Responsibilities:- Own the technical vision and system architecture for the pod's solutions, actively writing and shipping robust production code weekly while establishing high engineering standards for hardening, scalability, and live-environment reliability
- Direct full-lifecycle offensive engagements from scoping and strict legal rules of engagement through execution and executive readout, deploying frontier cyber models (e.g., Mythos/Fable, Google Argon, Daybreak) to uncover critical vulnerabilities, including zero-days
- Bridge the gap between finding flaws and fixing them by designing software updates, patches, and code refactors that eliminate root-cause technical debt and harden client applications
- Develop and maintain the pod's proprietary offensive tooling and agentic workflows, implementing rigorous evaluation harnesses, golden vulnerability datasets, automated regression testing, and human-in-the-loop safeguards
- Drive deliverables in fast-paced two-to-six-week delivery cycles, actively managing risk, identifying technical constraints early, and ensuring every release is production-ready and fully contained within authorized parameters
- Lead technical and executive working sessions across engineering groups, CISOs, and C-suite stakeholders, while coaching pod engineers to sustain talent density, quality, and execution speed
- Integrate automated security testing, policy-as-code, and compliance gates directly into the Harness engineering pipeline to catch vulnerabilities before deployment
- Build specific defense profiles for dual-model setups to include mitigating prompt injection and data poisoning for LLMs, while ensuring input validation, algorithmic tampering defenses, and bypass prevention for deterministic Type 1 models (e.g., Jev)
- Analyze customer journey path models to discover logical vulnerabilities, privilege escalation vectors, or states where non-deterministic LLM behavior can break the intended business logic flow
- Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment
Qualifications:- Minimum seven years of recent, hands-on offensive security experience (red teaming, penetration testing, exploit development, or vulnerability research) paired with active, current production software engineering capability (e.g., Python, Go, Rust, or Java); published research, CVEs, or certifications (OSCP, OSEP, OSCE3, GXPN) are strong pluses
- Minimum three years of hands-on leadership managing, mentoring, and scaling high-performing engineering teams; thrives with ambiguity and a bias toward shipping outcomes (founder or early-stage startup experience is a strong plus)
- Bachelor's degree from an accredited college/university in a STEM field or eight years equivalent practical experience
- Demonstrated experience building, hardening, and operating scalable systems in live enterprise environments across Azure, AWS, or Google Cloud (GCP), with proven ability to refactor legacy code and remediate production defects
- Hands-on fluency with frontier AI models, modern coding environments (e.g., Claude Code, Cursor), and agentic systems, including context engineering, tool-calling frameworks, evaluation discipline, and protocols such as MCP (Model Context Protocol); direct experience engineering agent harnesses or contributing to open-source developer infrastructure is highly valued
- Demonstrated ability to articulate complex security findings and AI technical concepts to both hands-on engineers and C-level executives (CIO, CISO, CFO), translating security and operational insights into quantified business value
- Impeccable ethical judgment regarding rules of engagement, authorization, and sensitive data handling
- Accessible portfolio, GitHub repository, or system walkthrough demonstrating shipped work
- Ability to travel domestically as needed
KPMG LLP and its affiliates and subsidiaries ("KPMG") complies with all local/state regulations regarding displaying salary ranges. If required, the ranges displayed below or via the URL below are specifically for those potential hires who will work in the location(s) listed. Any offered salary is determined based on relevant factors such as applicant's skills, job responsibilities, prior relevant experience, certain degrees and certifications and market considerations. In addition, KPMG LLP is proud to offer a comprehensive, competitive benefits package, with options designed to help you make the best decisions for yourself, your family, and your lifestyle. Available benefits are based on eligibility. Depending on job classification , standard work hours, and years of service, KPMG LLP provides a Total Rewards Package that includes 401(k) and medical and may include dental, vision, disability and life insurance, personal well-being and Personal Time Off. Additionally, each year KPMG publishes a calendar of holidays to be observed during the year depending on your job classification and entity affiliation. Additional details about our benefits can be found towards the bottom of our KPMG US Careers site at Benefits & How We Work .
Follow this link to obtain salary ranges by city outside of CA:
https://kpmg.com/us/en/how-we-work/pay-transparency.html/?id=7462_9_26 California Salary Range: $127200 - $246900
