Agent Security Research Engineer – Taiwan
Obsidian Security17 hours ago
Taipei, TaiwanSenior
Responsibilities
- Research attack and misuse scenarios involving AI agents, coding assistants, desktop agents, workflow automation tools, and MCP-connected tools.
- Design, build, test, ship, and document security detections and policies in the company’s engines and pipelines.
- Create reproducible positive and negative test cases, parse event logs, and build detection test harnesses using Python or Go.
- Support customer adoption, explain agent attack chains to technical and customer-facing teams, and tune content based on real-world results.
Requirements
- Hands-on knowledge of tool calling, hooks and lifecycle events, MCP servers and transports, skills and plugins, and permission modes.
- Understanding of direct and indirect prompt injection, tool and description poisoning, confused-deputy and excessive-agency issues, context secret leakage, and malicious or over-permissioned MCP servers and extensions.
- Strong SQL skills, preferably with analytical stores such as ClickHouse, Databricks, or Snowflake.
- Proficiency in Python or Go scripting for test harnesses, event-log parsing, and detections.
- Working knowledge of SaaS and cloud identity, including OAuth, PATs, API tokens, and scopes, plus developer tooling such as Git and GitHub/GitLab.
- Ability to distinguish real security risk from theoretical risk and explain agent attack chains to engineers, product teams, and customer-facing teams.
- Preferred qualifications include published LLM or agent-security research, CVEs, talks, or blog posts; threat-detection familiarity; endpoint-security experience on macOS, Linux, or Windows; experience with dbt, Dagster, or similar data-pipeline tooling; SaaS security, CASB/SSPM, or insider-threat experience; and substantial use of Claude Code, Copilot, Cursor, or similar tools.
Benefits
- Competitive compensation with equity and 401k for US-based employees.
- Comprehensive healthcare with dental and vision coverage for US-based employees.
- Flexible paid time off and paid holiday time off.
- 12 weeks of new parent or family leave.
- Personal and professional development resources.
- International benefits information is available separately; the role is located in Taiwan.
About Obsidian Security
Obsidian Security builds a SaaS security platform for enterprises to discover and govern third-party app and AI integrations, manage OAuth/API permissions, and detect and respond to identity and SaaS threats. It sells subscriptions to large regulated organizations; named customers include Snowflake, T-Mobile, and Algolia. Founded in 2017 and headquartered in Palo Alto, the privately held company focuses on Microsoft 365, Salesforce, and other major business apps.