Staff Application Security Engineer

This is a fully remote position, open to applicants in Utah.

📋 Description

• Oversee security assessments and threat modeling for AI functionalities and agentic systems, which include autonomous agents, MCP servers, and third-party integrations.

• Establish security protocols for AI agents, encompassing identity management, delegated authorization, data access, tool output, supply chain management, and human approval processes.

• Create and deploy security-team agents designed for validation, triage, review support, and remediation efforts.

• Assist developers and security advocates in the safe use and creation of agents through effective guidance and tooling.

• Incorporate security criteria into the software development lifecycle, ensuring design-time and release-time checkpoints for AI features.

• Implement agent-assisted code review processes, validation of findings, and fix recommendations within CI/CD workflows.

• Manage cross-team, multi-quarter security initiatives and communicate progress, risks, and trade-offs to leadership.

• Act as a representative for Application Security in architectural discussions and serve as an escalation contact.

• Collaborate with Legal, Privacy, and GRC teams on AI governance and the development of emerging AI regulations.

• Educate and mentor software engineers on secure design practices and threat modeling techniques.

• Guide security engineers on technical strategies and professional growth.

• Participate in an on-call rotation and provide support for incident response activities.

⛳️ Requirements

• Bachelor's degree in Computer Science, Information Security, or a related discipline, or equivalent practical experience.

• Over 8 years of experience in security, with at least 5 years of direct experience in application security.

• Proven experience in securing multi-tenant SaaS platforms, ensuring tenant isolation.

• Familiarity with cloud and infrastructure security, including AWS, Azure, or GCP.

• Practical experience in developing AI agents or agentic workflows.

• Capability to assess the security of AI and agentic systems, addressing issues such as prompt injection, tool/context poisoning, excessive agency, delegated authorization, data leakage, and supply-chain vulnerabilities.

• Knowledge of the OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, or similar frameworks.

• Proficiency in designing evaluations for agentic workflows.

• Experience leading threat modeling sessions and design reviews for intricate applications and APIs.

• Comprehensive understanding of web application and API security, including authentication, authorization, OAuth 2.0, OpenID Connect, session management, and access control frameworks.

• Strong software engineering skills in at least one programming language, such as Python, TypeScript, or PHP.

• Experience in spearheading cross-team projects and exerting influence without formal authority.

• Background in mentoring engineers.

• Good judgment in uncertain scenarios.

• Employment is subject to successful completion of background and credit checks.

🏝️ Benefits

• Comprehensive health, life, and disability insurance coverage.

• Generous leave policies, including 4 weeks of vacation, 12 company holidays, parental leave, and volunteer time off.

• 401k plan with a company match of up to 6%.

• $2000 Paid-Paid Vacation bonus.

• Employee Assistance Program provided through Headspace.

• Opportunities for professional development.

• Flexible working arrangements.

• Positive company culture.