Forward Deployed Engineer (FDE), Cyber - SF

Job description

About the team OpenAI’s Forward Deployed Engineering team builds with customers to bring frontier AI into production. Our Cyber FDEs partner with the security and engineering teams that defend globally critical systems, from enterprise software to the core infrastructure it runs on. Cyber FDEs work closely with our Product, Research, and Go-to-Market teams to adapt our products and models to what customers need to defend their systems. About the role You’ll build systems that give defenders an advantage at a scale few engineering teams encounter. You might help an enterprise identify, test, and deploy patches across hundreds of thousands of code repositories, or help a security team analyze petabytes of logs for signs of malicious agents or coordinated attacks. Across these deployments, you’ll build tools that customer engineers can trust to support consequential security decisions. You’ll work directly with customer security teams, from CISOs to frontline analysts. As AI changes how attackers operate, you’ll help these teams determine where their defenses need to evolve, prioritize what to build, and validate solutions with the engineers who will operate them. Alongside OpenAI’s account teams, you’ll translate security priorities into deployed systems that help defenders cover more ground. You’ll also help shape what OpenAI builds next. When you identify a gap between what defenders need and what today’s models or products can do, you’ll partner with Research and Product to define, build, and test capabilities that address it. This role is based in San Francisco. We use a hybrid work model of 3 days in the office per week. We offer relocation assistance. Travel up to 50% is required. In this role you will: - Partner with customer security leaders and OpenAI’s Go-to-Market team to scope engagements, establish responsibilities, and define measurable success criteria. - Lead technical design and implementation alongside customer engineers. Integrate agents into security workflows, establish access boundaries, and determine which actions require human review. - Build evaluations grounded in the decisions defenders make. For a patching agent, test whether a fix blocks a known exploit while preserving expected application behavior. For a detection system, replay historical attacks alongside normal traffic to measure detection speed and false-positive rates. - Guide production rollout with the engineers who will operate the system. Provide the observability and controls they need to understand system behavior, intervene when necessary, and expand adoption with confidence. - Translate successful approaches across deployments into reusable tools and engineering practices that other defenders can adopt. You might thrive in this role if you: - 5+ years of software engineering experience, including building and shipping production software. - Experience protecting production systems through work in security engineering, infrastructure, SRE, DevOps, or product engineering. - Experience building and evaluating AI agents for software engineering workflows. - Experience with CI/CD pipelines and practices that maintain code quality, reliability, and security. - Ability to navigate unfamiliar codebases and contribute maintainable, production-quality changes. - Ability to communicate technical concepts and trade-offs to engineering teams and senior security stakeholders. Additional experience Cybersecurity spans many disciplines, and while we’re primarily looking for strong engineering generalists, we’d love to hear about deeper experience in any of the following areas: - Security curiosity and experimentation: You read CVE write-ups because you want to understand how things break. You may have built an agent honeypot to test a hypothesis—or prove a point—and enjoy turning a security question into a hands-on experiment. - Security community engagement: You enjoy exchanging ideas with defenders, whether that’s discussing security strategy with a CISO at Black Hat or comparing technical approaches with frontline practitioners. - Application security: You’ve written CodeQL queries or Semgrep rules, built fuzzing harnesses, or discovered and responsibly disclosed vulnerabilities. - Automated remediation: CI/CD is your happy place. You’ve built tooling that turns security findings into tested patches, dependency upgrades, or configuration changes across large codebases. - Detection engineering: You’ve written and deployed detections using Sigma, YARA, Splunk, or KQL and tested them against attacker behavior. - Cloud and identity security: You’ve designed cloud IAM architectures and investigated abuse of workload identities, role hierarchies, or cross-account trust. - Security research: You’ve reverse-engineered malware, developed exploit reproductions, or contributed to vulnerability research. - Agent security: You’ve tested agents for prompt injection, tool misuse, or cre