Test LLM-powered and agent-based applications for prompt injection (direct and indirect), jailbreaks, system-prompt and sensitive-data leakage, insecure output handling, misuse of tool and function calls, excessive agent permissions, and abuse of agent memory and context. Assess the security of agents and MCP servers: tool permissions, authentication and authorization between agents and tools, trust boundaries between agents, and how far an attacker can get when an agent is compromised. Assess the AI supply chain and data pipelines, including retrieval (RAG) data sources, vector stores, model and plugin provenance, and the risk of poisoned training or fine-tuning data. Chain findings across application, cloud, identity, and network layers into realistic attack paths that show business and customer impact. Clarify priorities and dependencies across groups, explain key security issues to upper management, and work with partners to put fixes in place. Use AI agents to speed up recon, triage and regression testing, with clear guardrails and human sign-off. Master's Degree in Statistics, Mathematics, Computer Science, or related field AND 3+ years experience in security or related field These requirements include, but are not limited to the following specialized security screenings: 5+ years of hands-on penetration testing or red teaming across cloud (Azure, AWS, GCP), web and API, identity, and network. Hands-on experience assessing LLM applications or AI agents in production or pre-production, using the OWASP LLM Top 10, OWASP Agentic AI guidance and MITRE ATLAS. Understanding modern AI architectures: retrieval-augmented generation (RAG), agent orchestration frameworks, function and tool calling, MCP, and cloud AI platforms such as Azure AI Foundry, Azure OpenAI, Amazon Bedrock or Vertex AI. Strong coding in Python plus one or more of C#, Go, PowerShell, JavaScript/TypeScript or Rust. Able to turn research into tools you can run in engagements. Experience with tools such as Burp Suite Pro, Metasploit, Cobalt Strike or Sliver, AI tooling etc . Familiarity with governance and regulatory frameworks relevant to regulated industries: NIST AI RMF, EU AI Act, ISO 27K, HIPAA, PCI-DSS, SOC2 etc. Experience with APT emulation, purple teaming, threat intelligence, or bypassing operating systems and security control mitigations, including AI guardrails and content filters. Certifications such as OSCP, OSEP, GPEN, GWAPT or GXPN, and AI-security credentials. Strong teamwork, comfort with ambiguity, and the ability to mentor peers and learn new attack techniques quickly.