Get a demo
Careers

Security Researcher

Tel Aviv
Hybrid

Join Bay and help secure the next wave of work, where AI agents write code and act on company data alongside the people who use them. Bay is the AI agent security platform that gives enterprises visibility into every agent across devices, browsers and cloud workloads, and control over what those agents do in real time. That way, security teams can back AI adoption instead of slowing it down.

The role

We’re hiring a Security Researcher to take apart the AI agents enterprises are adopting, find where they break, and work out how to control them.

Today’s agents rarely live in one place. A desktop or browser client runs on the device, the model runs in the vendor’s cloud, and the work often happens in a remote VM or container. For each agent, you’ll map that chain: where actions execute, how commands travel, who is authenticated, and where we can observe or block. Sometimes the answer looks like offense, such as injecting into a process or speaking an agent’s internal protocol, because that’s where an enforcement point belongs.

You’ll be part of a research group we’re building from scratch, working with our Head of Research, detection engineers and R&D. We want every project to make Bay’s product better and produce something worth publishing.

What you’ll do

  • Research AI agents end to end: coding agents (Claude Code, Codex, Cursor, Copilot), cloud and computer-use agents, browser agents and extensions, and MCP servers, across the local client, the cloud control plane and the remote runtime.
  • Reverse engineer clients, runtimes and protocols (Electron/Node apps, native and Rust binaries, sandboxed VMs and containers) on macOS, Windows and Linux to find where agent actions can be observed, intercepted or blocked.
  • Hunt for vulnerabilities in high-impact agent products, such as sandbox and container escapes, cross-tenant access, credential exposure, prompt-injection-to-execution chains, and tool or MCP abuse. Take them through responsible disclosure.
  • Turn findings into product: interception points, enforcement primitives and threat insight that R&D and our detection engineers build into Bay.
  • Build research tooling and PoCs, using AI agents as research partners (LLM-driven Frida, IDA or Ghidra over MCP) to move faster.
  • Track new agent releases, agentic threats, and malicious packages, skills and extensions in the wild.
  • Publish blogs, CVEs, talks and open-source tools that build Bay’s voice in the community.
  • Red-team Bay’s own guardrails as the team grows.

What we’re looking for

  • A track record of original security research: vulnerabilities you found, disclosed or exploited (CVEs, bug bounty, vendor or red-team research). Usually 3+ years, but we care more about what you found than how long it took.
  • Hands-on black-box research: dynamic instrumentation (Frida or similar), traffic interception and TLS decryption, and protocol analysis when you only have the client or only the server.
  • Reverse engineering with IDA, Ghidra, Binary Ninja or similar, including stripped binaries, certificate pinning and custom transports.
  • Strong OS internals: processes, IPC, sandboxing (namespaces, seccomp, micro-VMs) and networking. macOS is a plus.
  • Strong coding in Python plus at least one of TypeScript/JavaScript, Go, Rust or C/C++. You build your own tools.
  • Fluency with AI agents as research tools, and the judgment to check what they tell you.
  • A nose for impact: you pick targets that matter, know when to push harder and when to move on, and work independently from question to result.
  • Evidence discipline: you keep what you observed and reproduced separate from what you inferred.

Nice to have

  • Research on LLM or AI security, prompt injection, agent sandboxes or software supply chain.
  • Cloud and container security: Kubernetes, container runtimes, cloud identity.
  • Published research, conference talks or open-source tools.
  • Experience from a technology or intelligence unit (8200, 81, Mamram, Sapir or similar).
  • Exposure to detection engineering or threat hunting.
  • B.Sc. in Computer Science, Mathematics or a related field.

Why join Bay

  • Join a research group at the start and help shape what it becomes.
  • Your findings ship in the product, with enterprise customers including Micron Technology, Peloton and ClickUp already live.
  • Work with a senior team that has built and scaled security companies before.
  • Competitive salary and meaningful equity in a well-funded, Series A stage company.

Location

Tel Aviv

‍

Bay is an equal opportunity employer. We welcome applicants of every background and don’t discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability or veteran status.

‍

Submit Application

Apply to
Security Researcher