Why This Job is Featured on The SaaS Jobs
Security Researcher roles are increasingly central to SaaS products that sit on top of developer platforms and cloud-hosted code, and this listing is notable for being tied to an agent that operates across GitHub-scale repositories. In a market where customers expect security to be embedded in the product rather than bolted on, the work described connects offensive research directly to a SaaS-style workflow of detection, validation, and remediation.
From a SaaS career standpoint, the role builds durable experience at the intersection of product security and applied automation. It touches the kinds of problems that recur across modern SaaS companies, such as securing distributed architectures, handling supply chain risk, and translating research findings into repeatable systems that reduce false positives and improve outcomes over time. The emphasis on datasets, evaluations, and feedback loops also aligns with how SaaS teams operationalise quality at scale.
This position suits security practitioners who prefer depth over breadth and who enjoy moving between hands-on exploit work and engineering collaboration. It will also fit those comfortable being a technical point of contact for external stakeholders, where clear written analysis and prioritisation matter as much as discovery.
The section above is editorial commentary from The SaaS Jobs, provided to help SaaS professionals understand the role in a broader industry context.
Job Description
About the Team:
Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity.
Codex Security is OpenAI’s first security agent, built to scan GitHub Cloud repositories, validate real vulnerabilities, and integrate with Codex to help generate fixes.
About the Role:
Lead an effort to map, characterize, and prioritize cross-layer vulnerabilities in advanced AI systems – spanning data pipelines, training/inference runtimes, system and supply chain components. You’ll drive offensive research, produce technical deliverables, enhance the Codex Security product line, and serve as OpenAI’s primary technical counterpart for select external partners (including potential U.S. government stakeholders).
What you’ll do:
Conduct deep security research on real-world software systems to discover complex vulnerabilities across large codebases and distributed architectures.
Investigate and validate vulnerabilities discovered by AI-driven security agents, including building proofs-of-concept and exploit demonstrations.
Partner with engineering teams to improve automated vulnerability discovery, validation, and remediation workflows as part of product development.
Build high quality security datasets and evals that will help advance model’s cybersecurity capabilities
Train and improve AI models used for vulnerability discovery, validation, and automated remediation by developing datasets, evaluations, and feedback loops grounded in real-world security research.
Publish technical writeups, research insights, and vulnerability analyses that advance the state of application security.
You may thrive if you:
Have strong experience in vulnerability research, exploit development, or offensive security.
Have deep experience with cutting edge offensive-security techniques
Are fluent across AI/ML infrastructure (data, training, inference, schedulers, accelerators) and can threat-model end-to-end.
Operate independently, align diverse teams, and deliver on tight timelines.
Communicate clearly and concisely with experts and decision-makers.
Care deeply about improving the security of widely used software and open-source infrastructure.
Are a strong developer who can work in a small energetic team
Goals & impact:
Build AI-driven systems that can discover high-impact vulnerabilities in widely deployed systems and open-source software before attackers do.
Improve the precision and effectiveness of AI-driven security agents by grounding them in real-world vulnerability research.
Key technical challenges:
System-level vulnerability discovery — identifying complex vulnerabilities that span multiple services, trust boundaries, or components.
High-confidence validation — distinguishing real exploitable vulnerabilities from speculative or theoretical issues.
Scaling security research with AI agents — guiding automated systems to analyze millions of commits while maintaining research-level rigor.
Automated exploit and proof-of-concept generation — building reproducible demonstrations of vulnerabilities within sandboxed environments.
Building large systems that work within OpenAI's enterprise architecture
About OpenAI
OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core, and to achieve our mission, we must encompass and value the many different perspectives, voices, and experiences that form the full spectrum of humanity.
We are an equal opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, sex, sexual orientation, age, veteran status, disability, genetic information, or other applicable legally protected characteristic.
For additional information, please see OpenAI’s Affirmative Action and Equal Employment Opportunity Policy Statement.
Background checks for applicants will be administered in accordance with applicable law, and qualified applicants with arrest or conviction records will be considered for employment consistent with those laws, including the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, for US-based candidates. For unincorporated Los Angeles County workers: we reasonably believe that criminal history may have a direct, adverse and negative relationship with the following job duties, potentially resulting in the withdrawal of a conditional offer of employment: protect computer hardware entrusted to you from theft, loss or damage; return all computer hardware in your possession (including the data contained therein) upon termination of employment or end of assignment; and maintain the confidentiality of proprietary, confidential, and non-public information. In addition, job duties require access to secure and protected information technology systems and related data security obligations.
To notify OpenAI that you believe this job posting is non-compliant, please submit a report through this form. No response will be provided to inquiries unrelated to job posting compliance.
We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made via this link.
OpenAI Global Applicant Privacy Policy
At OpenAI, we believe artificial intelligence has the potential to help people solve immense global challenges, and we want the upside of AI to be widely shared. Join us in shaping the future of technology.
