4 days ago
Remote, United StatesSenior
Base Salary
$170k - $230k/yr
Responsibilities
- Build and operate a production AI vulnerability platform with resumable workflows, bounded agent execution, model routing, and per-repository budgets.
- Engineer repository context, threat models, coverage tracking, and agent reasoning around entry points, trust boundaries, tenant isolation, and relevant code paths.
- Build independent finding validation, stable finding identity, deduplication, and evidence-backed exploitability and reachability judgments.
- Develop patch and regression-test workflows that verify failing and passing tests, check for regressions, and require human review before merging.
- Protect agent execution through sandboxing, least-privilege tool access, and controls for untrusted repository content, prompt injection, secrets, and sensitive data.
- Partner with security and engineering teams to deliver findings through SARIF and existing workflows.
- Measure finding quality, coverage, reliability, and cost, and communicate results and engineering practices.
Requirements
- 5+ years of software engineering experience, including ownership of production services or automation platforms.
- Hands-on experience building LLM-backed applications or agent workflows.
- Strong Python skills, including asynchronous concurrency, typing, testing, packaging, and profiling.
- Experience building multi-step workflows with durable state, idempotent retries, task queues, termination conditions, observability, and resource limits.
- Hands-on experience with LLM APIs, tool calling, structured outputs, context management, and evaluation.
- Experience with AWS or comparable cloud infrastructure and distributed systems.
- Familiarity with model-provider integrations, container isolation, and secure handling of code and credentials.
- Working knowledge of application security, including authentication, authorization, common vulnerability classes, and trust boundaries.
- Bachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent practical experience.
- For Vulnerability Discovery, experience with static analysis, syntax trees and call graphs, code retrieval, threat modeling, or sandboxed proof-of-concept execution is useful; experience reading C or C++ and understanding native-code vulnerabilities is valuable.
- For Finding Validation, experience with security triage, clustering or near-duplicate detection, benchmark design, ground-truth labeling, or automated patching and test infrastructure is useful.
- Additional useful experience includes SARIF, SAST/SCA integrations, durable execution frameworks, LLM application tracing and evaluation tools, agentic-system security, open-source contributions, security research, or program repair.
Benefits
- Full-time hybrid-remote work arrangement, with remote work available from specified U.S. states and hybrid options in Austin, Texas, or Tampa, Florida.
- Medical, dental, and vision insurance.
- 401(k) plan and life insurance coverage.
- Unlimited paid time off.
- Opportunities for growth and advancement.
- This position is not eligible for visa sponsorship.
Categories
About NinjaOne
NinjaOne builds a unified IT operations platform for IT teams and managed service providers, combining endpoint management, RMM, automated patching, backup, and remote access in a single SaaS console. The company sells subscriptions and related services to monitor, secure, and support fleets of devices. Headquartered in Austin, Texas, it is privately held and reports serving nearly 40,000 customers across 140+ countries.