Nucleus Labs

Our client is building and maintaining software systems where reliability, data protection, and secure user flows are critical. The security function is not limited to checking whether features and data are secure. The team also needs someone who can actively challenge the system, identify weak points, verify security assumptions, and help prevent vulnerabilities before they reach production.

We are looking for a Cyber Security Engineer who can work closely with infrastructure, engineering, and product teams to test web applications, APIs, authentication flows, permissions, infrastructure exposure, and overall application security.

This is a hands-on role. The main expectation is to find real risks, reproduce them clearly, document them properly, and help the engineering team validate that fixes are effective. Role We are looking for a Security Engineer who will take ownership of security testing and tightening across application, API, and platform layers.

This person should be comfortable working as part of a delivery governance team while bringing deeper security expertise into the team. The role requires practical knowledge of penetration testing, vulnerability assessment, secure testing methods, and clear communication with developers.

Key Responsibilities

• Perform manual security testing of web applications, APIs, user flows, and admin panels.
• Conduct penetration testing against staging and production-like environments.
• Identify, reproduce, document, and validate security vulnerabilities.
• Test authentication, authorization, permissions, session management, password flows, and access-control logic.
• Review API endpoints for broken access control, injection risks, data exposure, rate-limit issues, and insecure design.
• Validate security fixes and perform regression security testing.
• Work with QA engineers to include security checks in the regular testing process.
• Prepare clear reports with reproduction steps, evidence, severity, impact, and recommended remediation.
• Collaborate with developers to explain vulnerabilities and verify that fixes address the real issue.
• Support threat modeling and security review of new features when needed.
• Help improve security awareness and testing standards inside the team.

Required Experience

• 5+ years of experience in penetration testing, application security, security QA, or ethical hacking.
• Strong understanding of OWASP Top 10 and common web application vulnerabilities.
• Experience testing REST APIs and web-based systems.
• Practical experience with authentication and authorization testing.
• Ability to discover, reproduce, and explain vulnerabilities clearly.
• Experience using security testing tools such as Burp Suite, OWASP ZAP, Nmap, Wireshark, Metasploit, or similar.
• Understanding of HTTP, HTTPS, cookies, headers, sessions, JWT, OAuth2, MFA, and role-based access control.
• Ability to write simple scripts or proof-of-concept checks when needed, preferably in Python.
• Strong documentation skills and ability to produce actionable vulnerability reports.
• Good communication skills and ability to work directly with engineering and QA teams.
• Upper-intermediate or better English for written and spoken communication.

Nice to Have

• Experience with cloud security testing, especially AWS, Azure, or GCP.
• Experience with Docker, Kubernetes, CI/CD pipelines, and infrastructure security basics.
• Experience with mobile application security testing.
• Experience with secure code review.
• Experience with SAST, DAST, dependency scanning, and security automation.
• Bug bounty experience or responsible disclosure background.
• Security certifications such as OSCP, PNPT, eJPT, CEH, GWAPT, or similar.
• Experience working in product teams rather than only external consulting environments.

What Success Looks Like

• Security issues are found early and described clearly.
• Developers can reproduce and fix reported vulnerabilities without confusion.
• QA coverage becomes stronger because security checks are included in regular delivery.
• Authentication, authorization, and API risks are actively tested before release.
• Security findings are prioritized by real impact, not just tool output.
• The team gains practical confidence that critical user flows and sensitive data are protected.

Role Overview

We are looking for a Senior AI Engineer to own the Python AI service inside a learning-platform programme and act as the technical voice in front of the client.

About one-third to one-half of the role focuses on LLM and agent engineering. The rest covers backend development, data modelling, architecture, and the DevOps needed to keep everything shipping.

Project Description

The client is a US remote online-learning provider. Their learning-content platform is a .NET application; our team builds the Python AI service that sits alongside it, handling retrieval over the platform's content and, increasingly, agent workflows on top of it. The retrieval and recommendation layer is already delivered; the next phase is LLM engineering and agents, with custom model training a possibility later rather than a certainty.

All models used in the system are open-source and deployed on the client's own infrastructure, so this is a self-hosted inference. Agent work uses frameworks in the Google ADK / LangChain family. The .NET side is being taken over by other developers on the team, but you will still need to read and occasionally change it, which in practice means working through a coding agent in a language you may not write natively.

Two things about the environment are worth saying plainly. Requirements move constantly, so the role includes running the conversations that pin them down — meetings, diagrams, written specifications, and the patience to re-explain. And the infrastructure is branched: pipelines run in GitLab CI/CD, environments are separated, and configuration and keys live in repositories the team does not own, so working DevOps ability is a practical requirement.

Key Responsibilities

• Own the Python AI service end to end — retrieval, LLM orchestration, and the agent workflows built on top of it.
• Design and build agent workflows using a Google ADK.
• Work with open-source models deployed on the client's own infrastructure, including selection, prompting, and performance tuning.
• Own the service's data model, database design, and backend architecture.
• Run requirement sessions directly with client stakeholders and produce the diagrams and written specifications that settle them.
• Own policy-governed, auditable AI pipelines: human-review gating, content lineage, tenant/role policy enforcement. 
• Integrate the AI service with the client's .NET learning-content platform, reading and changing that code where needed.
• Maintain and extend CI/CD pipelines in GitLab across separated development environments.
• Trace configuration, keys and pipeline definitions across repositories the team does not own, and unblock delivery when they break.
• Propose an approach and defend it, rather than waiting for the requirement to arrive fully formed.
• Hand .NET-side work over to the developers taking it on, with documentation they can act on.
• Prepare the service for custom model training and evaluation if that work lands with this team.
• Owning prompt/model versioning and an evaluation harness gating changes.

Required Qualifications

• Senior-level commercial Python experience, with ownership of a production service.
• Ability to read and modify .NET / C# code.
• Hands-on LLM engineering in production — retrieval-augmented generation, context design, prompt and output handling.
• Experience building agent workflows with a framework such as Google ADK, LangChain, or LangGraph.
• Backend and database design experience, including making the architectural calls rather than following them.
• Working DevOps ability — CI/CD pipelines, containers, and multi-environment configuration.
• Willingness and ability to work in a codebase written in a language you do not primarily use.
• Strong client-facing communication: running requirement sessions, producing diagrams, and holding a position under pressure.
• English at a level that supports direct client meetings without an intermediary (at least B2 level).
• Comfort with requirements that change between meetings.

Preferred Qualifications

• Experience with document based db like MongoDB, or similar
• Experience with OpenSearch/vector search. 
• Experience with Kubernetes.
• Experience deploying and operating self-hosted open-source models.
• MLOps experience — training pipelines, fine-tuning, model monitoring and evaluation.
• Experience with learning-management or content-management platforms.
• Experience delivering alongside a partner vendor's team, including a business analyst outside your own organisation.
• Daily working experience with coding agents in a large, unfamiliar codebase.