Senior AI Security Researcher

Bangkok, Thailand · Bangkok (One Bangkok Office) · 2-7 years experience · Posted Sep 30, 2026

At a glance

At Agoda, we bridge the world through travel. Our story began in 2005, when two lifelong friends and entrepreneurs, driven by their passion for travel, launched Agoda to make it easier for everyone to explore the world.
Today, we are part of Booking Holdings [NASDAQ: BKNG], with a diverse team of over 7,000 people from 90 countries, working together in offices around the globe. Every day, we connect people to destinations and experiences, with our great deals across our millions of hotels and holiday properties, flights, and experiences worldwide.
No two days are the same at Agoda. Data and technology are at the heart of our culture, fueling our curiosity and innovation. If you’re ready to begin your best journey and help build travel for the world, join us.
The Opportunity: AI Security Researcher
We are looking for an AI Security Researcher with a strong offensive security mindset, published CVEs, and the ability to use AI as a hacking tool. The core of this role is finding real exploitable issues before attackers do, prioritizing external (internet-facing) exploits, then internal ones.
You will build autonomous agents that research and hack on the fly by interacting with AI, and you will jailbreak AI systems.

Agoda is looking for a Senior AI Security Researcher with a strong offensive security mindset, published CVEs, and the ability to use AI as a hacking tool.
The core of this role is finding real exploitable issues before attackers do, prioritizing external internet-facing exploits over internal ones.
You will build autonomous agents that research and hack on the fly by interacting with AI, and you will jailbreak AI systems.

Proactively find, exploit, and document real-world vulnerabilities, prioritizing external attack paths, then internal ones.
Discover these issues before attackers do, with working proofs of concept and demonstrated impact.
Build autonomous agents that hunt, attack, and iterate on the fly by interacting with AI models and tools.
Use and develop AI-driven offensive workflows for continuous hunting.
Apply deep offensive security skills with AI in the loop.
Produce CVE-quality research outcomes and drive findings through to engineering fixes.
Design, execute, and document jailbreaks, prompt injection attacks, model evasion, data exfiltration, and other offensive techniques against AI systems.
Assess and attempt to compromise Model Context Protocol (MCP)based systems and other tool-calling or plugin ecosystems.
Translate research findings into practical engineering requirements and collaborate closely with product and engineering teams.
Produce clear technical documentation, proof-of-concepts, and knowledge sharing on AI security practices.

Bachelor's in Computer Science or related degree.
2–7 years in offensive cybersecurity.
Published CVE(s).
Strong offensive security knowledge: API security testing and manipulation; prior red teaming, penetration testing, or adversarial testing.
Hands-on jailbreak experience.
Ability to work with multiple teams, explain risk and impact, and present to different teams and C-level stakeholders.
Good communication skills in English.
Experience handling and maintaining production-level code.