[Hiring] Senior Security Engineer @Trail of Bits

Role Description

AI has transformed the cost curve for formal verification. Network boundaries, infrastructure, operating system components, cryptographic libraries, and proof-checking kernels can now ship with genuine mathematical guarantees attached, and those guarantees are narrower than the word "verified" leads anyone to believe. We are looking for candidates who have both the rigor to read a proof and say exactly what it establishes, and the instinct to find what it left out.

• Evaluate specifications alongside their designs and proofs.
• Determine what has actually been established versus what has merely been assumed.
• Use state-of-the-art tools and frontier AI models to explore everything the proof does not reach.
• Identify ordinary memory corruption and threats that ignore real attackers.
• Conduct red-team evaluations scheduled for a one-week sprint with seven weeks to prepare.
• Build tooling that determines coverage during evaluations.
• Work in small teams and with third parties, reporting to a domain lead.
• Occasionally attend sprints and hackathon events in London.

Qualifications

• Red teaming: Direct experience with red teaming production software, personally responsible for finding and proving exploitable vulnerabilities.
• Building AI tools that find bugs: Experience building AI-driven tooling for vulnerability discovery.
• Formal methods: Experience applying formal methods to system designs and code implementations.
• Depth in a systems domain: Experience finding vulnerabilities in network protocol implementations, operating system internals, open-source software, cryptographic implementations, or AI inference infrastructure.
• Software development: Experience in Python, C++, and/or Rust.
• Written findings for expert readers: Experience producing security assessment reports for an audience that will scrutinize every claim.
• Delivery to a fixed external schedule with defined acceptance criteria.
• Vulnerability Disclosure: Experience in the ethical reporting of vulnerabilities in technology.

Requirements

• Published vulnerability research: CVEs, advisories, or talks at venues like OffensiveCon, RECon, CCC, or USENIX Security.
• Experience auditing or contributing to a formally verified codebase such as HACL*, EverCrypt, seL4, CompCert, or CakeML.
• Experience building automated bug-finding infrastructure at scale: cyber reasoning systems, fuzzing fleets, or symbolic execution engines.
• Experience with zero-knowledge proof systems, proof-checking kernels, or SMT-backed tooling.
• Experience attacking AI inference infrastructure: weight confidentiality and integrity, tenant isolation, or output mediation.
• Participation in CTF competitions, Pwn2Own, DARPA's AI Cyber Challenge, or similar.
• Experience with compiler technology, program analysis, or binary analysis.
• Experience in reading, writing, and publishing academic papers.

Benefits

• Competitive compensation complemented by performance-based bonuses.
• $1,000 Working-from-Home stipend to create a comfortable and productive home office.
• Annual $750 Learning & Development stipend for continuous personal and professional growth.
• Company-sponsored all-team celebrations, including travel and accommodation, to foster community and recognize achievements.
• Philanthropic contribution matching up to $2,000 annually.