Offensive Security Engineer (AI Cloud)

Location: Amsterdam, Netherlands; remote-first culture.

Company

Nebius builds a full-stack AI cloud platform covering data, model training, inference, and production deployment for developers and enterprises.

What you will do

• Design and execute continuous penetration testing and full-scope red team engagements across compute, storage, inference, networking, orchestration, and internal tooling.
• Validate Secure SDLC threat models, assess threat severity and mitigation status, and automate routine security validations.
• Research novel attacks against GPU infrastructure, firmware, drivers, device passthrough, SR-IOV/IOMMU, RDMA/InfiniBand, inference stacks, and managed AI services.
• Assess tenant-isolation boundaries and conduct targeted security reviews of new products and infrastructure changes.
• Run purple team exercises with Detection & Response and security engineering teams to validate detection coverage and close gaps.
• Establish scalable red team processes, tooling, methodology, and reporting practices with prioritized remediation guidance.

Requirements

• 6+ years of experience in offensive security, penetration testing, red teaming, or adversary simulation.
• Deep experience attacking cloud-native environments, including Kubernetes privilege escalation, cloud IAM abuse, virtualization, and container escapes.
• Strong knowledge of the attack lifecycle, including initial access, persistence, lateral movement, and data exfiltration.
• Proficiency developing custom tooling and post-exploitation capabilities with Python, Go, or similar languages.
• Experience running purple team exercises and collaborating constructively with blue teams.
• Ability to write clear senior-level reports with business-contextualized risk and actionable remediation guidance.

Nice to have

• Experience attacking ML infrastructure, model-serving pipelines, or GPU clusters.
• Reverse engineering, exploit development, vulnerability research, or CVE discovery experience.
• Application security experience and familiarity with eBPF bypass techniques or kernel-level exploitation.
• Experience with cloud provider internals, including hypervisor and networking layers.
• Security research presentations at conferences such as BlackHat or DEF CON.

Culture & Benefits

• Flexible, remote-first work culture with ownership and autonomy.
• Competitive compensation with equity upside in a Nasdaq-listed company.
• Career growth and learning opportunities.
• Collaborative, international environment with experienced engineering teams.
• Opportunity to work on impactful AI infrastructure and novel security challenges.