Senior Software Security Engineer - AI Trainer at Turing

Senior Software Security Engineer | Remote | Contractor

About the role

Turing works with frontier AI labs on training data, evaluations, and engineering talent. In this role you will create training and evaluation tasks for frontier AI coding models by turning real-world open-source vulnerabilities — CVEs, security advisories, and bug reports — into Harbor-format audit-and-patch tasks across multiple programming languages. The work combines security research, vulnerability reproduction, benchmark development, automated testing, and technical review, and aims to test whether AI systems can identify, understand, exploit, and securely fix software vulnerabilities without relying on pattern matching or known patches.

What the work involves

• Source and analyze real-world vulnerabilities from CVEs, security advisories, bug reports, and open-source repositories.
• Classify vulnerabilities by the most specific applicable CWE and map them to OWASP Top 10 categories where appropriate.
• Reproduce vulnerabilities and develop reliable proof-of-vulnerability tests.
• Build Harbor-format audit-and-patch tasks across languages such as Python, JavaScript/TypeScript, Java, C/C++, C#, Go, Rust, Ruby, PHP, Kotlin, and Swift.
• Write task instructions that describe the security issue without revealing the vulnerable code, exploit details, or expected fix.
• Create reproducible Docker-based environments with pinned dependencies and clear setup procedures.
• Harden verifiers against gaming, overfitting, test manipulation, and hardcoded solutions.
• Screen out tasks that can be solved by copying a well-known upstream patch without understanding the vulnerability.
• Review and score AI-generated patches and reasoning against defined technical rubrics.
• Document vulnerability context, reproduction steps, expected behavior, patch requirements, test methodology, and review decisions.

Requirements

• 5+ years of professional software engineering experience.
• Expert-level proficiency in at least one of Python, JavaScript/TypeScript, Java, C/C++, C#, Go, Rust, Ruby, PHP, Kotlin, or Swift.
• Strong understanding of software security concepts, including CWE, CVE, and the OWASP Top 10.
• Ability to reproduce vulnerabilities and write proof-of-vulnerability tests.
• Hands-on experience with security tooling, including sanitizers, fuzzers, and static-analysis tools such as CodeQL or Semgrep.
• Strong proficiency with Git, Linux, Bash, and Docker.
• Excellent technical writing and documentation skills.
• Able to work independently in a fully remote, research-oriented environment.

Location, schedule and contract

• Fully remote.
• 40 hours per week, with 4 hours of overlap with Pacific Standard Time (PST).
• Contractor assignment; no medical or paid leave.
• 3-month contract, expected to start next week.
• Hourly rate is not specified in this listing.

Interview process

One round: a 60-minute technical interview.