Offensive Security Engineer, Agent Products

OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. They are seeking a Principal-level Offensive Security Engineer to conduct deep penetration testing of their agent-powered products and infrastructure, identify vulnerabilities, and collaborate with engineering teams to implement security improvements.

Responsibilities:

• Conduct deep penetration tests of OpenAI’s agent-powered products, including web applications, APIs, cloud services, identity and authorization flows, CI/CD systems, and model-integrated product surfaces
• Continuously hunt for exploitable vulnerabilities in the interactions between the applications, infrastructure, tools, and models that power our agentic products
• Perform code review, architecture review, and hands-on exploitation to validate risk and identify subtle or novel failure modes
• Produce clear, actionable findings with reproduction steps, exploitability analysis, impact assessment, and practical remediation guidance
• Partner directly with engineering teams to drive fixes, validate remediation, and improve secure design patterns across agentic products
• Build tools, test harnesses, and automation to scale penetration testing across rapidly evolving product surfaces
• Leverage advanced automation and OpenAI technologies to optimize your offensive security work
• Share attacker-informed insights with security and engineering teams to improve threat models, mitigations, and defensive coverage

Requirements:

• 7+ years of hands-on penetration testing, product security assessment, application security, cloud security assessment, or equivalent offensive security experience
• Deep expertise finding, exploiting, documenting, and helping remediate vulnerabilities in complex production systems
• Experience performing offensive security assessments of modern technology products, including web applications, APIs, cloud infrastructure, identity systems, CI/CD pipelines, and distributed services
• Experience designing, developing, or assessing the security of AI-powered systems
• Experience finding, exploiting, and mitigating common vulnerabilities in AI systems, including prompt injection, confused deputies, unsafe tool use, and dynamically generated UI components
• Exceptional skill in code review to identify novel and subtle vulnerabilities
• Proven experience performing offensive security assessments in at least one hyperscaler cloud environment. Azure experience is preferred
• Demonstrated mastery assessing complex technology stacks, including: Highly customized Kubernetes clusters, Container environments, CI/CD pipelines, GitHub security, macOS and Linux operating systems, Data science tooling and environments, Python-based web services, React-based frontend applications
• Strong intuitive understanding of trust boundaries and risk assessment in dynamic contexts
• Excellent coding skills, capable of writing robust tools and automation for offensive security testing
• Ability to communicate complex technical concepts effectively through clear reports, practical remediation guidance, and compelling technical storytelling
• Proven track record of not just finding vulnerabilities, but actively contributing to solutions in complex codebases
• Background or expertise in AI or data science
• Prior experience working in tech startups or fast-paced technology environments
• Experience in related disciplines such as Software Engineering, Product Security, Application Security, Detection Engineering, Site Reliability Engineering, Security Engineering, or IT Infrastructure