Runlayer
Member of Technical Staff - Security Research
NYC +2 · Hybrid · Staff · Full-time · Posted Sep 28, 2026
- Location
- NYC
Remote (US Timezones)
SF - Experience
- 5+ years in offensive security research, vulnerability research, or red teaming.
About the job
Research and exploit security vulnerabilities in AI agent ecosystems, publish findings, and turn them into protections for Runlayer customers.
What you'll do
- Find vulnerabilities across MCP servers and clients, AI coding agents, frameworks, skills, plugins, and OAuth flows; conduct coordinated disclosure.
- Publish technical research, tools, and talks, and run ecosystem-scale studies of MCP servers.
- Convert research into product detections, scanner rules, and risk ratings; contribute to MCP security work and brief customers, prospects, and press.
What they ask for
- 5+ years in offensive security research, vulnerability research, or red teaming.
- Public record of CVEs or advisories, conference talks, or published tools and write-ups.
- Depth in agent-native attacks, including prompt injection, tool poisoning, OAuth attacks, and supply-chain attacks.
- Writes Python, TypeScript, or Go; communicates clearly and exercises sound disclosure judgment.
Nice to have
- Published research on LLM, agent, or MCP security.
- Experience on a security vendor research team or at an offensive security consultancy; talks at major security conferences are also noted.
Tools
MCP, Python, TypeScript, Go, OAuth
AI focus
Security research on AI agents and their ecosystem, using AI agents as tools and targets and translating findings into customer protections.
Model-written summary · the original posting is authoritative