Research
Security Researcher (Offensive)
Discover and validate real attack paths across networks, applications, cloud and identity. Your research shapes how Prava AI's penetration testing reasons about exploitability and impact, so that what it reports is reproducible and worth acting on.
About the role
Why this role exists
Prava AI includes AI-guided penetration testing and attack-surface discovery. The models behind it are only as good as the security knowledge they are built on. This role exists to supply that knowledge: how real attackers chain small weaknesses into meaningful access, and how to tell an exploitable path from a theoretical one.
You will spend your time on hands-on research. That means testing authorised targets, building lab environments that reproduce real enterprise patterns, and writing up what you find in a form that engineers and the model team can use. A good week might end with a new technique documented, a lab that reproduces it, and a set of validation steps the platform can follow.
You will own the quality bar for offensive findings. When the platform reports an attack path, it should explain the preconditions, the evidence and the likely impact, and a practitioner should be able to reproduce it. You help define what that means and check that the product meets it. You can read more about the module on the penetration testing page.
Responsibilities
What you will do
- Research attack paths across internal networks, web applications and APIs, cloud control planes and identity systems such as directory services and single sign-on.
- Build and maintain lab environments that reproduce realistic enterprise configurations, so that techniques can be tested safely and repeatably.
- Turn validated techniques into structured knowledge: preconditions, steps, evidence and impact, written so the model and engineering teams can use them.
- Review the platform's penetration testing output for accuracy, false positives and missed paths, and file clear, reproducible issues.
- Help design the safety limits that keep automated testing within scope, avoid disruption and stop when authorisation does not cover a target.
- Work with the threat intelligence team to reflect techniques seen in the wild, mapped to common frameworks such as MITRE ATT&CK.
- Report vulnerabilities you find in third-party software through coordinated disclosure, in line with our responsible disclosure approach.
Requirements
What you will bring
We care about what you can do, not where or how you learned it. If you meet most of these, we would like to hear from you.
- Hands-on experience finding and exploiting vulnerabilities in authorised engagements, such as penetration tests, red team work or bug bounty programmes.
- Depth in at least one of: Active Directory and identity attacks, web and API security, cloud security on a major provider, or network exploitation.
- Working knowledge across the others, enough to follow an attack path from an exposed service to the data it protects.
- The ability to write and read code for tooling and proofs of concept, for example in Python, Go or a similar language.
- Clear technical writing. You can explain a finding so that a defender understands both the risk and the fix.
- Sound judgement about scope, safety and authorisation, and the habit of documenting what you did and why.
- Comfort working with engineers and machine learning practitioners who may not share your background.
Nice to have
Helpful, not required
Disclosure
Public research
Published CVEs, conference talks, write-ups or open-source tools that others use.
Depth
Exploit development
Experience with memory corruption, binary analysis or kernel-level research.
AI
Model-aware testing
Interest in how language models reason about security, or experience testing LLM applications.
Scale
Attack-surface work
Experience with external discovery, asset mapping or large-scale scanning done responsibly.
Your first months
What progress looks like
These are typical outcomes, not fixed targets. Your manager will agree goals with you when you join.
First month
Settle in
You have set up your lab access, learned how the penetration testing module reasons today, and reviewed a sample of its findings with the team.
First three months
Contribute
You have contributed documented techniques in your area of depth and raised issues that improve how the platform validates or explains a class of findings.
First six months
Own
You own a research area end to end, from lab reproduction to how the platform handles it, and other teams come to you for judgement on exploitability.
Tools and environment
How you will work
You will work with tools such as Burp Suite, Nmap, BloodHound, Impacket, Metasploit and common cloud provider command-line tools, alongside debuggers and disassemblers such as Ghidra where research calls for them. You will write your own tooling where existing tools fall short.
Research happens in isolated lab environments and against targets covered by written authorisation. Specific internal tooling and environments are covered during onboarding.
Hiring process
How we hire for this role
This follows our usual hiring process, adapted to the role. We reply to every application and tell you in advance what each stage involves.
- Application. Your CV and a short note. Links to public research, CVEs or write-ups are welcome but not required.
- Introductory call. Your experience, the kind of research you enjoy and what you want next.
- Technical conversation. A discussion of a past finding or attack path, how you validated it and how you explained it.
- Practical exercise. A scoped exercise in a lab environment we provide, followed by a short write-up. We do not use your work in our product.
- Final conversations and offer. Time with leadership, then a written offer from an @prava.dev address.
Security and ethics
Working responsibly
Note. All offensive research at Prava AI happens under written authorisation, within agreed scope and in line with our Acceptable Use Policy. Testing outside authorised scope is never part of this role. Because the role involves access to sensitive environments, offers may be subject to background checks where the law allows.
We never ask candidates for payment, bank details or fees, and interviews and offers come only from @prava.dev addresses. Read more about recruitment fraud and how we handle your application data under our Privacy Policy.
Benefits
What we offer
Benefits vary by country and employing entity, and the specifics are set out in each offer. They include pay set for the role and location, health cover, paid leave, support for learning, the equipment you need and working arrangements that suit the role. See benefits on the careers page. We are an equal opportunity employer; if you need an adjustment at any stage, tell us at careers@prava.dev.
Other open roles
Explore the team
- Machine Learning Engineer (Security LLM) · AI
- DFIR Analyst · Detection and response
- Threat Intelligence Analyst (Dark Web) · Intelligence
- Backend Engineer (Platform) · Engineering
- Detection Engineer · Detection and response
- Solutions Engineer · Customers
- Compliance and GRC Specialist · Customers
Do not see the right fit? Send a general application.
Next step
Apply for this role
Send your CV and a short note about the research you are proudest of. If you have public research, CVEs, talks or tools, include links and describe your part in each, giving fair credit to collaborators. The Apply button opens an email to careers@prava.dev with the role in the subject line.