Member Of Technical Staff
Posted 28 Sep 2026
Advertised as “Member of Technical Staff - Security Research”
BranchFactor Summary
The original posting with the fluff stripped out
- Management level
- Individual contributor
- Employment
- Hybrid
- Contract
- Full-time
No salary listed for this role.
About Runlayer
AI is transforming how every company operates, but most enterprises are stuck. They want to move fast with AI Agents, tools, and workflows, but they can't do it safely. We're fixing that.
Our team built AI Actions for OpenAI, shipped Zapier Agents to millions of users, and launched the first remote MCP server with Anthropic. We helped establish the protocol, and now we're building the platform enterprises need to actually put AI to work.
Runlayer is one platform for MCPs, Skills, and Agents: purpose-built security, fine-grained governance, and complete observability so organizations can go all-in on AI across the entire company without the risk. We just raised a $30M Series A led by Felicis, with participation from Khosla Ventures, bringing our total raised to $42M. Already trusted by Gusto, Instacart, Opendoor, dbt Labs, and Decagon.
About the Role
As our first Security Researcher, you'll find the vulnerabilities that define AI agent security and publish the research the industry reads. You'll hunt across MCP servers, AI coding agents, skills and plugins, and the OAuth flows that connect them. You'll disclose responsibly, and every finding becomes a protection our customers run.
Why You'll Thrive Here
-
Impact: Your findings shape how enterprises, vendors and standards bodies think about agent security, and they ship as protections for our customers
-
Excellence: Work with the team that helped establish MCP and a group of senior engineers from top security backgrounds
-
Ownership: Own the research agenda end to end, from the first bug to disclosure, publication and the stage
What You'll Do
-
Find and exploit vulnerabilities in MCP servers and clients, AI coding agents, agent frameworks, skills and plugin marketplaces, and the OAuth flows between them
-
Run coordinated disclosure end to end: vendor contact, CVEs and advisories, embargoes and publication
-
Publish research people quote: technical write-ups, open-source tools and conference talks
-
Run ecosystem-scale studies across thousands of MCP servers using our catalog and scanning pipeline
-
Turn findings into product: detections, scanner rules and public risk ratings for MCP servers
-
Brief customers, prospects and press with our marketing and developer relations teams