Own 01Start to close
Run engagements end to end
Scope, attack, findings, hardening, retest. Your name is on the work, and you decide how it is done.
We hire for what you have broken.
Years served, certifications, and past employers count for less than one thing: something you took apart that its builders were sure was closed, and how you proved it.
- Role
- Senior offensive security operator
- Where
- Singapore preferred
Strong APAC-remote considered - Entity
- Serpio Pte. Ltd. (UEN 202642849C)
- Show us
- hello@serpio.ai
The role.
You lead adversarial testing against production systems: models, agents, pipelines, applications, and the rest of the software stack, including the permission boundaries between them. AI is where we go deepest. You scope the work with the client, run the attack, prove the finding, and stay for the part where it gets fixed.
Most first engagements are a scoped adversarial test, and you lead them.
Own 02The attack
Attack the system properly
Direct and indirect prompt injection, agent tool-abuse, permission and confused-deputy escalation, RAG and model supply chain, plus the applications, APIs, and infrastructure around them.
Own 03After the finding
Close the loop into defense
Findings become concrete design and control changes the client’s engineers can ship, verified by re-running the attack that broke them.
Own 04Compounding
Grow the attack-pack library
Encode what you know as attack packs mapped to a coverage taxonomy, so the next engagement starts ahead of where the last one finished.
The classes we test for are the threat register. Coverage states, severity and the six phases behind them are on the method page, and the map each engagement leaves behind is Serpio Atlas.
Your first quarter.
A typical path; your calendar will differ. You are measured on whether each finding holds up and whether the fix survives the retest.
2 of 6 steps open1 human gate90 days
Owns
Scope, rules of engagement, test windows and data handling, agreed in writing with the client before anything is touched.
Produces
A signed scope: named targets, stop conditions, credential handling, and the surfaces you are not touching.
Judged on
You agree the scope before testing starts, and nothing is touched that was not agreed first.
Owns
The attack classes below, plus the applications, APIs and infrastructure around the model.
Contains
LLM01, AG1, AG2, LLM08, SC1
Produces
A finding for every class you can actually reach, each with a reproduction.
Judged on
Evidence grade. Severity follows demonstrated impact.
Owns
Every high-impact step stops here and waits for a person to decide it should run. Named stop conditions halt testing without waiting for a confirmation.
Produces
A written decision for each high-impact step: what it does, what it could break, and who accepted that.
Judged on
The gate held on every high-impact step.
Owns
A fix for each finding, agreed with the client’s engineers.
Produces
Changes in their repository, written so their engineers can read them without you in the room.
Judged on
The change fixes the whole class as well as the reproduction you hit.
Owns
Re-run the attack against agreed changes and record what is closed, still open, or regressed.
Produces
A closure state per finding, and the reviewed system written onto the Atlas map.
Judged on
Each closure claim is backed by a passing retest.
Owns
The next engagement, scoped the same way, starting from the attack packs the first one added.
Produces
A signed scope and the first findings against it.
Judged on
The same two rules: the gate holds, and every finding reproduces.
Illustrative example, not client data.
Two rules are hard all quarter: every high-impact step waits at the gate, and a finding you cannot reproduce stays out of the report.
The bar.
Five things we test you on, then four that help but are optional. No certificate appears on either list.
| Requirement | What we are looking for |
|---|---|
| Proof of workRequired | Real offensive delivery against production systems. Red team or penetration testing that someone paid for and acted on. |
| AI depthRequired | Depth in attacking AI systems, or the demonstrated ability to get there fast. Agents with real permissions are the interesting part. |
| InfrastructureRequired | Cloud and Kubernetes literacy. Most of what an attacker reaches sits in the infrastructure around the application and the model. |
| Evidence gradeRequired | Evidence-grade work. You prove findings and you do not inflate severity. |
| StandingRequired | Client-facing communication. You can sit across from a CTO or CISO and be the person who signs off. |
Helpful, but optional.
- Reverse-engineering depth: binaries, toolchains, vendor components.
- Experience with agent frameworks, fine-tuning, or building your own tooling.
- Published research, CVEs, advisories, or serious CTF results in pwn and RE.
- Singapore or APAC network and market knowledge.
If you are early but the instinct is obviously there, send one thing you broke properly: a homebrew release, a from-scratch reversing writeup, a glitch or coldboot result, a fuzzer you built because the existing one annoyed you.
We work with people who publish responsibly. That rules out piracy and anything done to systems you had no permission to touch.
Show the work.
Send a note to hello@serpio.ai with three things: what you broke, how you proved it, and why adversarial testing of production systems is where you want to spend the next few years.
Send links where you can: a writeup, a repo, an advisory, a video of the thing failing. Skip the cover letter. You will get a real answer either way.
We use your application details to assess your fit and contact you about the role. We retain them while needed for recruitment or legal or business requirements, then delete or anonymise them. For access, correction or deletion, write to hello@serpio.ai.