Careers
Come work on cybersecurity's most challenging problems
We're looking for people who are hungry for knowledge and constantly thinking about security - how software and systems can fail, how they can be attacked, and how they can be made better.
Open roles
Who we're hiring now
All roles are currently remote within the U.S., and require U.S. or EU citizenship and a background check.
-
Senior Software Engineer, Agentic Development
Join the team building Nemesis, our AI-native offensive security platform, and drive engineering projects end to end by directing AI coding agents.
-
Senior Cybersecurity Consultant
Lead AI red teaming, penetration testing and full-scope assessments of AI systems and everything they run on, using AI and agentic testing tools to go deeper, and run your client engagements independently.
-
AI Governance Program Manager
Partner with engineering teams to assess their AI systems and guide them through hardening LLM-based systems, with responsible AI governance built in, to meet release standards.
Senior Software Engineer, Agentic Development
Full-time · Remote, U.S. · Engineering
About the role
Casaba is a security consultancy whose clients include some of the world's largest technology companies. We also build a growing body of software, for our own use and for clients, much of it with AI coding agents. The largest project is Nemesis, our AI-native offensive security platform. Its agents reason about client code the way an expert does, trace how a system can be attacked, and investigate live targets to prove what they find. Our consultants run and orchestrate engagements on it.
You'll drive engineering projects end to end, for the firm and for our clients: keeping them reliable as they roll out, fixing what real use uncovers, and building what our consultants and clients need next.
Whatever the project, you'll work by directing AI coding agents. The agents write most of the code. You set the direction, verify what they produce and make the engineering decisions, with a high degree of autonomy. Major product decisions go to your lead.
What you'll do
- Lead fixes and features from report to release with AI coding agents, through design, implementation, testing and deployment.
- Verify the work independently. Review the changes, test the product hands-on, and catch the agent when it is confidently wrong.
- Keep Nemesis reliable, diagnosing and resolving issues from live engagements across our cloud services and the consultants' own environments.
- Work with our consultants to understand their methodology, and turn their needs into product capabilities.
- Handle deployment and operations across cloud services, containers and releases.
- Take on other engineering projects as priorities change, from internal tools and new platforms to software we build for clients.
- Keep your lead informed through concise written updates, and escalate the decisions that warrant it.
What we're looking for
- Rigor in verifying AI output. You treat plausible-looking work as unproven until you've seen it run.
- Substantial, recent experience delivering production work with agentic coding tools such as Claude Code, Codex or Cursor.
- 5+ years building and operating production software, with a computer science background or equivalent experience.
- Range across languages and systems. You read unfamiliar code quickly and accurately, and can judge whether an agent's design is sound anywhere in a multi-language codebase spanning web and cloud services.
- Deep, hands-on cloud infrastructure expertise, including Azure: how services, containers, networking, identity and secrets fit together. Agents can write the configuration; you know when it's wrong. We run on Azure.
- Experience building production systems on LLMs: prompt and pipeline design, model selection, cost control and evaluating output quality.
- A strong bias to action and little need for process or meetings. You make most decisions yourself and recognize the ones that need escalating.
- Sound judgment where mistakes are irreversible, such as handling client data or changing production systems during live engagements.
- Clear, concise written communication.
- Disciplined handling of secrets and sensitive data. You'll work with client source code under strict confidentiality obligations.
Nice to have
- A background in penetration testing, vulnerability research or application security. This isn't required; you'll learn our methodology from our consultants.
- Experience shipping and supporting software that other engineers rely on every day.
Senior Cybersecurity Consultant
Full-time · Remote, U.S. · Consulting
About the role
Casaba is a security consultancy, trusted since 2002, whose clients include some of the world's largest technology companies. We test AI and everything it runs on. Our consultants run the engagements: AI red teaming and penetration testing of models, agents and LLM-based features, and full-scope assessments of the applications, cloud platforms and devices beneath them, from scoping through the final readout.
As a senior consultant you lead engagements end to end. You scope the work with the client, find the vulnerabilities that matter, prove they're exploitable, and write findings the client's engineers can act on. You run the client relationship for your engagements with little oversight, and you set the standard for the consultants working alongside you.
You'll also shape how we work. Our consultants' methodology drives Nemesis, our AI-native offensive security platform. You'll use AI throughout your work: to understand unfamiliar code and systems fast, to direct testing agents against live targets, and to build new agentic testing capabilities with the engineers so the whole team tests deeper.
What you'll do
- Lead full-scope assessments across AI security, penetration testing and red teaming, from scoping and threat modeling through testing, reporting and readout.
- Find exploitable vulnerabilities by hand and prove their impact. Review automated and AI-generated findings and discard the ones that aren't real.
- Write clear, prioritized reports that a client's engineers can act on, and present them to technical and executive audiences.
- Manage client engagements independently: schedules, communication, scope changes and escalations.
- Build threat models and advise on security policy and program development where an engagement calls for it.
