Why This Field Matters

Most AI security work has asked one question: how do I protect my agent? Block prompt injection, narrow tool permissions, put execution in a sandbox. As platforms that let an agent write code and deploy it on the spot have multiplied, a second direction has appeared. How do you protect the platform when users abuse its execution capability? The target of defense flips.

The structure makes it clear why this becomes its own role. An agentic coding platform, by definition, hands compute, network, and deploy rights to strangers. There is a free tier and trial credit, a few lines of natural language spin up a container, and requests go out to the internet. To an attacker that is both free resource and a launch pad. Mining, spam infrastructure, proxy relays, and card testing against payment tooling all come through the same door. Because the caller is an agent rather than a person, anomaly detection built on human behavioural assumptions fits poorly.

The market has already started carving out titles for this. Replit, an agentic software creation platform, has both Engineering Manager, Anti-Abuse & Security (total compensation $210K to $275K) and Staff Software Engineer, Fraud ($250K to $315K) open at the same time. Cursor, the AI code editor, folded agent security and product security into one team under Engineering Manager, Agent & Product Security. OpenAI’s Offensive Security Agent Engineer sits in a $347K to $490K band. Abuse response has been promoted from a trust-and-safety subtask into staff and lead level engineering work.

What stands out is company size. These are not enterprises with mature risk functions. They are startups whose user counts grew fast. When growth rate and abuse rate rise together, deferring abuse work stops being an option, because compute leaking out of the free tier shows up directly in burn.

Required Skills

First, anomaly detection built for agent behaviour. Human-oriented signals such as typing cadence, cursor paths, and session length lose their power here. What you look at instead is the shape of the work: which tools get called in what order, how the destination distribution of outbound traffic differs from a normal build, whether generated code actually reaches a deploy or just loops on execution. You need to define the normal user’s work graph before an anomaly is visible.

Second, the economics of resource abuse. Success here is not measured by detection rate alone. It is measured in dollars lost. You need judgment about where to set per-account compute ceilings, trust tiers for new accounts, and rate limits on suspicious work so that losses fall without wrecking legitimate users. Because a single false positive ruins a new developer’s first session, this sits right against product decisions.

Third, the fundamentals of the fraud domain. Payment abuse, promotional credit farming, multi-account linkage inference, device and network fingerprinting. Card testing and credit farming are problems fintech has worked for two decades, so that toolbox transfers directly. That is exactly why the postings above put the word fraud in the title.

Fourth, the ability to isolate and cut off. Detection without enforcement is worthless. You need infrastructure knowledge to safely perform container isolation, egress policy, credential revocation, and forced workload termination. The recurring appearance of Python, Go, Kubernetes, and cloud operations in this family of postings comes from that requirement.

On the soft side, the decisive skill is explaining the trade-off between loss and friction in numbers. The configuration that perfectly stops abuse usually kills the product, and you have to convince leadership and product where between the two you intend to stand.

Career Path

There are two entry routes. One starts in trust and safety or fraud detection and moves onto an agentic platform. The other starts in infrastructure or platform engineering and widens scope into abuse response. The second is more common lately, since isolation and enforcement are ultimately infrastructure work. Replit keeping Security Engineer, Vuln Management (Infra) ($210K to $270K) open in the same period shows that adjacency.

Past senior, the staff and manager tracks both open. The staff side owns the design of detection systems and enforcement paths; the manager side pulls abuse response together as a single team objective. The postings above ask for eight to ten or more years of experience and span $210K to $490K in compensation, which reads as thin supply.

In many markets the title has not separated out yet. The same problem already occurs at companies selling cloud and developer tools, SaaS with generous free trials, and commerce platforms that added generative features. Whether they sit in the security team or the platform team, the person who can answer “where is our free resource leaking” in numbers is already doing this role. If the title does not exist, creating it puts you in a stronger negotiating position.

One caution. Success in this work appears as an absence of incidents, which makes contribution hard to prove. Establishing metrics from day one, dollars lost, abusive jobs blocked, legitimate users lost to false positives, ends up shaping the career as much as the engineering does.