Responsibilities: At Runsphere, you will own hands-on adversarial testing of AI agents and tool-calling workflows. Find the failure, prove it, automate it, and turn it into clear evidence that helps customers ship safely.
- Red-team LLM-powered agents, copilots, RAG pipelines, and API products.
- Test prompt injection, jailbreaks, system-prompt and tool leakage, sensitive-data leakage, unsafe outputs, policy bypass, tool misuse, excessive agency, resource and token-cost abuse, and business-logic abuse.
- Write Python tooling to run attack suites, call model APIs, score behavior, and produce repeatable reports.
- Build an internal attack library, regression tests, scoring rubrics, and reusable demo cases.
- Convert failures into reproducible findings, severity assessments, remediation guidance, and product requirements.
- Support customer demos and security reviews with credible evidence.
Ideal candidate: You are a hands-on security engineer or researcher who enjoys breaking systems responsibly and explaining how to fix them. You bring:
- Experience in QA automation, application security, API or web penetration testing, or bug bounty work.
- Strong Python scripting skills and experience testing APIs, web apps, backends, or SaaS products.
- Practical familiarity with LLMs, prompts, system instructions, RAG, agents, and tool or function calling.
- An understanding of prompt injection, jailbreaks, data leakage, tool misuse, excessive agency, policy bypass, and token-cost abuse.
- The ability to find meaningful attack paths, separate real customer risk from low-impact tricks, and write clear, reproducible reports in English.
- Comfort working quickly with incomplete requirements and collaborating across research, product, and engineering.
Experience with Burp Suite, Postman, Playwright, pytest, agent pipelines, or frameworks such as LangChain, LangGraph, or LlamaIndex is a plus. You hold a firm ethical line and operate within scope and the law.