We have access to our clients' operations. You try to break the platform, the agents and the projects before anyone else tries, and close every finding with evidence.
The role
- Run authorized penetration tests on applications and APIs.
- Test agents against prompt injection and tool abuse.
- Review access policies, secrets and exposed data.
- Document every finding with evidence and verify it gets closed.
Your first 90 days
- Day 30
You learn the security standard and run your first authorized test.
- Day 60
You test a complete project and close findings with the team.
- Day 90
Tests against the agents run before every major change.
Stack and tools
Burp SuitePythonReconnaissance toolsSupabase / Postgres
What we look for
Must have
- You have found real vulnerabilities, at work, in CTFs or in bug bounty programs.
- You understand web applications, authentication and access control.
- You work only within what is authorized and you document it.
- You can explain a risk to the person who decides.
Nice to have
- Language model security.
- Postgres and row-level policies.
- OSCP or equivalent.
What working here is like
What you build goes into products that operate real organizations. You work directly with the founders, with no layers between your code and production, under the same rule we give the intelligence: a person signs what is critical.