• Build and grow the automated evaluation suite every agent runs against before it's approved for production, designed to run unattended and scale across a growing agent fleet, not something that needs a person babysitting each run.
• Design adversarial test scenarios — prompt injection attempts, sycophancy checks where an agent has to correctly push back on a false premise, multi-attempt attacks rather than single-shot ones — and automate them so they run on every relevant change, not just before a big release.
• Own the "break it on purpose" pass for every new agent: attempt to extract data it shouldn't expose, get it to act outside its registered tool boundaries, or get it to treat a synthetic test probe as real. As the fleet grows, build this into a repeatable, scriptable process rather than a manual exercise redone from scratch each time.
• Partner with the Data Steward on data sensitivity classification for the systems agents touch, so your test scenarios reflect what's actually at stake, not a generic checklist.
• Decide, for each agent capability, what "pass" actually means, and build that judgment into automated thresholds wherever possible so evaluation keeps up as the number of agents climbs into the hundreds.
• Maintain the guardrail and negative-test catalog (fail-closed vs. fail-graceful behavior) across the platform, and add new cases as new failure modes get discovered in the wild.
• Produce clear, audit-ready evidence for every agent's evaluation results, generated automatically as part of the pipeline rather than assembled by hand for each review.
• Track drift over time across the whole fleet, not agent by agent, so a slow-moving problem in one corner doesn't go unnoticed just because no one's looking at that specific agent that week.

• At least 4 years in software quality, security testing, or a related discipline, with 1–2 years specifically evaluating or red-teaming LLM-based systems — not just running unit tests against traditional code.
• Strong Python skills, since the evaluation harness, adversarial test scripts, and automated pipelines will mostly be built in it. Comfortable writing production-quality code, not just glue scripts.
• Working knowledge of REST APIs and webhook/event-driven patterns, enough to build test harnesses that call an agent's tools directly and validate its inputs and outputs, not just its final chat response.
• Real experience building automated test infrastructure and integrating it into CI/CD, not just manually running test cases — someone who thinks in pipelines and repeatability by default.
• Hands-on familiarity with at least one adversarial testing or LLM eval tool (DeepTeam, Garak, PyRIT, Promptfoo, or similar), and an understanding of how these map to standards like the OWASP LLM Top 10 or NIST's AI risk framework.
• Practical understanding of prompt injection, jailbreaking, and sycophancy failure modes — able to design new test cases for these, not just run ones someone else wrote.
• Comfort making a hard call: willing to block a release when an agent doesn't meet its bar, even under schedule pressure.

• Enough understanding of data sensitivity and compliance classification to design tests that reflect real risk, even though the Data Steward owns the classification system itself.
• Experience in a regulated environment where evaluation results had to hold up to an external audit, not just an internal review.
• Familiarity with multi-attempt or persistent-attack testing methodology, rather than only single-shot adversarial prompts.
• Some exposure to how agents are actually built (prompting, tool schemas, orchestration) — not required, but it makes it much easier to design tests that target real failure modes instead of generic ones.

#LI-CV1