Attackers automate. Most defenders fill out checklists. We sell security reviews that end with fixed code, not PDF reports - and we need the engineer who can run them.
You would own our security review practice end-to-end: fixed-scope engagements (2 weeks, fixed price) on web applications, APIs, cloud setups, and AI/LLM integrations. You find what is exploitable, rank it by real-world impact - not CVSS theater - write the fix, verify the fix, and hand the client a system that is actually harder to break. You are comfortable in a compliance conversation without becoming a compliance auditor: clients will bring ISO 27001, NIS2, and SOC 2 to the table, and your job is to map those frameworks to technical reality, not to sell them binder shelf-ware.
The work
- Run fixed-scope security reviews: recon, exploitation, findings ranked by exploitability, remediation, retest
- Break AI/LLM systems specifically: prompt injection, RAG poisoning, excessive agency, tool and agent abuse, insecure output handling, supply chain in model pipelines
- Write and verify fixes across the stack - you code, you do not only scan
- Advise clients on ISO 27001, NIS2, and SOC 2 readiness: which controls their product actually meets, which are gaps, what to do in what order
- Write reports a CTO can act on in plain language - findings first, framework mapping second
- Work alongside our AI engineer on client systems and on our own internal security posture
What we need
- Hands-on offensive or application security experience on real engagements - things you found and broke, not courses you attended
- A working command of the AI/LLM attack surface: you have exploited or defended LLM-integrated systems, and you know what goes wrong beyond the OWASP LLM Top 10 headlines
- Working familiarity with ISO 27001, NIS2, and SOC 2: enough to map findings to controls and guide a client to audit-readiness. Certifications (ISO 27001 LA, CISSP, OSCP or similar) are a plus, never a substitute
- Solid engineering fundamentals: you read code fluently in at least two languages and can write the fix yourself (we use Go, Rust, TypeScript, Python)
- Clear writing: findings a non-security founder understands and a CTO can assign
- Based in San Marino or willing to relocate
Why RBB LAB
Small team, senior-only, productized service: two-week cycles with a fixed perimeter, findings plus fixes plus retest, zero lock-in. You work directly with clients - founders, CTOs, product owners - and you own engagements end-to-end. Our background is production infrastructure: we build and operate blockchain systems (Mintlayer) and AI products for SMEs, so you will always have real systems to defend, not lab exercises.
Use the form below to apply. Include your CV and a short note on a vulnerability you found and exploited before anyone else did - and what the fix looked like.