Offensive Security Agent Engineer

Build and own a production system of offensive security agents that continuously discover, validate, and coordinate remediation of vulnerabilities across OpenAI's infrastructure.
- Design and deploy specialized agents that test cloud environments, Kubernetes clusters, web applications, endpoints, and external attack surfaces from authenticated and unauthenticated perspectives.
- Translate offensive security expertise into agent tools, skills, policies, and knowledge bases; integrate internal context to deepen agent understanding of OpenAI's environment.
- Build complete vulnerability-management loops that move beyond discovery to impact validation, ownership identification, prioritization, remediation support, and fix verification.
- Develop human-in-the-loop systems allowing security engineers to approve dangerous actions, provide context, and steer agents; create feedback mechanisms for agents to learn from expert decisions.
- Requires substantial hands-on offensive security experience, production software engineering, and agent systems development; expertise in cloud, Kubernetes, or web application security especially valuable.
- Design rigorous evaluations measuring security outcomes; investigate agent failures and improve tools, context, workflows, and guardrails based on model capabilities and limitations.

OpenAI is a frontier AI research and product company, with teams working on alignment, policy, and security. We post specific opportunities at OpenAI that we think may be high impact. We do not necessarily recommend working at other positions at OpenAI. You can read concerns about doing harm by working at a frontier AI company in our career review on the topic, including concerns about OpenAI in particular. Note that there have also been concerns around OpenAI's HR practices.