Member of Technical Staff - Security Research

About the role

As the first Security Researcher at Runlayer, you will discover and publish vulnerabilities that define AI agent security, influencing industry standards and protecting our customers.

Key responsibilities

• Find and exploit vulnerabilities in MCP servers, AI coding agents, agent frameworks, skills, plugins, and OAuth flows.
• Run coordinated disclosure end‑to‑end, including vendor contact, CVEs, advisories, embargoes and publication.
• Publish technical write‑ups, open‑source tools and conference talks.
• Conduct ecosystem‑scale studies across thousands of MCP servers using our scanning pipeline.
• Translate findings into product detections, scanner rules and public risk ratings.
• Brief customers, prospects and press together with marketing and developer relations.

Required profile

• 5+ years in offensive security research, vulnerability research or red teaming.
• Public record of CVEs, advisories, conference talks or published tools.
• Deep knowledge of agent‑native attacks such as prompt injection, tool poisoning, OAuth abuse and supply‑chain attacks.
• Ability to write clear technical documentation for engineers and security leaders.
• Sound judgment in responsible disclosure, even when vendors push back.

Required skills

• Python programming.
• TypeScript programming.
• Go programming.
• Offensive security techniques and vulnerability research.

What we offer

• Competitive salary and equity.
• Paid time off, including vacation, sick leave and parental leave.
• Professional development budget for conferences, courses and certifications.
• Top‑tier equipment and choice of laptop.
• Comprehensive health, dental and vision benefits.