Senior AI Security Researcher - Agoda

Agoda seeks a Senior AI Security Researcher to proactively find and exploit vulnerabilities, prioritizing internet-facing attack paths. The role involves building autonomous agents that interact with AI models to hack and test systems, conducting jailbreaks, and researching security weaknesses in AI infrastructure. The candidate will apply offensive security skills to AI-driven products, produce CVE-quality research, and collaborate with engineering teams to implement fixes. Responsibilities include assessing Model Context Protocol systems, designing defensive controls, and presenting findings to stakeholders.

The ideal candidate must have a Bachelor's in Computer Science, 2–7 years of offensive cybersecurity experience, and published CVEs. Strong knowledge of API security, red teaming, and hands-on jailbreak experience are required. The role demands the ability to work with multiple teams, communicate risks clearly, and handle production-level code.

Proactively find, exploit, and document real-world vulnerabilities, prioritizing external attack paths

Build autonomous agents that hunt, attack, and iterate on the fly by interacting with AI models

Use and develop AI-driven offensive workflows for continuous hunting

Apply deep offensive security skills with AI in the loop

Produce CVE-quality research outcomes and drive findings through to engineering fixes

Design, execute, and document jailbreaks and prompt injection attacks

Assess and attempt to compromise Model Context Protocol (MCP)–based systems

Build and automate security testing workflows involving multiple models and tools

Research security weaknesses in models and infrastructure

Contribute to in-house guardrail design and propose defensive controls

Translate research findings into practical engineering requirements

Bachelor’s in Computer Science or related degree

2–7 years in offensive cybersecurity

Published CVE(s)

Strong offensive security knowledge: API security testing and manipulation

Hands-on jailbreak experience (prompt injection, role confusion, data leakage)

Ability to work with multiple teams and present to C-level stakeholders

Good communication skills in English

Experience handling and maintaining production-level code

Proven exploits or write-ups that used AI to find or exploit bugs

Experience building autonomous agents that interact with AI to attack systems

Already using AI in day-to-day offensive work

Bug bounty / HackerOne track record

Conference presentations

Review Hiring Process Guidelines before interview