Offensive Security Engineer, AI

Overview

Build AI-driven security tooling and lead red teaming of AI systems, bridging traditional penetration testing with AI-augmented offensive security on the Application Security team.

What you'll do

• Build, deploy, and maintain custom security scanners that leverage frontier models to detect vulnerabilities at scale across Coinbase's product surface.
• Lead red teaming efforts against internal AI systems, including jailbreak testing, prompt injection analysis, and tool abuse simulation.
• Develop AI-driven automation for vulnerability triage, validation, and remediation workflows to accelerate the bug bounty and vulnerability response pipelines.
• Partner with engineering teams to prioritize, remediate, and verify fixes for critical vulnerabilities discovered through AI-augmented and manual testing.
• Mentor junior security engineers on integrating AI into offensive security workflows to scale team capabilities.

What you'll need

• 3+ years of experience in application security, penetration testing, or offensive security with demonstrated ability to build custom security tooling.
• Hands-on experience using LLMs or frontier models to automate security tasks, scale vulnerability research, or build security scanners.
• Demonstrated experience red teaming AI-based systems (prompt injection, jailbreak testing, tool abuse).
• Deep understanding of common vulnerability classes (OWASP Top 10, SANS Top 25) and proven track record identifying and exploiting them in production environments.
• Proficiency in at least one programming language (Python, Go, or similar) with experience writing production-grade security tooling.
• Utilizes generative AI responsibly, maintaining human oversight to deliver business-ready outputs and drive measurable improvements in workflow efficiency, cost, and quality.

Details

• Remote-first, but not remote-only; quarterly in-person working sessions called "surges".
• Annual base salary range (excluding equity and bonus): $154,000 CAD.
• Application limit: maximum of 3 applications within a 6-month period.