Senior Security Researcher - Red Team (Contract)

The role

You will proactively identify and exploit weaknesses across product, cloud, and AI-powered systems. This role involves offensive security, GenAI attack simulation, and security engineering to strengthen defenses.

What you will do

• Design and execute red team operations against GenAI systems, LLM pipelines, RAG architectures, autonomous agents, APIs, SaaS products, and cloud environments.
• Conduct adversarial testing focused on prompt injection, indirect prompt attacks, jailbreaking, model extraction, training-data poisoning, data leakage, inference abuse, and unauthorized output manipu
• Use deepfake generation, voice synthesis, and related spoofing techniques to test voice authentication and deepfake detection capabilities.
• Develop novel attack chains combining GenAI vulnerabilities with infrastructure, application, identity, and API weaknesses.
• Plan and execute full-scope penetration tests and support bug bounty efforts across web applications, APIs, SaaS products, and AWS/GCP environments.
• Perform architecture reviews, security code reviews, and threat modeling for AI/ML components and LLM-facing services.
• Build automation for offensive security workflows, testing, compliance checks, alerting, and reporting using Python or similar scripting languages.
• Partner with SecOps and security engineering to improve detections and translate findings into remediation.
• Stay current on GenAI security research, adversarial ML techniques, and evolving threat intelligence.

Required qualifications

• 3+ years of hands-on penetration testing and red team experience across SaaS applications, cloud infrastructure, APIs, and web applications.
• Demonstrable experience attacking GenAI or LLM-based systems, including prompt injection, jailbreaking, indirect prompt attacks, model extraction, or adversarial input generation.
• Hands-on experience with deepfake tools, voice synthesis, or audio/visual spoofing technologies in an offensive or research context.
• Strong proficiency with offensive security tooling such as Burp Suite, OWASP ZAP, Nmap, Metasploit, Cobalt Strike, or equivalent frameworks.
• Experience configuring and operating SAST and DAST tools and integrating them into CI/CD pipelines.
• Proficiency in at least one scripting or programming language, with Python strongly preferred.
• Familiarity with AI-specialized security tools or frameworks such as Garak, PyRIT, Claude Security, or similar adversarial ML tooling.
• Strong understanding of cloud security architecture, container security, API security, and common security standards including ISO 27001/27002, NIST, CIS, PCI DSS, OWASP, and SOC 2.

Nice to have

• Prior software development or secure architecture experience, including the ability to reason about production code across multiple languages.
• Research, publication, or deep practitioner background in adversarial machine learning, LLM security, or voice/audio deepfake detection.
• Relevant certifications such as OSCP, GPEN, GWAPT, GXPN, CEH, or equivalent.
• Prior experience in voice biometrics, AI security, fraud prevention, or similarly high-risk product environments.

Benefits

• Competitive compensation, including equity for all employees
• Unlimited Paid Time Off (PTO)

Before you apply

• This position is contracted through Alcor BPO.
• Pindrop may use AI tools to help prioritize job applications for human review.

About the company

Pindrop is a cybersecurity company delivering continuous identity verification across voice, video, and digital interactions. It protects billions of high-risk interactions for enterprises, including leading financial institutions, insurers, and healthcare organizations.