Member of Technical Staff (Offensive Security Engineer)

Details

Perplexity is seeking a highly skilled and hands-on Offensive Security Engineer to join its security team. The role takes an adversarial approach to hardening infrastructure, applications, and AI systems through red team operations, penetration tests, and attack simulations across cloud infrastructure, web and mobile applications, AI/ML pipelines, and corporate environments.

Responsibilities

• Plan and execute red team and purple team engagements simulating advanced threat actors across AWS, Kubernetes, endpoints, and application surfaces.
• Conduct continuous penetration testing of web applications, APIs, mobile clients, browser extensions, cloud infrastructure, and internal services.
• Assess AI/ML-specific attack surfaces, including prompt injection, model exfiltration, agent abuse, tool-use exploitation, and MCP security boundaries.
• Develop and maintain custom offensive tooling, exploits, and automation to improve the efficiency and coverage of security testing.
• Perform open-scope adversary simulations that test detection and response capabilities end to end, collaborating closely with the defensive security team.
• Drive threat modeling sessions with engineering teams to identify and prioritize attack vectors in new features and architectures.
• Deliver clear, actionable findings to technical and executive audiences and partner with engineering teams to validate remediations.
• Contribute to the security of CI/CD pipelines, supply chain integrity, and secrets management through offensive assessment.
• Stay current on emerging attack techniques, vulnerability research, and adversary tradecraft, bringing external perspective into Perplexity's security strategy.

Requirements

• 5+ years of hands-on experience in offensive security, red teaming, or penetration testing.
• Deep technical expertise in at least two of the following areas: cloud security across AWS, GCP, or Azure; web/API application security; Kubernetes and container security; macOS/Linux endpoint security; network penetration testing; or CI/CD pipeline security.
• Track record of discovering impactful vulnerabilities or developing novel attack techniques in production environments.
• Strong programming and scripting skills in Python, Go, or similar languages, with the ability to write custom tooling and exploits.
• Experience with industry-standard offensive tools such as Burp Suite, Cobalt Strike, Sliver, Mythic, Metasploit, BloodHound, and nuclei, along with the ability to operate beyond them.
• Excellent written and verbal communication skills, including the ability to translate complex technical findings into clear risk narratives.
• Experience assessing AI/ML systems, LLM applications, or agentic workflows for security vulnerabilities.
• Bonus: Published security research, conference talks at events such as DEF CON, Black Hat, or BSides, CVE credits, or meaningful bug bounty contributions.

Benefits

• U.S. full-time employees receive benefits including equity, health, dental, vision, retirement, fitness, commuter, and dependent care accounts.
• International full-time employees receive benefits tailored to their region of residence.
• USD salary ranges apply only to U.S.-based positions. International salaries are set based on the local market, and final offers vary based on experience and expertise.