Senior Security Engineer, Agentic AI

Trail of Bits seeks a Senior Security Engineer specializing in Agentic AI Security for our Software Assurance team. You will discover and exploit novel vulnerabilities in agentic AI systems, finding the breaks before your clients do. You'll develop sophisticated prompt injection attacks, test agent orchestration weaknesses, and identify real-world failure modes in LLM tool use, training data pipelines, and guardrail mechanisms. You will identify and analyze novel attack vectors specific to AI and agentic environments, focusing on real-world failure modes, system integration issues, and unauthorized access vectors. This role allows you to apply application security expertise and adversarial thinking to the latest agentic systems and business integrations.

In addition to performing technical assessments, you will develop threat models for agentic AI systems, contribute to risk frameworks for generative AI deployment, and deliver specialized training to clients on novel exploitation techniques in agentic AI security.

What You'll Achieve

• Agentic AI Security Assessments - Conduct comprehensive application security assessments of agentic AI pipelines, tools, and frameworks for leading companies and labs. Examine vulnerabilities in model architectures, guardrails, and deployment infrastructure while developing mitigation strategies.
• Prompt Injection Research & Development - Develop and share novel prompt injection techniques targeting agentic workflows, including indirect injection via tool outputs, multi-turn manipulation, and cross-agent exploitation.
• Threat Modeling - Conduct threat modeling and risk assessments to proactively identify potential risks for clients and develop mitigation strategies for future prevention.
• Client Engagement - Work with leading industry teams to review system code and architecture, and help assure their products through system analysis and modeling.

What You'll Bring

• AI Security Expertise - Demonstrated interest and experience in agentic AI security, with demonstrated ability to identify and mitigate AI-specific vulnerabilities across complex systems, including hands-on experience with prompt injection attacks and defenses.
• Technical AI Knowledge - Deep understanding of AI/ML architectures, frameworks (PyTorch, JAX, LangChain, RAG systems, etc.), and MLOps practices, combined with robust security engineering expertise.
• Application Security Skills - Track record of conducting technical security assessments of software, including software and system hardening, security policy analysis, and implementing effective security measures.
• Programming Proficiency - Strong knowledge of multiple programming languages such as Rust, Go, Kotlin, Swift, Objective-C, JavaScript/TypeScript, Python, Ruby, C and/or C++ for both security analysis and tool development.