Senior Application Security Engineer – GenAI Security Evaluation

This is a fully remote position, open to applicants in Indonesia, +3 more countries.

📋 Description

• Develop executable agents and Retrieval-Augmented Generation (RAG) repositories that identify code-reachable vulnerabilities related to Sensitive Information Disclosure and Excessive Agency.

• Create realistic security scenarios that encompass tool invocation, agent memory, Model Context Protocol (MCP), and other components of LLM applications.

• Generate vulnerable, corrected, and hard-negative code variants with minimal differences concerning security.

• Assess static application security testing (SAST) tools for their effectiveness in detecting actual vulnerabilities while minimizing false positives.

• Conduct source-to-sink analysis and trace significant data flows, action paths, and trust boundaries.

• Document security findings, detailing affected assets, root causes, controls, severity, and residual risk.

• Establish authorization contexts that encompass actors, tenants, identities, authorized data, actions, purposes, and recipients.

• Create deterministic tests to verify vulnerable, corrected, and negative security behaviors.

• Suggest suitable security controls and remediation strategies.

• Engage in technical calibration, peer reviews, and quality assurance processes.

⛳️ Requirements

• Over 5 years of professional experience in application security, product security, or security-centric software engineering.

• Extensive experience in performing secure code reviews and pinpointing application-level vulnerabilities.

• Solid understanding of source-to-sink analysis, taint analysis, and static application security testing (SAST).

• Practical experience with security analysis tools such as CodeQL or Semgrep.

• Experience in building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.

• Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).

• Comprehensive understanding of authorization models, which include actors, identities, trust boundaries, multi-tenant authorization, access control, OAuth, IAM, identity management, permitted data access and actions, as well as purpose and recipient restrictions, and document-level access control.

• Production-level coding proficiency in Python and/or TypeScript.

• Capability to differentiate between legitimate Sensitive Information Disclosure and Excessive Agency vulnerabilities and non-findings or false positives.

• Strong analytical abilities and the skill to communicate technical security findings effectively.

🏝️ Benefits

• Competitive salary and performance-based incentives.

• Comprehensive health, dental, and vision insurance packages.

• Opportunities for professional development and continuous learning.

• Flexible working hours and remote work options.

• Supportive and inclusive company culture.