Nebius·Europe·16 июля
Offensive Security Lead
🌍 УдалённоSeniorПолная занятость🌐 Глобал
52
Есть о чём спросить
Навык востребован (python). Но вилки нет, про деньги придётся договариваться с нуля.
Наша компания
Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. Offensive security The internal offensive security team is responsible for the penetration testing program, red team engagements, and offensive research aimed at uncovering sophisticated attack scenarios targeting high-value assets across the Nebius Cloud stack.
Чем предстоит заниматься
We're hiring an Offensive Security Lead to build and run Nebius' red team capability. You'll design and execute adversarial simulation across our cloud platform - attacking the same infrastructure our customers depend on - and translate findings into measurable security improvements
This is a hands-on leadership role within Product Security Team. You will build an internal red team, establish a penetration testing program, and conduct research to uncover sophisticated attack scenarios targeting high-value assets across the Nebius tech stack
Build and lead a red team function within Product Security Team, hiring and developing offensive security engineers
Validate and extend early-stage Secure SDLC threat models via continuous penetration testing, assessing threat severity and mitigation status while challenging assumptions made during threat modeling and system development. Automate routine validations to keep pace with increasing feature flow, reserving manual analysis for genuinely complex cases
Plan and execute full-scoped red team engagements against Nebius cloud platform - including compute, storage, inference, networking, orchestration layers, and internal tooling. Identify threats, which are able to impact an organization's operations. Work closely with Detection & Response and other security engineering teams to run purple team exercises, validate detection coverage, and close gaps collaboratively
Research novel attacks against GPU infrastructure (e.g., closed-source firmware and vendor driver binaries, device passthrough exploits, SR-IOV/IOMMU misconfigurations, RDMA/InfiniBand fabric attacks, etc.), the inference stack (e.g., vLLM, TRT-LLM), and AI platform managed services (e.g., managed Slurm). Assess tenant-isolation boundaries and how they can be broken at the low-level stack
Conduct targeted assessments of new products and infrastructure changes before they ship
Deliver clear, actionable reports for both technical audiences and leadership - with prioritized findings and remediation guidance
Establish red team processes, tooling, and a methodology that scales as the platform grows
Наши требования
6+ years in offensive security - penetration testing, red teaming, or adversary simulation - with at least 1-2 years leading or mentoring a team
Deep experience attacking cloud-native environments: Kubernetes privilege escalation, cloud IAM abuse, virtualization and container escapes
Strong fundamentals across the attack lifecycle: initial access, persistence, lateral movement, data exfiltration
Proficiency developing custom tooling and post-exploitation capabilities (Python, Go, or similar)
Experience running purple team exercises and working constructively with blue teams
Ability to write clear, senior-level reports with business-contextualized risk (not just raw findings) that engineers can easily use
Experience attacking ML infrastructure, model serving pipelines, or GPU clusters
Reverse engineering and exploits development experience
Application security experience
Familiarity with eBPF bypass techniques or kernel-level exploitation
Background in vulnerability research or CVE discovery
Experience with cloud provider internals (hypervisor/networking layers)
Presenting your security research at conferences like BlackHat/DefCon, etc
Мы предлагаем
Competitive compensation
Career growth and learning opportunities
Flexibility and ownership
Collaborative and innovative culture
Opportunity to work on impactful AI projects
International environment and talented teams
Build a red team from scratch at a company operating frontier AI infrastructure
Attack surface that's genuinely novel - GPU clusters, AI platforms, multi-tenant cloud at scale
Work alongside world-class engineers on infrastructure that powers frontier AI
Competitive compensation with equity upside in a Nasdaq-listed, high-growth company
Flexible, remote-first culture
Дополнительно
Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI
Технологии и навыки
Мы против мошенников на площадке: если тебя просят заплатить, продиктовать код или установить непонятное приложение, прекращай общение и сразу пиши нам (чат с основателем или форма обратной связи).