GenAI Security Evaluation Engineer

You will create and evaluate code-based examples that test how well static analysis tools find security problems in generative AI applications. The work covers runnable agent and retrieval-augmented generation repositories, including risks involving sensitive information disclosure and excessive agency.

You will combine secure software engineering, vulnerability analysis, deterministic testing, and structured technical annotation.

• Build small, runnable agent and retrieval-augmented generation repositories with code-reachable vulnerabilities.
• Create vulnerable, fixed, and hard-negative versions with only small security-relevant differences.
• Trace and annotate assets, data paths, action paths, controls, root causes, severity, and residual risk.
• Define authorization contexts and write deterministic tests for vulnerable, fixed, and negative behavior.
• Recommend security controls and contribute to calibration and peer review.
• Work across tool calling, memory, and Model Context Protocol systems.

What it pays and takes

This is a remote contractor engagement lasting up to two weeks. Compensation is up to $150 per hour, depending on evaluation and location.

• Pay: up to $150 per hour.
• Time: at least 20 hours per week.
• Schedule: at least 4 hours of overlap with Pacific Time.
• Location: open worldwide for remote work.
• Language: fluent in English.
• Experience: at least 5 years in application security, product security, or security-focused software engineering, including secure code review.
• Security analysis: experience with source-to-sink analysis, taint analysis, SAST, CodeQL, or Semgrep.
• GenAI systems: hands-on experience building LLM agents or retrieval-augmented generation systems with tools such as LangChain, LlamaIndex, OpenAI or Anthropic SDKs, or MCP.
• Security knowledge: strong understanding of authorization, trust boundaries, tenants, OAuth, IAM, identity, permitted data and actions, recipients, and document-level access control.
• Programming: production coding experience in Python and/or TypeScript.
• Judgment: ability to distinguish genuine security findings from non-findings.
• Helpful background: OWASP LLM security risks, MCP, threat modeling, or security evaluation.

How it works

Apply on OpenTrain with your resume, then complete the application on the hiring site. OpenTrain is a platform where people find AI training and data-labeling work and start their applications.

About AI training work

AI training work is the human work behind artificial intelligence, including preparing examples, reviewing model behavior, and evaluating code or system outputs. Experienced contributors are paid for applying specialized knowledge that helps make AI systems more accurate, useful, and secure.