Oreset Red Team

Apply to test AI agents for a living.

We pay security testers and sharp analysts to attack production AI agents for fintech, payments, and lending companies, and to catch the decisions those agents get wrong with no attack at all. Remote, paid per engagement, Africa-first but not Africa-only.

A lead auditor reads every application. No automated screening.
Approved testers sign an NDA and pass two calibration scenarios before any live work.
Findings you write go to real clients with your reasoning attached.
Languages matter: agents fail differently in Pidgin, Hausa, or Swahili than in English.

Already applied? Sign in to see your status.

About you

Full name

Phone or WhatsApp

Location

Choose a password

You will use it to sign in and follow your application.

Security and AI testing background

Years of professional security testing

Pentesting, bug bounty, red team, application security, or QA with a security focus.

No professional security testing yetUnder 2 years2 to 5 yearsOver 5 years

Your experience, in your own words

What have you tested, for whom, and what did you find? Bug bounty handles and CTF results count.

Have you tested an LLM, chatbot, or AI agent before?

Optional. Prompt injection, jailbreaks, tool misuse, evaluation work, or even structured personal experiments. Say what you tried and what happened.

Tools and techniques you use

Optional. Burp, custom scripts, Garak, PyRIT, manual only, whatever is true.

Work sample

The brief

A payments company runs an AI support agent. It can look up a customer’s balance and transactions, open a dispute, explain policies, and reverse a transfer once the customer passes step-up identity verification. Describe the first three things you would try to make this agent do something it should not, and for each one, what result would tell you the agent failed.

Your answer

This is what decides the application. Precision beats length. Around 150 to 400 words.

Languages

Languages you can test in

Agents behave differently across languages. English plus anything else you speak well.

Someone who will answer for you

A former manager, a client, a team lead, a professor, a bug bounty triager. We will email them one short question.

Reference name

How they know your work

Their email

Identity verification

After you apply you will upload a government ID, a selfie holding it, and your CV. A vetting officer checks them against this form. Nobody is approved without them. We store the result of the check and delete raw images once verification is complete, as described in our Privacy Notice.

I consent to Oreset verifying my identity, including checking a government ID and a live selfie (biometric data) and, if I am approved, confirming that the bank account I give is in my name. I understand the person who tests must be the person who was vetted.

Practical

Availability

Optional. Engagements run one to two weeks; most testers work a few evenings per engagement.

Weekday daytimeWeekday eveningsWeekendsFull time

Portfolio, GitHub, HackerOne, or LinkedIn

Required. One public link we can open and check. A link that goes nowhere ends the application.

By applying you agree to keep anything you learn about client systems confidential, before and after any NDA.