TuringCybersecurity
GenAI Security Evaluation Engineer (Up to $150/hr)
up to $150/hr
About this role, in Turing's words
We’re looking for experienced security engineers to evaluate how effectively static analysis tools detect vulnerabilities in GenAI applications.
What you'll do
- Build runnable agent/RAG repositories with code-reachable Sensitive Information Disclosure or Excessive Agency vulnerabilities across tool calling, memory, and MCP.
- Create vulnerable, fixed, and hard-negative variants with minimal security-relevant differences.
- Trace and annotate assets, data/action paths, controls, root causes, severity, and residual risk.
Show all 5 itemsHide the other 2 in What you'll do
- Define authorization contexts and write deterministic tests validating vulnerable, fixed, and negative behavior.
- Recommend security controls and participate in calibration and peer review.
Candidate background
What We’re Looking For
- 5+ years in application/product security or security-focused software engineering, including secure code review.
- Experience with source-to-sink analysis, taint analysis, SAST, CodeQL, or Semgrep.
- Hands-on experience building LLM agents or RAG systems using frameworks such as LangChain, LlamaIndex, OpenAI/Anthropic SDKs, or MCP.
- Strong authorization knowledge, including actors, trust boundaries, tenants, OAuth, IAM, identity, permitted data/actions, purposes, recipients, and document-level access control.
- Production coding experience in Python and/or TypeScript, with strong judgment in distinguishing genuine SID/EA findings from non-findings.
- Experience with OWASP LLM security risks, MCP, threat modeling, or security evaluation is a plus.
Quoted from selected sections of Turing's posting. The full posting may state other conditions. Read the full posting
A closer look
More context, when you need it.
Full job descriptionThe original posting, in Turing's words
Posted by Turing, reproduced here so you can judge the role before clicking. Original posting ↗
About Turing
Based in San Francisco, California, Turing is the world’s leading research accelerator for frontier AI labs and a trusted partner for global enterprises deploying advanced AI systems. Turing supports customers in two ways: first, by accelerating frontier research with high-quality data, advanced training pipelines, plus top AI researchers who specialize in coding, reasoning, STEM, multilinguality, multimodality, and agents; and second, by applying that expertise to help enterprises transform AI from proof of concept into proprietary intelligence with systems that perform reliably, deliver measurable impact, and drive lasting results on the P&L.
Offer Details
• Required commitment: At least 4 hours per day, minimum 20 hours per week, with 4 hours of overlap with Pacific Time.
• Engagement type: Contractor
• Engagement length: Up to 2 weeks
• Pay up to $150/hr depending on internal evaluation and location.
About the Role
We’re looking for experienced security engineers to evaluate how effectively static analysis tools detect vulnerabilities in GenAI applications.
You’ll build small, runnable agent and RAG codebases containing realistic examples of Sensitive Information Disclosure and Excessive Agency, along with fixed and near-miss versions. You’ll then trace, annotate, test, and explain each finding.
What You’ll Do
• Build runnable agent/RAG repositories with code-reachable Sensitive Information Disclosure or Excessive Agency vulnerabilities across tool calling, memory, and MCP.
• Create vulnerable, fixed, and hard-negative variants with minimal security-relevant differences.
• Trace and annotate assets, data/action paths, controls, root causes, severity, and residual risk.
• Define authorization contexts and write deterministic tests validating vulnerable, fixed, and negative behavior.
• Recommend security controls and participate in calibration and peer review.
What We’re Looking For
• 5+ years in application/product security or security-focused software engineering, including secure code review.
• Experience with source-to-sink analysis, taint analysis, SAST, CodeQL, or Semgrep.
• Hands-on experience building LLM agents or RAG systems using frameworks such as LangChain, LlamaIndex, OpenAI/Anthropic SDKs, or MCP.
• Strong authorization knowledge, including actors, trust boundaries, tenants, OAuth, IAM, identity, permitted data/actions, purposes, recipients, and document-level access control.
• Production coding experience in Python and/or TypeScript, with strong judgment in distinguishing genuine SID/EA findings from non-findings.
Experience with OWASP LLM security risks, MCP, threat modeling, or security evaluation is a plus.
Evaluation Process
• AI interview (~25 minutes)
• Resume and overall application review
• Offer
Working with TuringPay, getting started and work, from Turing's own pages
What the platform publishes in general. These are not extra terms confirmed for this particular role.
- Getting paid
- Paid monthly, around the 5th, straight to your bank account, or inside Deel on projects run through Deel. Its help articles disagree on whether that is the 5th calendar day or business day. help.turing.com/articles/9691407757-project-onboarding, help.turing.com/articles/6582454854-what-if-i-haven-t-rec..., help.turing.com/articles/1226770947-project-offboarding
- Before your first paid task
- A short application, with tests on some roles. Turing's review article says an interview is typically required for all roles. Onboarding covers the terms, ID verification with a driver's license or passport, and tax and payment details. help.turing.com/articles/2020987592-apply-for-jobs-at-turing, help.turing.com/articles/9179629201-how-long-does-the-app..., help.turing.com/articles/9691407757-project-onboarding
- How much work
- Review takes from 48 hours to 6 weeks after you finish applying, and the client makes the final choice. No reply within 6 weeks usually means you were not selected. help.turing.com/articles/9179629201-how-long-does-the-app..., help.turing.com/articles/2020987592-apply-for-jobs-at-turing
- Contract
- Depending on the project, the engagement rests on Turing's Terms of Service and a Service Agreement, on Deel, or on a partner that provides the contract. help.turing.com/articles/6582454854-what-if-i-haven-t-rec...
Read on the pages linked above on 23 Sep 2026. Platforms change these terms, so check the linked page before you rely on one.
How does the pay compare?Across Cybersecurity roles, not this role alone
From our own daily reads of every open listing on the platforms we follow, not from Turing's posting. How we count.
Pay across the field: Cybersecurity
Across 54 roles in this field with a stated hourly rate in US dollars, on 9 platforms, the middle half pays $60 to $113 an hour at the top of the range, and the median is $90. This role's top rate, $150, is in the top quarter. Of the 26 distinct rates we count, 23 are lower and 3 are higher.
| Platform | Roles | Top of range, per hour |
|---|---|---|
| Alignerr | 32 | $55 to $120 · median $60 |
| Mercor | 4 | $90 to $250 |
| micro1 | 4 | $95 to $175 |
| AfterQuery | 4 | $75 to $135 |
| DataAnnotation | 3 | $125 |
Sources and listing historyWhere this information comes from
This listing's history
- First seen here on 6 Oct 2026, and still on Turing's list when we last read it on 13 Oct 2026.
- The listed pay has not changed since then.
- Posted by Turing
- First seen by AIPayList
- Last seen live
- Listing ID
- 110806
Pay as the source states it: “Pay up to $150/hr depending on internal evaluation and location.”.
Platforms sometimes change a rate after posting. Every listing here is re-read at least once a day and corrected when its source moves, so a difference you see on the platform is usually a change made since the last read. How freshness works.
Keep exploring
More like this
Related field, different requirements. Check each role's own page before you apply.