Base Salary
$210k - $290k/yr
Responsibilities
- Plan and execute authorized red team operations across cloud, Kubernetes, networks, identity systems, SaaS, and internal applications.
- Build and maintain AI-assisted testing harnesses for reconnaissance, attack-path discovery, fuzzing, exploit validation, and related workflows.
- Use LLMs and agentic tools for vulnerability research, payload and test-case generation, code review, and report drafting.
- Conduct offensive testing of AI systems, including prompt injection, tool and connector abuse, data exfiltration, permission boundaries, and AI dependency supply chain risks.
- Emulate realistic adversaries using MITRE ATT&CK and ATLAS and chain findings into end-to-end attack paths.
- Run purple team exercises with detection engineering and incident response teams and tune detections based on test results.
- Write findings with reproduction steps, impact, and recommended fixes; track remediation and perform retesting.
- Automate regression tests and integrate results into engineering workflows.
- Document and share techniques, tooling, and lessons learned with engineering teams.
Requirements
- At least 3 years of experience in offensive security, red teaming, or penetration testing involving production-scale environments.
- Strong Python programming skills and experience writing custom security tooling.
- Hands-on experience building LLM-powered workflows or agents, including tool use, orchestration, evaluation, and guardrails.
- Deep expertise in at least two of cloud security and IAM abuse, Active Directory or identity attacks, Kubernetes and container escapes, web and API exploitation, or CI/CD and supply chain attacks.
- Working knowledge of AI-specific risks including prompt injection, insecure tool use, data leakage, excessive agent permissions, and model supply chain issues.
- Sound judgment regarding testing scope, safety, and blast radius in production-adjacent systems.
- Clear written communication suitable for both engineering and executive audiences.
Benefits
- Generous holiday and time-off policy.
- Medical, dental, and vision insurance options.
- Remote work support, including a home-office setup allowance and monthly cell phone and internet allowances.
- Care benefits, wellness allowance, childcare allowance, and family-planning benefits.
- 401(k) options with employer matching up to 4% of base salary in the US and pension plans internationally.
- Monthly allowance for using the Whatnot app as both a buyer and seller.
- Sixteen weeks of paid parental leave plus one month of gradual return to work.
- Remote co-located work model with hubs across the US, UK, Ireland, Poland, Germany, and Australia.
Tech Stack
Categories
About Whatnot
Whatnot is the largest livestream shopping platform in the US, UK, and Europe. Millions of people come to Whatnot every day to buy, sell, and connect over the things they love, from sneakers to sports cards, vintage fashion to fine jewelry, comics to Pokémon, beauty, electronics, and hundreds of other categories. In 2025, live sales on Whatnot surpassed $8B, more than doubling the year before. Over 20 million accounts were created last year alone, and we have been the #1 shopping app in both the US and UK. We've built a real business, but we're nowhere near done. Live commerce at this scale has never been done in the West, which means the people here now are shaping how an entirely new industry develops. The pace here is fast and the expectations are high. We move quickly, prioritize ruthlessly, and trust people to own their work end-to-end. In return, careers grow faster, impact is real, and your colleagues will raise your standards. It's an environment built for people who want to do the best work of their careers alongside others doing the same. We're a remote, co-located team with hubs in the US, UK, Ireland, Poland, and Germany, and we're hiring across every function.