SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Armadin Security is building autonomous proactive security powered by AI agents that discover, exploit, and chain vulnerabilities across external, internal, identity, cloud, and application attack surfaces. Led by Kevin Mandia (founder of Mandiant, acquired by Google for $5.4B), the company brings together researchers and engineers from Google, xAI, Meta, Stanford, Georgia Tech, Waterloo, Berkeley, and MIT.
As a Senior Red Team Operator, Applications, you will be the training signal for Armadin's agentic attacker swarm. Your hands-on red team tradecraft will be encoded into AI agents that run continuously at machine speed against live production environments. In a recent engagement, the swarm generated over 17 million offensive actions in three days and validated 38 attack paths.
You will run full kill chains against web, mobile, API, and thick/thin client applications, hunting logic flaws and chaining weaknesses that scanners miss. You'll prove exploitability with working exploitation and clear evidence, map blast radius from application compromise through identity and cloud systems, and review source code across languages for control-flow flaws and injection paths. You'll use static and dynamic analysis, binary reversing, runtime instrumentation, and API testing to understand how applications really work.
Critically, you'll translate your tradecraft into the techniques and decision logic that make AI agents operate like expert operators. You'll pressure-test the swarm's attack paths, spot where it's naive, and make human-in-the-loop calls that keep autonomous operations safe and accurate. You'll also write scripts, tools, and plugins extending Armadin's offensive capabilities, deliver attack narratives to engineers and executives, research emerging vulnerability classes and AI-driven attacker tradecraft, and own concurrent operations with startup-level autonomy.
This is a small, scrappy team with high ownership. Your work reaches enterprises through industry-leading partners. The problems are novel: what does a kill chain look like when it can branch a thousand ways in parallel? How do you prove exploitability instead of just flagging it? What does continuous hyperattack find that a two-week engagement never could?
REQUIREMENTS:
- Deep, hands-on application offense: web app and API exploitation beyond OWASP Top 10, including business logic abuse, authentication/authorization bypass, and injection chains.
- Depth in at least one additional attack surface: mobile (iOS/Android reversing, runtime hooking, insecure storage, traffic interception); thick/thin clients (desktop apps, client-server protocols, memory analysis); source code review (control-flow issues, injection paths, insecure design); or reverse engineering (applications, obfuscators, custom encryption).
- Fluency with offensive tools: Burp Suite, Caido, ZAP, Frida, jadx, Ghidra, IDA Pro, with judgment to know when tools are wrong.
- Systems understanding: strong grasp of network protocols, client-server architecture, and full range of application vulnerability classes and how they chain.
- Proficiency across Linux, Windows, and macOS; scripting in Bash, Python, or similar.
- AI-forward working style: already using AI tools for recon, analysis, or tooling; excited to push further.
- Sharp human-in-the-loop judgment: absorb information quickly, make time-sensitive calls under pressure, explain reasoning to safety and engineering teams.
- Builder's startup mindset: scrappy, self-directed, comfortable with ambiguity, prefer shipping useful work over waiting for process.
- Clear communication with clients: translate complex attack chains for engineers, executives, and legal counsel.
- Must be eligible to work in the United States without sponsorship. Ability to travel up to 20% for on-site engagements or client meetings.
PLUS (nice-to-have):
- Built offensive automation or worked alongside AI/ML (agentic frameworks, ML-assisted fuzzing, automated exploitation pipelines).
- Shipped offensive tooling (Burp/Caido extensions, open-source offensive projects, custom frameworks).
- Public hunting: bug bounty findings, CVEs, CTF wins, or application-security conference talks.
- Active on PortSwigger Web Security Academy, Hack The Box, or TryHackMe.
- Relevant certifications: OSWE, Burp Suite Certified Practitioner, GWAPT, CWES, eWPTX, eMAPT, or TCM Practical Web and Mobile Pentest tracks.
