Offensive Security Engineer

About the role

Artemis is building the future of AI-driven cybersecurity, helping companies defend themselves effectively in an era where AI is fighting AI on the cyber battlefield.

Our platform brings a new approach to the $100B security operations market, building a live model of each customer's environment and using AI agents to detect, investigate, hunt, and respond to threats at machine speed. Just one year after our founding, Artemis is one of the fastest-growing cybersecurity companies of all time, with customers including multiple Fortune 500 companies, Global 2000 enterprises, and AI innovators like Cursor.

We have raised $70M from Felicis, First Round Capital, Theory Ventures, Two Sigma Ventures, Lockstep VC and Brightmind. We are also backed by some of the most prominent operators in cybersecurity, including the CEO of Crowdstrike, the former CEO and CTO of Splunk, and the founders of Abnormal AI and Demisto.

Artemis's founders have built and scaled security products used by tens of thousands of customers. Shachar Hirshberg (CEO) led Amazon GuardDuty, the world's largest cloud detection product, was an early employee at Demisto, the company that invented the SOAR category, was an engineering leader at Palo Alto Networks, and holds an MBA from Harvard. Dan Shiebler (CTO) led all AI and machine learning at Abnormal AI, the pioneer of behavior-based detection, spent five years building analytics using machine learning and vector databases at Twitter, and holds a PhD in machine learning from Oxford.

Our team of software engineers, AI researchers, security engineers, and product designers comes from Google, Meta, AWS, Wiz, CrowdStrike, SentinelOne, Abnormal AI, Perplexity, Bridgewater, Mercor, CERN, and more.

We're growing fast and looking for builders who want to help us serve our rapidly expanding customer base.

RESPONSIBILITIES

- Build scalable adversary emulation – Develop reusable scenarios and automation that reproduce attacker behaviors and multi-stage attack chains across cloud, identity, endpoint, SaaS, AI, and data environments. Prioritize work using threat intelligence, customer risk, and detection coverage gaps.

- Validate detections end to end – Trace emulated activity through collection, normalization, enrichment, detection, and investigation. Verify expected findings and evidence, identify missed detections and visibility gaps, and distinguish successful prevention from successful detection.

- Research attacks against AI systems – Investigate prompt injection, MCP and tool abuse, retrieval poisoning, excessive agent privileges, and unauthorized actions. Chain weaknesses across applications, agents, and integrations to establish realistic impact and identify detection opportunities.

- Research attacks against data planes – Explore abuse of service identities, integration tokens, permissions, and data access across databases, warehouses, object storage, and AI retrieval systems. Turn access, staging, export, and cross-platform attack paths into repeatable scenarios.