AI Engineer

TryHackMe

Contractor for owning AI engineering at TryHackMe's Live Breach product. Building adaptive AI systems for cyber incident simulations in a remote environment.

Posted 5/8/2026contractRemote • 🇬🇧 United KingdomMid-LevelSeniorWebsite

Tech Stack

Tools & technologies

CloudCyber SecurityPythonReact

About the role

Key responsibilities & impact

You'll build and own the AI systems that make Live Breach feel like a real incident rather than a scripted exercise.
The AI attacker agent - an autonomous LLM-powered agent that receives a threat actor profile, a network briefing, and a configured attack chain, then executes it against a live environment.
The exercise orchestration layer - a parallel system that monitors the network during a live exercise, recognises which attack techniques have executed, listens for correct containment and eradication actions from participants, and surfaces investigation tasks tied to real attacker behaviour.
Prompt engineering for both red and blue team agent components, in close collaboration with our content engineering team
Integration with adversary emulation tooling for realistic technique execution
User emulation and noise generation — simulating realistic background activity so participants must distinguish real attacker behaviour from normal log volume
Documentation and architecture that allows the broader engineering team to operate and debug the AI layer without dependency on any single person.

Requirements

What you’ll need

Hands-on experience building LLM-powered agents — planning loops, tool use, memory, state management
Strong Python engineering; able to ship production-quality agentic systems, not just prototypes
Ability to design prompts and agent architectures that are reliable and predictable under adversarial conditions
Comfortable working autonomously on problems that aren't fully defined — you'll need to make good technical decisions with limited hand-holding
Strong async communication; the team is distributed and documentation matters
Working familiarity with cybersecurity concepts — attack techniques, MITRE ATT&CK, network fundamentals (Active Directory, lateral movement, persistence).
Experience with adversary emulation frameworks (MITRE CALDERA or similar)
Experience building event-driven systems that monitor and react to real-time state changes
Familiarity with cloud infrastructure (we provision VMs and networks dynamically per exercise)
Prior work in the cyber range, red team tooling, or security simulation space
Experience with multi-agent architectures where agents observe and react to each other

Benefits

Comp & perks

Remote work options
Professional development opportunities

ATS Keywords

✓ Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

LLM-powered agentsPythonprompt engineeringadversary emulation frameworksevent-driven systemscloud infrastructuremulti-agent architecturesstate managementnetwork fundamentalscybersecurity concepts

Soft Skills

autonomous problem solvingtechnical decision makingasync communicationcollaborationdocumentation