Offensive Security Engineer
Nebius
WorldwideremotePosted 17 days ago
Skill Required
Offensive-Security-EngineerPenetration-TesterRed-Team-EngineerSecurity-ResearcherApplication-Security-EngineerOffensive-Security-EngineeringOffensive-Security-SpecialistSenior-Offensive-Security-SpecialistOffensive-SecuritySecurity-EngineerSecurity EngineersecurityPenetration TestingSystem DesignVMwareEngineeringKubernetesnetworkingdevelopingsimilar)Firmwarebuildingetc.)TestNGPythondesignCloudIAMandGenerative AIGoAIMachine LearningFulltime
Key highlights
- Competitive compensation with equity upside in a Nasdaq-listed, high-growth company
- 6+ years in offensive security required
- Focus on novel attack research against GPU infrastructure, inference stacks, and AI platform services
- Remote-first flexible culture with international talent pool
- Opportunity to work on impactful AI projects shaping the global AI economy
- Access to cutting-edge cloud-native security challenges in multi-tenant AI infrastructure
Role overview
Nebius is a Nasdaq-listed company (NBIS) headquartered in Amsterdam that is building a full-stack AI cloud platform supporting developers and enterprises from data and model training through production deployment without requiring large in-house AI/ML infrastructure. This role is for an Offensive Security Engineer joining the Product Security Team to design and execute adversarial simulations across the cloud platform, establish a penetration testing program, and conduct research on novel attack vectors.
Responsibilities
- Validate and extend early-stage Secure SDLC threat models via continuous penetration testing, assessing threat severity and mitigation status while challenging assumptions made during threat modeling and system development.
- Automate routine validations to keep pace with increasing feature flow, reserving manual analysis for genuinely complex cases.
- Plan and execute full-scoped red team engagements against Nebius cloud platform covering compute, storage, inference, networking, orchestration layers, and internal tooling.
- Identify threats capable of impacting organizational operations.
- Work closely with Detection & Response and other security engineering teams to run purple team exercises, validate detection coverage, and close gaps collaboratively.
- Research novel attacks against GPU infrastructure (e.g., closed-source firmware and vendor driver binaries, device passthrough exploits, SR-IOV/IOMMU misconfigurations, RDMA/InfiniBand fabric attacks).
- Research novel attacks against inference stack (e.g., vLLM, TRT-LLM).
- Research novel attacks against AI platform managed services (e.g., managed Slurm).
- Assess tenant-isolation boundaries and how they can be broken at the low-level stack.
- Conduct targeted assessments of new products and infrastructure changes before they ship.
- Deliver clear, actionable reports for technical audiences and leadership with prioritized findings and remediation guidance.
- Establish red team processes, tooling, and a methodology that scales as the platform grows.
Requirements
- 6+ years in offensive security - penetration testing, red teaming, or adversary simulation
- Deep experience attacking cloud-native environments: Kubernetes privilege escalation, cloud IAM abuse, virtualization and container escapes
- Strong fundamentals across the attack lifecycle: initial access, persistence, lateral movement, data exfiltration
- Proficiency developing custom tooling and post-exploitation capabilities (Python, Go, or similar)
- Experience running purple team exercises and working constructively with blue teams
- Ability to write clear, senior-level reports with business-contextualized risk
Nice to have
- Experience attacking ML infrastructure, model serving pipelines, or GPU clusters
- Reverse engineering and exploits development experience
- Application security experience
- Familiarity with eBPF bypass techniques or kernel-level exploitation
- Background in vulnerability research or CVE discovery
- Experience with cloud provider internals (hypervisor/networking layers)
- Presenting security research at conferences like BlackHat/DefCon
Benefits
- Competitive compensation with equity upside in a Nasdaq-listed, high-growth company
- Flexible, remote-first culture
- Career growth and learning opportunities
- Collaborative and innovative culture
- Opportunity to work on impactful AI projects
- International environment and talented teams
Additional details
- Hiring process includes recruiter chat (30mins), live-coding interview (60mins) to assess basic coding skills, security interview (60mins) to assess domain expertise, security system design interview (90mins) to assess practical experience, optional technical deep dive (90mins) to present a complex and impact project, and final interview (45mins) to close the hiring process.
- The role focuses on designing and executing adversarial simulations across the cloud platform, establishing a penetration testing program, and researching novel attack scenarios targeting high-value assets.
- Attacks target GPU clusters, AI platforms, and multi-tenant cloud at scale, leveraging Nebius's unique attack surface.
- Compensation is competitive with equity upside in a Nasdaq-listed, high-growth company.
- Culture emphasizes flexibility, remote-first work, career advancement, collaborative innovation, and significant impact on AI projects.
- The team comprises over 1,500 engineers with deep expertise across hardware, software, and AI R&D, operating globally across Europe, the UK, North America, and Israel.
- Company is listed on Nasdaq (NBIS) and maintains R&D hubs in multiple regions to drive its AI cloud platform.