You keep documents, websites and tools from silently taking control of a person's agent. Prompt injection and confused-deputy problems are the defining security issue of agent systems: an agent that reads a web page has just taken instructions from a stranger, and the boundary between data and command is where this either holds or does not. This role is the one holding that line, and it is a research problem as much as an engineering one.
Open for applications. Starts at: Pilot expansion.
We are taking applications for this role now and building the pipeline for it. The stage above is when the work itself is expected to begin, which is something you deserve to know before you apply rather than after. It is context, not a gate.
Where
In the office together five days a week, in one of our garages, and remote-friendly around your family, arranged one person at a time. We hire across the United States 🇺🇸, India 🇮🇳 and the UAE 🇦🇪.
The work
Review application code, connectors and tool execution for authorization failures, injection, secret leakage and unsafe external actions. Build enforceable controls outside model prompts. Work with engineers on secure defaults, egress restrictions and tests that reproduce actual failure modes.
The milestone
In your first 90 days, secure one complete workflow and add regression tests for its highest-risk attacks.
Required
Nice to have
Evidence
Bring practical application security and strong coding skills. Experience with agent systems is valuable, but disciplined threat modeling and remediation are essential.
Evidence, not credentials. We are describing work you can point at, in whatever form it exists.
The exercise
Review a malicious document that asks the agent to send private files elsewhere and show where enforcement must happen.
The package
Indicative pay ranges by market and level are on the compensation page. Plan numbers are confirmed in your offer letter.
Apply
One short form. A person reads every application and you hear back either way. You will get your own link to check where things stand, and you can withdraw or delete your application from it at any time, without an account.
