The posting
Penetration Tester / ML Data Collection
Location: Mountain View, CA
About AutoRoboto
AutoRoboto is an engineering and management consulting firm that has delivered projects for some of the largest technology companies in the San Francisco Bay Area. Our work spans mechanical, electrical, and software design; data collection and quality assurance; and validation testing for new hardware and software.
We're deliberately small. That means our engineers work directly with client teams, see their work reach production quickly, and move between problem domains as our customers' priorities shift. If you want a narrow lane and a long approval chain, this isn't the place. If you want range and ownership, read on.
The Role
This is a hybrid position that sits at the intersection of offensive security and machine learning data work — two areas where our clients increasingly need the same person in the room.
On the security side, you'll take a proactive, offensive role: performing authorized penetration tests against client systems, using a range of tools and techniques to find the gaps an attacker would exploit. You'll document every action in detail and produce clear reports covering what you attempted, what succeeded, what it means for the client's risk posture, and how to fix it.
On the ML side, you'll help design and run the data collection efforts that support our clients' model development and evaluation — including adversarial and edge-case data, where your security instincts are a direct advantage. You'll also apply the same rigor to data quality that you apply to security findings: reproducible process, documented methodology, defensible results.
You'll typically be embedded with one or two client teams at a time, with engagements that shift as their roadmaps do.
What You'll Do
Offensive security
- Plan and execute authorized penetration tests across web applications, APIs, internal networks, and hardware-adjacent systems, working within clearly defined scope and rules of engagement
- Identify, validate, and prioritize vulnerabilities by real-world exploitability and business impact, not just scanner severity
- Write detailed technical findings and remediation guidance, and present results to both engineering teams and non-technical stakeholders
- Retest remediated findings and confirm fixes hold
- Contribute to our internal testing methodology, checklists, and tooling so engagements get faster and more consistent over time
ML data collection and quality assurance
- Design and run data collection efforts against client specifications, including adversarial, edge-case, and failure-mode data
- Build and maintain QA processes that catch labeling errors, coverage gaps, and dataset drift before they reach a training run
- Write and maintain scripts and tooling to automate collection, validation, and reporting
- Document collection methodology and dataset provenance to a standard that holds up under client audit
- Partner with client ML teams to translate model evaluation needs into concrete collection plans
Across both
- Keep meticulous records — in this role, the report is the deliverable
- Operate strictly within authorized scope and client agreements, and escalate immediately when a finding falls outside it
- Adapt as client priorities change, which they will
What We're Looking For
- 3+ years in penetration testing, offensive security, red teaming, or security assessment work
- Hands-on command of the standard offensive toolkit and, more importantly, the judgment to know which tool the situation actually calls for
- Working knowledge of common vulnerability classes and how they show up in real systems (web, API, network, authentication and authorization flows)
- Scripting proficiency in Python or a comparable language, sufficient to automate your own workflow
- Exceptional written communication — you can turn a messy engagement into a report a client executive will read and act on
- Familiarity with ML/AI workflows and what makes a dataset good or useless
- Comfort with ambiguity and client-facing work; you'll be representing AutoRoboto directly
- Authorization to work in the United States and ability to work on-site or hybrid in Mountain View, CA
Nice to Have
- Relevant certifications (OSCP, GPEN, CEH, or similar)
- Experience with adversarial ML, model red-teaming, or AI safety evaluation work
- Background in hardware or embedded security
- Prior consulting or agency experience
Why AutoRoboto
- Direct client exposure and real ownership from day one
- Variety — our engagements change, and so does the work
- A small team where your process improvements actually become the process
- Full-time role with benefits
