Staff AI Security Researcher

Staff AI Security Researcher  Singapore  About Agoda  At Agoda, we bridge the world through travel. Our story began in 2005, when two lifelong friends and entrepreneurs, driven by their passion for travel, launched Agoda to make it easier for everyone to explore the world.  Today, we are part of Booking Holdings [NASDAQ: BKNG], with a diverse team of over 7,000 people from 90 countries, working together in offices around the globe. Every day, we connect people to destinations and experiences, with our great deals across our millions of hotels and holiday properties, flights, and experiences worldwide.  No two days are the same at Agoda. Data and technology are at the heart of our culture, fueling our curiosity and innovation. If you're ready to begin your best journey and help build travel for the world, join us.  Get to Know Our Team  The Security Department oversees security, compliance, GRC, and security operations for all Agoda. We are vigilant in ensuring there is no breach or vulnerability threatening our company or endangering our employees in order to keep Agoda safe and protected. This would be a great challenge for those who want to work with the best technology in a dynamic and advanced environment.  The Opportunity  We are hiring a Staff AI Security Researcher with a strong offensive security mindset, published CVEs, and a proven ability to use AI as a hunting tool. This role finds real, exploitable issues before attackers do, with external (internet-facing) attack paths first and internal ones next.  You will set the AI security research agenda, build autonomous agents that hunt and iterate on the fly, and jailbreak AI systems. You will also build the workflows, quality bar, and controls that the rest of the company uses.   The ideal candidate has a deep offensive security background, has already shifted day-to-day work onto AI-assisted hunting, and is comfortable leading that shift across teams.  What You Will Do  • Set the AI security research agenda, prioritizing internet-facing attack paths and high-impact risks across products, models, agents, MCP, and third-party integrations.  • Lead vulnerability research from discovery through proof of concept, impact validation, engineering fixes, and verification.  • Build scalable AI-assisted hunting capabilities, including agents, playbooks, workflows, and standards for validating findings.  • Lead offensive testing of AI systems, APIs, models, and integrations, including prompt injection, jailbreaks, data exfiltration, and supply-chain risks.  • Raise research quality by reviewing findings, coaching researchers, and producing high-impact research, including CVE-quality discoveries.  • Own the AI guardrail strategy and program metrics, including time to verified fix, recurring vulnerability classes, and guardrail bypass rates; verify control effectiveness.  • Influence product, engineering, and senior stakeholders to prioritize risks and deliver fixes; communicate findings through clear briefings, documentation, and research.  What You Will Bring  • Bachelor’s degree in Computer Science or a related field, or equivalent practical experience.  • 7+ years of offensive cybersecurity experience, including API security testing, penetration testing, red teaming, or adversarial testing, At least 1 year of AI security experience, with demonstrable examples of testing for jailbreaks, prompt injection, role confusion, data leakage, or safety bypasses.  • Demonstrated vulnerability research impact, evidenced by at least 3 published CVEs or multiple verified bug-bounty findings (e.g., HackerOne) that led to fixes or other security improvements.  • Must have published security research, presented at a conference, or maintained a personal technical blog demonstrating relevant cybersecurity expertise.  It is Great if You Have  • Ability to work with multiple teams, explain risk and impact, and present to different teams and C-level stakeholders.  • Fluent spoken and written English, with the ability to communicate technical findings clearly to both technical and non-technical audiences.  • Experience developing and maintaining production-level code.  • Experience using AI agents to find and exploit bugs, supported by write-ups or proofs of concept showing the model’s contribution.  • Experience building autonomous or semi-autonomous hunting workflows using multiple models, tool-calling, or orchestration.  • Hands-on experience assessing the security of MCP-based systems.  Salary and Location  This role is based in Singapore.  Monthly base salary: SGD 10,900-16,300  Please review our Hiring Process Guidelines before your interview - click here to learn how interviewing at Agoda works.  Discover more about working at Agoda  Agoda Careers https://careersatagoda.com  Facebook https://www.facebook.com/agodacareers/  LinkedIn https://www.linkedin.com/company/agoda  YouTube https://www.youtube.com/agodalife  Equal Opportunity Employer  At Agoda, we pride ourselves on being a company represented by people of all different backgrounds and orientations. We prioritize attracting diverse talent and cultivating an inclusive environment that encourages collaboration and innovation. Employment at Agoda is based solely on a person's merit and qualifications. We are committed to providing equal employment opportunity regardless of sex, age, race, color, national origin, religion, marital status, pregnancy, sexual orientation, gender identity, disability, citizenship, veteran or military status, and other legally protected characteristics.  We will keep your application on file so that we can consider you for future vacancies and you can always ask to have your details removed from the file. For more details please read our privacy policy.  Disclaimer  We do not accept any terms or conditions, nor do we recognize any agency's representation of a candidate, from unsolicited third-party or agency submissions. If we receive unsolicited or speculative CVs, we reserve the right to contact and hire the candidate directly without any obligation to pay a recruitment fee.