AI Offensive Testing Technical Lead
Employer not yet confirmed · Poland
Within the CISO Offensive Security Tribe, the AI Offensive Testing Technical Lead owns the technical coherence, engineering and industrialisation of Euroclear’s LLM-supported security-testing capability. The role transforms an R&D activity into a secure, reliable and operational service covering AI-assisted SAST, DAST, penetration testing and red-team activities.
Working with Offensive Security specialists, application teams, platform engineers, Enterprise Architecture and Data & AI, the Technical Lead builds the technical setup, infrastructure, integration patterns, operating model and quality controls required for secure, reproducible and evidence-rich testing under strict human oversight.
The capability enhances existing SAST, DAST, penetration-testing and red-team services by leveraging LLM capabilities throughout assessment preparation, execution, analysis and validation. The role ensures that validated findings integrate with prioritisation, remediation, retesting, reporting and secure software-development practices.
Key Accountabilities
1. Technical Architecture & Secure Engineering
- In collaboration with the Frontier AI Transformation Squad Lead, support the definition and maintenance of the target architecture, technical standards, threat model and engineering roadmap for the LLM-supported testing capability.
- Contribute to the build-up of the segregated technical environment (incl. identity, access, network, compute, storage, secrets, logging, egress and model connectivity).
- Protect sensitive source code, application data, credentials, testing artefacts and assessment evidence throughout intake, processing, review, retention and deletion.
- Ensure the technical setup aligns with enterprise architecture, cloud, data-protection and security requirements and can be operated, supported and scaled reliably.
2. Testing Methodology & Model Evaluation
- Build repeatable methods for LLM-supported SAST, DAST, penetration testing and red-team activities, including context collection, prompting, orchestration, execution and evidence capture.
- Compare frontier models, agents and configurations using consistent measures for coverage, finding quality, repeatability, duration, resource use and cost.
- Define an evidence contract covering target, code or asset location, weakness hypothesis, technical proof, affected paths, remediation proposal and validation status.
- Version and maintain prompts, model parameters, testing configurations, tools, evaluation datasets and execution workflows to support reproducibility and controlled change.
3. Finding Quality & Technical Validation
- Define technical quality gates covering finding accuracy, code or asset reachability, exploitability, attack paths, affected-component deployment and control effectiveness.
- Lead technical review of complex findings and distinguish actionable vulnerabilities from false positives, duplicate findings, non-reachable code and unsupported hypotheses.
- Ensure human validation, authorised scope and explicit approval remain mandatory before intrusive testing or findings enter risk, remediation and reporting workflows.
- Support developers, application owners and security teams with technically credible remediation options, compensating controls and validation evidence.
4. Assessment Delivery & Lifecycle Integration
- Plan and oversee technically complex LLM-supported scans and tests, resolve execution issues and ensure outputs are complete, reproducible and reviewable.
- Coordinate SAST, DAST, penetration-testing and red-team use cases with internal specialists and external providers, including scope, prerequisites and rules of engagement.
- Connect validated findings to risk prioritisation, IRM, remediation workflows, retesting, reporting and closure evidence.
- Convert recurring deterministic findings into secure patterns, automated tests, SAST rules, detection content or CI/CD quality gates where appropriate.
5. Operationalisation & Technical Leadership
- Contribute to architecture documents, technical standards, runbooks and operating procedures, and establish service-quality, performance, capacity and support measures.
- Contribute to the transition from R&D to operations by structuring deployment, integration, onboarding, support, knowledge transfer and continuous service improvement.
Your Profile
Qualifications & Experience
- At least 8 years in application security, offensive security, security engineering or software engineering within complex enterprise environments.
- Deep hands-on knowledge of source-code analysis, SAST, DAST, penetration testing, red teaming and secure SDLC practices.
- Strong engineering experience with LLM or agent orchestration, APIs, automation, structured evaluation, observability and operational integration.
- Demonstrated ability to assess code and asset reachability, exploitability, attack paths, control effectiveness and remediation options.
- Experience designing secure cloud execution environments and protecting sensitive source code, credentials and security-assessment data.
- Strong coding or scripting capability and disciplined use of version control, testing, logging, deployment automation and technical documentation.
- Practical experience taking an AI or security R&D capability through industrialisation and into a supportable enterprise service is preferred.
Skills & Competencies
- Application security, offensive security, SAST, DAST, penetration testing, red teaming, secure architecture and vulnerability validation.
- LLM and agent orchestration, APIs, Python or equivalent automation, evaluation methods and observability.
- Azure, containers, CI/CD, infrastructure integration, version control, logging, monitoring and application-security platforms.
- OWASP, CWE, CVE, MITRE ATT&CK or ATLAS, secure coding standards and recognised offensive-testing methodologies.
- Professional English; French or another European language is an advantage.
Behavioural
- Acts as a hands-on technical authority across AI engineering, offensive testing and operational service design.
- Combines innovation with secure, controlled, reproducible and operationally sustainable execution.
- Communicates technical, operational, security and economic trade-offs clearly and drives alignment from R&D through production operation.
About the Team
Part of the CISO Offensive Security Tribe, the LLM-supported testing capability combines secure source-code and asset intake, application context, frontier-model orchestration, SAST, DAST, penetration testing, red-team use cases, human validation, remediation support and retesting. It supports the wider objective of transforming AI-enabled security-testing research into an operational capability that strengthens Euroclear’s ability to discover and