Remote opportunity at
NebiusOffensive Security Engineer
Nebius is a cloud infrastructure provider focused on the global AI economy, delivering a full-stack platform for developers and enterprises that spans data, model training, and…
Career Tools
About This Role
Nebius is a cloud infrastructure provider focused on the global AI economy, delivering a full-stack platform for developers and enterprises that spans data, model training, and production deployment. Listed on Nasdaq and headquartered in Amsterdam, the company maintains research and development hubs across Europe, the United Kingdom, North America, and Israel, supported by a workforce exceeding 1,500 employees. The internal product security group is currently hiring an Offensive Security Engineer…
Job Description
Nebius is a cloud infrastructure provider focused on the global AI economy, delivering a full-stack platform for developers and enterprises that spans data, model training, and production deployment. Listed on Nasdaq and headquartered in Amsterdam, the company maintains research and development hubs across Europe, the United Kingdom, North America, and Israel, supported by a workforce exceeding 1,500 employees. The internal product security group is currently hiring an Offensive Security Engineer to join a remote-first work environment.
This hands-on engineering position involves designing and executing adversarial simulations across the cloud architecture. The selected professional will perform penetration testing, run red team engagements, and conduct research to uncover complex attack scenarios targeting critical assets within the Nebius tech stack. The role centers on validating threat models, automating routine checks, testing multi-tenant cloud environments, and collaborating with detection and response teams through purple team exercises.
Candidates for this role will engage with novel attack surfaces such as GPU clusters, AI platforms, and multi-tenant cloud infrastructure at scale. The ideal individual brings extensive experience in offensive security, cloud-native environments, and custom tooling development, and is capable of producing clear technical reports with prioritized remediation guidance for both engineering peers and leadership.
Responsibilities
- Validate and extend threat models through continuous penetration testing and assess mitigation statuses
- Automate routine validation tasks to handle feature flows while reserving manual analysis for complex scenarios
- Plan and execute full-scoped red team engagements covering compute, storage, networking, inference, orchestration, and internal tooling
- Collaborate with Detection and Response teams in purple team exercises to validate detection coverage and resolve security gaps
- Research novel attacks directed at GPU infrastructure, inference stacks, and managed AI platform services
- Evaluate tenant-isolation boundaries to identify potential low-level stack vulnerabilities
- Perform targeted security assessments on new products and upcoming infrastructure modifications prior to release
- Produce clear, actionable reports containing prioritized findings and remediation guidance for technical and leadership audiences
- Build and scale red team processes, methodologies, and tooling as the platform expands
Requirements
- Possess at least six years of professional experience in offensive security, penetration testing, red teaming, or adversary simulation
- Demonstrate deep practical experience attacking cloud-native environments, including Kubernetes privilege escalation, container escapes, virtualization issues, and cloud IAM abuse
- Show strong foundational knowledge spanning the complete attack lifecycle from initial access and persistence to lateral movement and data exfiltration
- Display proficiency in writing custom tools and post-exploitation capabilities using languages like Python or Go
- Have prior experience conducting purple team exercises and cooperating constructively with defensive teams
- Be able to compose senior-level reports that frame risk within a business context rather than listing raw findings alone
- Provide authorization to work in the country of application with valid proof of employment eligibility
Qualifications
- Experience attacking machine learning infrastructure, model serving pipelines, or GPU clusters
- Background in reverse engineering and exploit development
- Previous involvement in application security
- Familiarity with kernel-level exploitation or eBPF bypass techniques
- Prior background in vulnerability research or CVE discovery
- Familiarity with cloud provider internals across hypervisor and networking layers
- History of presenting security research at industry conferences such as BlackHat or DefCon
Core Skills
Benefits
- Competitive compensation package
- Equity upside in a high-growth, Nasdaq-listed enterprise
- Opportunities for career growth and ongoing learning
- High degree of flexibility and professional ownership
- Exposure to an international working environment alongside talented teams
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, the posting indicates a flexible, remote-first culture.
What is the employment type?
The role is offered as full-time employment.
What salary does the position offer?
The specific salary is not stated in the posting, though it notes competitive compensation with equity upside.
How many years of experience are required?
Candidates must have six or more years of experience in offensive security, penetration testing, red teaming, or adversary simulation.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
