Research Scientist

Research Lead in Cybersecurity and AIBenchmarks Reinforcement Learning and Enterprise Environments About AxiaAxia is building research data, evaluation methods and environments that help AI systems perform useful work. Our cybersecurity program connects current threats and realistic enterprise workflows to benchmarks, training tasks and validated outcomes for AI labs and security teams. The opportunityWe are looking for a researcher who can connect deep cybersecurity knowledge with the experimental discipline of AI research. You will lead the cyber research agenda, working with our CTO/CISO, CAIO and Head of AI Research to build evaluations and training data that measure meaningful security capability. The role spans AI for cybersecurity and the security of AI agents. You will study offensive and defensive workflows in authorized environments, and examine how tool access, permissions, context and operational constraints affect agent behavior. What you will own
• Create realistic research tasks. Translate vulnerabilities, incident patterns and security workflows into reproducible environments. Develop multi-step scenarios involving software, identity, cloud services, APIs and business systems, with clear task boundaries and outcomes.
• Measure defensive work. Build tasks for vulnerability triage, secure patching, patch regression, detection engineering, threat hunting, incident investigation and recovery. Evaluate whether an action fixes the problem while preserving legitimate service behavior.
• Study cyber agents. Compare model and scaffold configurations under controlled budgets. Examine planning, tool selection, uncertainty, escalation and prompt-injection resistance in workflows involving untrusted content and external tools.
• Design trustworthy verifiers. Validate intended state changes and constraints, accept legitimate alternative solutions, and test for false passes, false failures, leakage and reward exploits. Use reference executions, negative controls and adversarial QA.
• Develop training signals. Build expert and model trajectories, reward functions and curricula for SFT and RL. Measure which task families and data mixtures improve held-out cyber performance with the AI research team.
• Make enterprise realism measurable. Include varied controls, realistic background activity, incomplete telemetry and organization-specific restrictions. Tie outcomes to protected assets, recovery and operational impact.
• Protect experimental validity. Separate capability failure, policy refusal, infrastructure failure and ambiguous task design. Establish reproducible resets, run-level variation, isolated environments and checks that enforce authorized scope.
• Publish useful research artifacts. Produce documented benchmark releases, failure analyses and lab-facing reports. Convert security-team feedback into new research questions and improved evaluation coverage. Cybersecurity research candidate profileQualifications and early outcomes What you bring
• Substantial hands-on depth in at least one security discipline, such as vulnerability research, program analysis, application security, cloud and identity security, detection engineering, incident response or adversary emulation.
• Evidence of research ability through papers, disclosed vulnerabilities, reproducible technical investigations, open-source tools or rigorous experiments. You can formulate a hypothesis and distinguish an interesting example from a general result.
• Direct experience evaluating or training AI systems for security, or a strong security research record paired with demonstrable implementation of LLM-agent evaluations and working knowledge of RL rewards and post-training.
• Strong Python and Linux skills; familiarity with containerized workloads, networked systems, telemetry and reproducible experiments. You can work with environment engineers to debug a broken task or unreliable grader.
• Ability to reason about attacker actions and defender evidence, and to explain what a benchmark result does and does not establish about enterprise readiness. Especially relevant experienceUseful specializations include fuzzing, reverse engineering, exploit validation, secure code generation, SOC automation, SIEM/EDR workflows, software supply chains, AI application security and agent tool protocols such as MCP. Experience in financial systems, healthcare, industrial control systems or other operationally constrained sectors is valuable. We expect depth in selected areas and collaboration across the rest. We welcome researchers from AI labs, security companies, enterprise R&D, academia and data providers. A PhD is optional; evidence of experimental research is essential. What early success looks like
• First 30 days: audit a representative task sample; define a cyber capability map and failure taxonomy; identify the most consequential gaps in verifiers and enterprise realism.
• By 60 days: deliver a validated pilot collection spanning offensive and defensive workflows, including reference solves, negative controls, reproducible resets and telemetry.
• By 90 days: complete a controlled evaluation or training study with held-out task families, and produce a report that separates capability, refusal, environment and scoring effects. How we will measure research qualityTrack pass rates, repeatability, verifier errors, valid trajectory yield and transfer to unseen services or configurations under explicit budgets. Report uncertainty and failure categories. Enterprise metrics should also capture patch effectiveness, false alarms, recovery, time to outcome and operational side effects. Aggregate scores must preserve visibility into critical failures. What to share with usShare a research artifact and a short explanation of how you would convert a real security workflow into an AI evaluation. Explain the ground truth, an alternative valid solution, a way the grader could be fooled and how you would test the fix.