methods, and auditing processes for mission-critical AI applications.

Requirements

  • Demonstrated interest and experience in agentic AI security.
  • Hands-on experience with prompt injection attacks and defenses.
  • Deep understanding of AI/ML architectures and frameworks such as PyTorch, Jax, LangChain, and RAG systems.
  • Experience with MLOps practices.
  • Track record of conducting technical security assessments of software.
  • Experience with software and system hardening and security policy analysis.
  • Practical experience designing and executing prompt injection workflows against production LLM systems, agentic pipelines, and tool-use environments.
  • Strong knowledge of multiple programming languages such as Rust, Golang, Kotlin, Swift, Objective-C, JavaScript/TypeScript, Python, Ruby, C, and/or C++.
  • Creative, adversarial hacker mindset with a passion for discovering novel attack vectors.
  • Ability to communicate complex security concepts clearly to diverse stakeholders and provide actionable recommendations.

Benefits

  • Competitive salary ranging from $100,000 to $200,000, plus potential bonuses.
  • Performance-based bonuses.
  • Fully company-paid health, dental, vision, disability, and life insurance.
  • 401(k) plan with a 5% company match.
  • 20 days of paid vacation, with flexibility for more where jurisdiction allows.
  • 4 months of parental leave.
  • $1,000 work-from-home stipend and $750 annual learning and development stipend.
  • $10,000 relocation assistance for candidates moving to NYC, plus company-sponsored team celebrations and travel, and up to $2,000 in annual charitable donation matching.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Senior Business Applications Security Engineer

AlphaSense 251-1K Internet Software & Services

AlphaSense is hiring a Senior Business Applications Security Engineer to build and own a centralized security program for its business application ecosystem, spanning SaaS, cloud, and on-premise tools.

OAuth Salesforce SAML
11 minutes ago

Cybersecurity Engineer - EU/US Timezones

hermeneutic Investments 11-50 Technology, Information and Internet

hermeneutic Investments is seeking a Junior–Mid Cybersecurity Engineer to run day-to-day security operations and strengthen protections across cloud, endpoints, identity, and collaboration systems in its proprietary trading and hedge fund environment.

AWS Azure Cybersecurity GCP OAuth SIEM System Design WAF
26 minutes ago

Security Engineer

SymSoft Solutions Web Design, Development, and System Integration

Symsoft Solutions is hiring a remote six-month contract professional to support state and local government web, application, and data services work with prior State of California experience.

26 minutes ago

Sr. Security Software Engineer (Starshield)

SpaceX 10K-50K Aerospace & Defense

SpaceX is hiring a Sr. Security Software Engineer for Starshield to secure software and infrastructure supporting government-focused space systems, including communications, sensing, and in-space mesh networks.

C++ Go Network Security Python TCP/IP
26 minutes ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers