A Prompt Injection Researcher, also known as a Jailbreak Researcher, studies one of the hardest open problems in LLM security. Language models cannot reliably tell the difference between instructions from their developer and instructions hidden in the content they process. That weakness lets an attacker override system prompts, bypass safety training or hijack an agent through a web page, an email or a file the model reads.
Companies hire specialists in this area because general red teaming finds known jailbreaks, while a dedicated researcher finds the next ones. As models gain tools, memory and the ability to act on a user's behalf, a successful injection can move from producing an embarrassing reply to sending data out of the organisation or taking an action nobody approved. Labs and product teams want people who understand the problem deeply enough to design defences and measure whether they work.
What does a Prompt Injection Researcher do?
The role is research-led but practical. A Prompt Injection Researcher develops new attack techniques, builds datasets and benchmarks around them, and evaluates mitigations under adaptive attack. Findings go to model training teams, product security and safety policy, and sometimes into public research.
- Developing direct and indirect injection attacks against chat assistants, retrieval systems and tool-using agents
- Designing jailbreaks that generalise across models, including multi-turn, many-shot, role-play and encoded or translated attacks
- Researching automated attack generation, such as gradient-guided adversarial suffixes and attacker models that search for successful prompts
- Testing multimodal injection, where instructions are hidden in images, documents or audio
- Evaluating defences such as instruction hierarchies, input and output classifiers, spotlighting of untrusted content and privilege separation in agent design
- Building benchmark datasets and evaluation harnesses that track attack success rates across model versions
- Writing up findings for internal teams and contributing to responsible disclosure or publication
Key skills and backgrounds
Candidates typically come from security research, NLP research or LLM evaluation work. Some started as bug bounty hunters or red teamers and became known for original jailbreak techniques. Others are ML researchers who worked on robustness or alignment and moved towards the security side. What separates strong candidates is the ability to reason about why an attack works, which makes their defences and evaluations more trustworthy.
When interviewing, ask candidates to explain a technique they developed, how it was measured and what defence would stop it. Then ask how they would break that defence.
- Deep understanding of transformer models, tokenisation, instruction tuning and RLHF, and how each shapes injection behaviour
- Adversarial prompt design across single-turn, multi-turn and agentic settings
- Python and experience running large-scale experiments against model APIs and open-weight models
- Automated red-teaming methods, including optimisation-based and model-driven attack search
- Experimental design for attack success measurement, including sensible baselines and statistical care
- Knowledge of agent security patterns such as least privilege, human approval steps and sandboxed tool execution
- Familiarity with the OWASP guidance on LLM application risks and MITRE ATLAS
Where Prompt Injection Researchers work
Foundation model labs hire prompt injection researchers into safety, security and alignment teams to harden models during training. Companies building AI agents, browser assistants, coding tools and enterprise copilots hire them to secure products that read untrusted content. AI security start-ups building guardrails, firewalls and detection products need them to design and test their core technology. Academic and non-profit research groups also study injection and jailbreaks, often in collaboration with industry.
Prompt Injection Researcher vs related roles
Injection research connects to several offensive roles. These are the closest.
- An AI Offensive Security Researcher works across all attack classes on AI systems, while a Prompt Injection Researcher goes deep on instruction-level attacks against language models.
- An AI Vulnerability Researcher looks for software flaws in AI frameworks and infrastructure, such as memory corruption or unsafe deserialisation, rather than flaws in model behaviour.
- An AI Bug Bounty Hunter finds and reports issues in live products under a bounty programme, often using injection techniques, but is rewarded for individual findings rather than for building defences.
Salary and market data
Compensation for prompt injection researchers depends on research seniority, publication record and whether the employer is a lab, a product company or a start-up. See current ranges in the GenAI and agentic systems salary guide, compare adjacent roles across our AI and deep tech salary guides, and benchmark an offer with the deep tech salary calculator.
Hiring Prompt Injection Researchers with DeepRec
DeepRec recruits researchers and engineers in GenAI and agentic systems across Europe and the US from London, Berlin, Zurich, Dublin and Boston. The pool for this role is small and much of it is not actively looking, so we spend time on referrals and research communities as well as direct applications. Our technical screening covers attack design, evaluation method and defence thinking. We work on a permanent, contract, retained and executive search basis. To discuss a role, visit Looking to Hire.