- Mentor other consultants and review their work.
- Use AI to understand code and systems quickly, direct testing agents on Nemesis, and build agentic testing capabilities with the team building it.
What we're looking for
- 5+ years of hands-on security assessment work: penetration testing, code review or red teaming, with findings you can describe.
- Depth in at least one of our specializations (AI and agentic AI security, cloud and application penetration testing, red teaming, threat modeling, responsible AI governance) and working knowledge of the others.
- Strong coding skills. You read code in languages you don't write, and you script whatever the engagement needs.
- Hands-on use of AI in security work: reasoning about code with LLMs, running agentic testing tools, and the judgment to know when their output is wrong.
- A record of exploitable findings, not scanner output, and the judgment to tell the two apart.
- Experience running client engagements on your own, including the hard conversations.
- Excellent written and verbal communication. Your reports are the product.
- Comfort with ambiguity: scope that shifts, requirements nobody wrote down, and problems nobody else thought of.
- Disciplined handling of client data and secrets under strict confidentiality obligations.
Nice to have
- Offensive security certifications such as OSCP, OSWE or OSEE.
- Published research, CVEs, conference talks or bug bounty results.
- Experience testing agentic AI systems: tool use, MCP servers and autonomous workflows.
- Device, embedded or hardware security.
AI Governance Program Manager
Full-time · Remote, U.S. · Program management
About the role
Casaba assesses AI systems for some of the world's largest technology companies, from LLM-based features to agents, and helps the teams building them ship safely and responsibly. This role sits between those engineering teams, our assessment work, and our responsible AI (RAI) governance work.
As AI Governance Program Manager you partner with a client's engineering stakeholders to assess how their AI systems are developed and deployed, and you guide teams through hardening LLM-based systems until they meet release standards. You run the program: which systems get assessed and when, what each needs to pass, where each stands, and what's blocking it.
You're technical enough to read an assessment, question a mitigation and understand an attack surface, and product-minded enough to turn that into a plan a dozen teams can follow.
What you'll do
- Run the assessment program for AI systems across a client's engineering teams: intake, prioritization, scheduling and status.
- Partner with engineering stakeholders to understand each system, its risks and its release timeline.
- Define what "ready for release" means for an LLM-based system, communicate it, and guide teams through meeting it.
- Keep the program aligned with the client's responsible AI governance commitments: harm categories, content safety, and the RAI policy each release has to meet.
- Turn assessment findings into mitigation plans, track them to closure and verify the fixes held.
- Keep leadership informed with concise written status: what's assessed, what's blocked and what's at risk.
- Work with our consultants and researchers on measurement: how we test AI systems and how we judge the results.
- Improve the program as it runs: criteria, templates, tooling and reporting.
What we're looking for
- A product-oriented mindset. You think in outcomes, priorities and tradeoffs, and you keep many teams moving at once.
- A technical background in AI measurement and mitigation: evaluations, red teaming of LLM-based systems, prompt and output safety, and the mitigations that work.
- Cybersecurity understanding of attack surfaces and risk assessment, enough to judge an AI system's exposure and a proposed fix.
- Working knowledge of responsible AI governance: RAI policy, harm categories, and how commitments are turned into release requirements.
- 5+ years in technical program management, technical product management, security program management or a related role working directly with engineering teams.
- Clear, concise written and verbal communication with engineers and executives alike.
- Comfort working inside a large engineering organization's release processes and timelines.
- Disciplined handling of confidential client information.
Nice to have
- Hands-on experience building or shipping LLM-based features.
- A background in security consulting or assessment.
- Experience with AI governance frameworks such as the NIST AI RMF or the EU AI Act.
What we look for
Every role at Casaba
The technology we all use revolves around code. Anyone wishing to work in this field should know how to write it - whether scripting, native apps, or web applications. Beyond that, a passion for security and digital privacy are key.
This isn't a normal job. Tasks aren't always clearly defined and requirements aren't always known. You must handle ambiguity and bring direction with confidence and humility. Our clients depend on us to find the problems that nobody else thought of.
Eligibility
- U.S. or EU citizenship
- Ability to pass a background check
- Occasional travel availability
Compensation & benefits
- Competitive salary based on experience
- Profit-sharing opportunities
- Simplified Employee Pension (SEP) plan
- 100% employer-paid health insurance for employees and dependents
- Generous paid vacation and sick leave
How to apply
The process
1. Get in touch
Email us at employment@casaba.com with your resume. Put the role title in the subject line. For consulting roles, include a brief description of notable vulnerabilities you've found; for engineering roles, a link to something you've built or shipped with AI coding agents.
2. Screening call
We'll set up a call to get to know each other - personally and professionally.
3. Technical interviews
In-depth technical and professional interviews. We may present security scenarios for you to think through so we can understand your knowledge across focus areas.
4. Closing call
A final conversation to answer your questions and talk through the offer.