Principal Attack Engineer (AI/LLM Security)

Location: US, Remote; up to 10% travel may be required.

Base salary: $238,000–$280,000 per year, plus eligible equity in the form of stock options.

Company

hirify.global is a remote cybersecurity product company developing NodeZero, an autonomous pentesting platform that finds, fixes, and validates exploitable attack paths across internal, external, cloud, and hybrid-cloud environments.

What you will do

• Define the long-term technical vision, architecture, standards, and roadmap for AI/LLM offensive capabilities in NodeZero.
• Lead company-wide initiatives across Attack Engineering, Platform, Product, customer-facing teams, and other technical functions.
• Own coverage strategy for the OWASP Top 10 for LLM Applications and extend it to multi-agent and tool-connected systems.
• Direct research and productization covering prompt injection, defense evasion, tool-use exploitation, context poisoning, remote code execution, data exfiltration, privilege escalation, and model or supply-chain attacks.
• Set technical direction for AI infrastructure, including model serving, training pipelines, vector databases, GPU/MLOps tooling, and enterprise deployments.
• Guide LLM-powered offensive applications, agentic workflows, microservices, evaluation systems, reliability practices, safety controls, observability, and operational readiness.

Requirements

• Exceptional Python and software engineering expertise, with experience designing secure, reliable, observable, and operable systems at scale.
• Deep expertise in offensive security, penetration testing, exploit development, vulnerability research, or a closely related discipline.
• Recognized expertise in AI/LLM and agentic-system security, including identifying novel attack paths and translating them into technical strategy.
• Deep command of the OWASP Top 10 for LLM Applications and MITRE ATLAS, with the judgment to extend beyond existing frameworks.
• Track record of shipping or shaping high-impact security capabilities, platforms, research programs, or technical standards across multiple teams.
• Ability to define long-term technical vision, resolve ambiguous company-wide problems, and drive execution through influence rather than direct authority.
• Company-wide technical judgment across product value, safety, reliability, cost, speed, and maintainability.
• Proven ability to develop senior technical talent and expand an engineering organization’s mentorship capacity.
• Self-motivated, highly credible, and deeply engaged with the direction of the AI security industry.

Nice to have

• Experience setting technical direction or architecture across an engineering organization or multiple product areas.
• Industry-level AI security research contributions through publications, conference talks, CVEs, open-source projects, or widely adopted techniques.
• Experience with AWS Bedrock, AWS Agent Core, Azure OpenAI, or Google Vertex AI.
• Deep experience with agentic architectures, tool-use security, retrieval systems, vector databases, Neo4j or other graph databases, or AI infrastructure security.
• Traditional exploit development, vulnerability research, or offensive security platform experience at significant scale.
• CTF experience, particularly in AI/ML-focused challenge categories.
• External technical leadership that strengthened technical credibility, recruiting reach, or market position.

Culture & Benefits

• Fully remote work with a collaborative culture focused on respect, ownership, inclusion, and results.
• Up to 10% travel may be required; Horizon3 also supports hybrid work for some roles, including roles requiring regular presence at the Chicago office.
• Full-time employees are eligible for equity and benefits including health, vision, and dental insurance for employees and families.
• Flexible vacation policy, generous parental leave, and career development opportunities.
• Inclusive environment emphasizing diversity, equity, inclusion, innovation, and professional growth.

Hiring process

• Application materials may redact or remove age-identifying information, including age, date of birth, and dates of school attendance or graduation, without penalty.