How to apply for Offensive Security Agent Engineer

About OpenAI

OpenAI is a frontier AI research and product company with teams working on alignment, policy, and security. It posts specific opportunities it considers high impact, and notes that it does not necessarily recommend working at other positions there. Candidates should read the 80,000 Hours career review on working at an AI lab to weigh concerns about doing harm.

About the role

This role is to build and own a production system of offensive security agents that continuously discover, validate, and coordinate remediation of vulnerabilities across OpenAI's infrastructure. The agents test cloud environments, Kubernetes clusters, web applications, endpoints, and external attack surfaces from authenticated and unauthenticated perspectives. The work also includes human-in-the-loop systems, evaluations of security outcomes, and investigation of agent failures.

A typical day

A typical day may involve designing or deploying specialized offensive security agents, reviewing agent findings, and coordinating remediation with security engineers. It may also include building human-in-the-loop approval flows, running evaluations of security outcomes, and investigating agent failures to improve tools, context, workflows, and guardrails. The job is remote in the US, and the exact team and daily routine are not specified in the details, so ask about them in interviews.

Who OpenAI is looking for

• Has substantial hands-on offensive security experience, including testing cloud environments, Kubernetes clusters, web applications, endpoints, and external attack surfaces.
• Has production software engineering experience and has built or operated agent systems in production.
• Can translate offensive security expertise into agent tools, skills, policies, and knowledge bases.
• Has expertise in cloud, Kubernetes, or web application security, and can design evaluations that measure security outcomes.

Tips for this application

• Show concrete offensive security work: name the environments you tested (cloud, Kubernetes, web apps, endpoints, external surfaces) and whether testing was authenticated or unauthenticated.
• Describe production agent systems you built or owned, including how tools, policies, and knowledge bases were structured for the agents.
• Explain how you handled vulnerability-management loops beyond discovery: impact validation, ownership identification, prioritization, remediation support, and fix verification.
• Detail any human-in-the-loop design you implemented, such as approval flows for dangerous actions, context injection, or feedback mechanisms for agents to learn from expert decisions.
• Include examples of evaluations you designed for security outcomes and how you investigated agent failures to improve tools, context, workflows, or guardrails.

What to cover in your cover letter

['Your hands-on offensive security experience across the specific surfaces listed: cloud, Kubernetes, web applications, endpoints, and external attack surfaces.', 'Your production software engineering and agent systems development work, especially systems you built and owned.', 'How you translate offensive security expertise into agent tools, skills, policies, and knowledge bases, including integrating internal context.', 'Your approach to complete vulnerability-management loops and human-in-the-loop systems for dangerous actions and expert feedback.']

Research before applying

• Read OpenAI's posted materials on alignment, policy, and security to understand how this role fits into the company's stated priorities.
• Read the 80,000 Hours career review on working at an AI lab to understand concerns about doing harm by working at a frontier AI company.
• Review OpenAI's infrastructure and product surface areas mentioned in the job description, such as cloud environments, Kubernetes, web applications, endpoints, and external attack surfaces.
• Check OpenAI's published research and engineering content on agents and evaluations to understand the technical context for offensive security agents.

Likely interview topics

Based on the job description, expect questions about:

• How you would design specialized agents to test cloud environments, Kubernetes clusters, web applications, endpoints, and external attack surfaces from authenticated and unauthenticated perspectives.
• How you would build a complete vulnerability-management loop that moves from discovery to impact validation, ownership identification, prioritization, remediation support, and fix verification.
• How you would create human-in-the-loop systems for security engineers to approve dangerous actions, provide context, and steer agents.
• How you would design rigorous evaluations measuring security outcomes and investigate agent failures to improve tools, context, workflows, and guardrails.
• How you would translate offensive security expertise into agent tools, skills, policies, and knowledge bases, and integrate internal context to deepen agent understanding.

Common mistakes to avoid

• Applying without concrete examples of production agent systems you built or owned, since the role requires agent systems development.
• Focusing only on vulnerability discovery and ignoring the full loop of validation, ownership, prioritization, remediation, and fix verification.
• Describing offensive security experience in general terms without naming the specific environments tested, such as cloud, Kubernetes, web applications, endpoints, or external attack surfaces.