AI Penetration Tester

Required Skills & Experience· 10+ years in penetration testing, red teaming, and/or application security, including end-to-end delivery (scoping, execution, reporting, retest).· Deep hands-on capability in web and API security testing, including authentication/authorization, session management, access control, and data flow analysis.· Experience testing complex enterprise environments (SSO/IdP integrations, tokens, service-to-service auth, secrets management, logging/telemetry considerations).Job Description· Lead and execute AI security assessments of Copilot-like apps, LLM applications, RAG pipelines, and agent/tool integrations.· Formalize and operationalize an AI testing methodology (scope → test plan → execution → reporting → retest) suitable for regulated enterprise use.· Stand up and mature non-prod AI testing infrastructure and repeatable workflows (safe test data, access patterns, evidence capture, reusable harnesses).· Enable existing pentesters via training, playbooks, reusable test packs, and quality review of findings/evidence.· Drive governance and defensibility: human-in-the-loop decisions, safe testing constraints, reproducible evidence, and consistent severity rationale.· Communicate outcomes to technical teams and leadership: themes, control gaps, remediation priorities, and validation results.· Demonstrated hands-on experience assessing AI-enabled applications, including one or more of:o LLM application security testing (prompt injection, data leakage, insecure output handling)o RAG security testing (retrieval manipulation, ingestion risks, exposure paths)o Agent/tool integration testing (tool boundary violations, unintended actions, privilege misuse)· Strong understanding of AI/LLM risk categories and how they translate into enterprise impact (confidentiality, integrity, availability, operational risk, and regulatory/audit concerns).· Ability to design safe, controlled testing approaches for AI systems (rules of engagement, non-prod usage, safe test inputs, rate/cost controls where applicable).