Senior Application Security Engineer – GenAI Security Evaluation

This is a fully remote position, open to applicants in Bangladesh, +5 more countries.

📋 Description

• Construct executable agents and RAG repositories that encompass code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.

• Create realistic security scenarios that incorporate tool invocation, agent memory, Model Context Protocol (MCP), and various components of LLM applications.

• Generate vulnerable, corrected, and hard-negative code variations with minimal security-relevant discrepancies.

• Assess SAST tools and evaluate their capability to identify authentic vulnerabilities while minimizing false positives.

• Conduct source-to-sink analysis and trace pertinent data flows, action paths, and trust boundaries.

• Document security findings, detailing affected assets, root causes, controls, severity, and residual risk.

• Establish authorization contexts that encompass actors, tenants, identities, permitted data, actions, purposes, and recipients.

• Develop deterministic tests to validate vulnerable, corrected, and negative security behaviors.

• Suggest appropriate security controls and remediation strategies.

• Engage in technical calibration, peer reviews, and quality assurance initiatives.

⛳️ Requirements

• Over 5 years of professional experience in application security, product security, or security-focused software engineering.

• Extensive experience in conducting secure code reviews and identifying application-level vulnerabilities.

• Practical understanding of source-to-sink analysis, taint analysis, and static application security testing (SAST).

• Hands-on experience with security analysis tools such as CodeQL or Semgrep.

• Experience in building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.

• Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).

• Comprehensive understanding of authorization models, actors, identities, trust boundaries, multi-tenant authorization, access control, OAuth, IAM, identity management, permitted data access and actions, purpose and recipient restrictions, and document-level access control.

• Production-level coding expertise in Python and/or TypeScript.

• Ability to differentiate genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.

• Strong analytical abilities and the capability to communicate technical security findings effectively.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance.

• Flexible working hours and remote work options.

• Opportunities for professional development and continuous learning.

• Supportive work environment that values diversity and inclusion.