Senior AI App Sec Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, develop, and test prototypes and production-ready capabilities leveraging generative AI, large language models, AI agents, and multi-step agentic workflows.

• Create Python-based services, automation, integrations, evaluation harnesses, and supporting tools tailored for Application Security use cases.

• Assess AI-enabled security products and frameworks for vulnerability identification, exploitability analysis, secure code guidance, remediation, validation, and integration into developer workflows.

• Establish controlled workflows for AI to analyze code, utilize approved tools, suggest or generate modifications, conduct tests, and provide auditable evidence with human oversight.

• Set technical guardrails concerning agent identity, least privilege, data access, tool usage, repository access, secrets management, logging, traceability, change control, and safe failure or termination.

• Create test plans and benchmarks for aspects such as accuracy, security, reliability, repeatability, cost, latency, false positives, remediation quality, and operational value.

• Conduct security testing of AI and agentic workflows, focusing on issues like prompt injection, unsafe tool utilization, excessive agency, data leakage, insecure output management, dependency and supply chain vulnerabilities, and authorization failures.

• Integrate capabilities with source control, CI/CD pipelines, developer tools, issue management, security testing platforms, and vulnerability management processes.

• Define reference architectures, reusable patterns, technical requirements, runbooks, and operational support models.

• Collaborate with governance and architecture teams on enterprise AI, security, privacy, data protection, and technology standards.

• Assist application teams in pilot projects, gather feedback, assess outcomes, and provide recommendations on whether capabilities should be scaled, redesigned, procured, developed, or decommissioned.

• Stay updated on trends in generative AI, agentic systems, secure AI engineering, Application Security, and software delivery methodologies.

• Lead or significantly contribute to complex projects with a wide scope and notable technical impact.

• Suggest new practices, architectures, controls, metrics, and engineering methodologies.

• Mentor and provide technical guidance to junior colleagues and cross-functional partners.

• Articulate technical findings, risks, trade-offs, and recommendations to engineering, security, governance, and leadership forums.

⛳️ Requirements

• Bachelor's degree in computer science, software engineering, cybersecurity, information systems, or a related field, or equivalent practical experience.

• Extensive experience in software engineering, security engineering, Application Security, DevSecOps, or a closely related technical domain.

• Proven expertise in developing solutions using Python.

• Solid understanding of Application Security principles and secure software development practices.

• Experience in delivering intricate technical work with limited specifications and coordinating among various stakeholder groups.

• Practical experience in generative AI application development, LLM integration, agentic systems, or AI-enabled developer tooling.

• Familiarity with one or more additional programming languages or platforms such as Java, JavaScript/TypeScript, .NET/C#, or Go.

• Experience with cloud services, containers, Kubernetes, infrastructure as code, and enterprise developer platforms.

• Background in AI evaluation, adversarial testing, red teaming, observability, or governance controls for AI-enabled systems.

• Knowledge of OWASP Top 10, OWASP guidance for LLM or agentic applications, NIST Secure Software Development Framework, and NIST AI Risk Management Framework.

• Strong hands-on Python development skills, including API integration, automation, testing, data management, and production-quality engineering practices.

• Experience in building or integrating solutions using large language models, model APIs, retrieval-augmented generation, tool invocation, structured outputs, workflow orchestration, or agent frameworks.

• Experience in designing and assessing agentic workflows that utilize tools, maintain state, make bounded decisions, and operate with human approval when necessary.

• Strong comprehension of secure software development, common application vulnerabilities, threat modeling, secure design, authentication and authorization, secrets management, and software supply chain risk.

• Experience with Application Security capabilities such as SAST, SCA, secrets detection, DAST, API security, container security, IaC security, and vulnerability remediation workflows.

• Proficiency with Git-based development, pull requests, CI/CD, automated testing, containers, Kubernetes, and cloud-native development paradigms.

• Ability to evaluate AI output quality using repeatable test cases, metrics, red-team scenarios, and evidence-based comparisons.

• Understanding of AI security risks and controls, including prompt injection, data leakage, excessive agency, insecure tool usage, model and dependency supply chain risks, and auditability.

• Strong problem-solving, technical writing, presentation, and cross-functional collaboration abilities.

• Capability to transition between experimental engineering and enterprise operationalization while ensuring maintainability, governance, cost, and support requirements.

• Relevant security, cloud, or software certifications are advantageous but not mandatory.

🏝️ Benefits

• Medical, dental, and vision coverage.

• Paid time off plan.

• Health savings account (HSA).

• 401k savings plan.

• Access to wages before payday with myFlexPay.

• Flexible spending accounts (FSAs).

• Short- and long-term disability coverage.

• Work-Life resources.

• Paid parental leave.

• Healthy lifestyle programs.

• Bonus eligible.