Offensive Security RL Researcher

San Franciscofull timeOn Site

Apply on Employer Site

mid

$200k–$500k

H1B: no

Idler The Offensive Security RL Researcher leads idler's cybersecurity work by deciding which environments to build, managing systems that produce them, and recruiting part-time experts for review. The role involves working directly with frontier AI researchers to understand and deliver cybersecurity capabilities and data.

Responsibilities

idler is looking for an elite security researcher who can also build. You'll lead idler's cybersecurity work: deciding which environments we build, building and running the systems that produce them, recruiting and managing the part-time experts who review them, and working directly with researchers at frontier AI labs to understand what they need and sell them what we build.
You're a security researcher first. We need someone whose judgment about what counts as a real vulnerability, what makes a task fair, and where the field's genuine skill hierarchy actually sits, we can trust without double-checking. Software development is the tool you use to put that judgment into a production pipeline — it's not a second, parallel discipline we're hiring for separately.
One note on scope: if idler stops investing in cybersecurity, you'd move to a different project inside the company rather than leave — we want to say that plainly now rather than have it be a surprise later.
Drive the roadmap for idler's cybersecurity evals and environments, and decide — using our cybersecurity capability map — which environments we build next and where we put engineering resources.
Build and run the systems that produce those environments yourself; you'll write production code where it matters, not just spec it out for someone else to build.
Recruit, onboard, and manage the part-time cybersecurity experts who review our environments for fairness, correctness, and quality.
Work directly with researchers at frontier AI labs to understand what cybersecurity capabilities and data they want, and sell them the environments that meet it.

Qualification

You might excel if youHave a public bug bounty track recordIn-person in San Francisco

Required

3+ years of experience in a professional cybersecurity role, with a track record that puts you in the top 5% of your peers by reputation.
Deep hands-on experience in at least one of: web app pentesting, bug bounty hunting, vulnerability/zero-day research, hacking agents, or AI security.
Well-connected within the security community — this makes recruiting and evaluating the part-time experts you'll manage far easier.
Comfortable writing and shipping production code (Python, TypeScript, or similar). You don't need a decade of software engineering experience, but you need to build and maintain the systems your research depends on, not hand that off entirely.
Strong written communication — you'll justify prioritization calls to researchers and explain findings to people who didn't do the work themselves.
You might excel if you...
Have a public bug bounty track record, live-hacking-event invitations, Pwn2Own placements, or published original research — send us a writeup of some of the best bugs you've ever found.
Have managed or mentored other security researchers or hackers before.
Have thought seriously about how to measure or grade security work that isn't simply pass/fail.
Have built tools or automation to support your own research, even if you wouldn't call yourself a software engineer.
In-person in San Francisco
$200K–$500K base salary + meaningful equity.