Senior AI/LLM Penetration Tester

About the Company

For more than two decades, Bishop Fox has defined the forefront of offensive security. By combining elite human expertise with the power of its proprietary Cosmos AI engine, the firm delivers industry-leading cloud and application security services, including AI-powered penetration testing and AI/LLM security assessments that reflect real-world attacker behavior. Renowned for its innovation and contributions to the open-source community through flagship tools like Sliver and AIMap, Bishop Fox has released 25+ tools and 75+ advisories in the last 10 years. As a trusted partner to the world’s most recognizable brands, Bishop Fox protects 26 of the Fortune 100, eight of the top 10 global tech companies, all of the top five global media companies, 10 of the top 20 retailers, and 7 of the top 10 manufacturers. A consistent market leader, Bishop Fox has been recognized as a Leader and "Fast Mover" in the GigaOm Radar for Attack Surface Management for five consecutive years. With a 70 NPS rating, the firm remains the trusted partner for organizations seeking to stay ahead of the evolving threat landscape.

About the Role

We are hiring a Senior AI/LLM Security Consultant to help clients stay ahead of emerging AI threats by conducting cutting-edge security assessments of large language models, AI agents, and AI-powered applications.

Responsibilities

• Conduct security assessments of AI/LLM-powered applications, including identifying vulnerabilities such as prompt injection, jailbreak techniques, indirect prompt injection, data leakage, insecure tool/function calling, agentic AI abuse, model misuse, and unsafe output generation.
• Perform manual application security testing beyond automated scanning.
• Review AI application architectures and identify security weaknesses across APIs, cloud infrastructure, and application logic.
• Perform source code review and dynamic testing.
• Present findings to technical and executive audiences.
• Mentor teammates and contribute to internal research, tooling, and methodology development.

Requirements

• 5+ years of offensive security experience performing penetration tests, red team engagements, or application security assessments.
• Experience assessing AI/LLM-powered applications for vulnerabilities.
• Understanding of modern AI architectures.
• Strong understanding of web application security fundamentals, including the OWASP Top 10 Web, Agentic, and LLM Applications.
• Experience with cloud platforms (AWS, Azure, or GCP) and securing AI workloads.
• Scripting or programming experience in Python, JavaScript, Go, Java, or similar languages.
• Familiarity with LLM application and agent-orchestration frameworks, inference provider APIs, external capability integration for models, and open-source tooling across commercial and self-hosted ecosystems.
• Knowledge of authentication, authorization, networking, APIs, and secure software development practices.
• Excellent written and verbal communication skills.

Qualifications

• OSCP, OSEP, GWAPT, GPEN, GXPN, or other relevant certifications (helpful but not required).
• Bachelor's degree in Computer Science, Cybersecurity, or a related technical field (a plus).
• Experience conducting AI red team exercises against production or pre-production AI systems.
• Research into emerging AI attack techniques or contributions to the offensive security community.
• Experience building or securing AI agents and autonomous workflows.
• Knowledge of adversarial machine learning concepts and model security.
• Experience with cloud-native AI platforms such as Azure OpenAI, Amazon Bedrock, or Google Vertex AI.
• Familiarity with AI software development lifecycle (AI SDLC) and AI governance frameworks.

Benefits

Bishop Fox offers a comprehensive benefits program tailored to meet your needs at an affordable price. We embrace diversity and foster an inclusive culture where employees are empowered to do their best work while advancing the security community through world-class research and consulting.

Schedule

This role is fully remote and can be based anywhere in the United States.

This position is not eligible for visa sponsorship. Applicants must be authorized to work in the United States of America for the duration of employment without sponsorship.