Senior Software Security Engineer - AI Trainer

Role Overview:
We are seeking a Senior Software Security Engineer to develop high-quality training and evaluation tasks for frontier AI coding models. You will transform real-world open-source vulnerabilities—including CVEs, security advisories, and bug reports—into Harbor-format audit-and-patch tasks across multiple programming languages.

This role combines software security research, vulnerability reproduction, benchmark development, automated testing, and technical review. The goal is to create realistic tasks that evaluate whether AI systems can identify, understand, exploit, and securely remediate software vulnerabilities without relying on superficial pattern matching or known patches.

What does day-to-day look like
• Source and analyze real-world vulnerabilities from CVEs, security advisories, bug reports, and open-source repositories.
• Classify vulnerabilities using the most specific applicable CWE and map them to relevant OWASP Top 10 categories where appropriate.
• Reproduce vulnerabilities and develop reliable proof-of-vulnerability tests.
• Build Harbor-format audit-and-patch tasks across languages such as Python, JavaScript/TypeScript, Java, C/C++, C#, Go, Rust, Ruby, PHP, Kotlin, and Swift.
• Write realistic task instructions that describe the security issue without revealing the vulnerable code, exploit details, or expected fix.
• Create reproducible Docker-based environments with pinned dependencies and clear setup procedures.
• Harden verifiers against gaming, overfitting, test manipulation, and hardcoded solutions.
• Screen out tasks that can be solved by copying a well-known upstream patch without understanding the vulnerability.
• Review and score AI-generated patches and reasoning using clearly defined technical rubrics.
• Document vulnerability context, reproduction steps, expected behavior, patch requirements, test methodology, and review decisions.

Requirements
• 5+ years of professional software engineering experience.
• Expert-level proficiency in at least one of Python, JavaScript/TypeScript, Java, C/C++, C#, Go, Rust, Ruby, PHP, Kotlin, or Swift.
• Strong understanding of software security concepts, including CWE, CVE, and the OWASP Top 10.
• Ability to reproduce vulnerabilities and write proof-of-vulnerability tests.
• Hands-on experience with security tooling, including sanitizers, fuzzers, and static-analysis tools such as CodeQL or Semgrep.
• Strong proficiency with Git, Linux, Bash, and Docker.
• Excellent technical writing and documentation skills.
• Ability to work independently in a fully remote, research-oriented environment.

Offer Details
• Commitments Required: 40 hours per week with overlap of 4 hours with PST.
• Engagement Type: Contractor assignment (no medical/paid leave)
• Duration of contract : 3 month; [expected start date is next week]

Evaluation Process
• Round 1: Technical Interview (60 mins)