Sr. Application Security Engineer

Responsibilities:
• Review existing application stacks against security best practices, identify gaps, and work with development teams to define, prioritize, and track remediation plans

• Perform threat modeling and secure design reviews early in the development lifecycle to identify weaknesses before code is written
• Embed security controls into CI/CD pipelines and agentic delivery workflows, integrating automated testing and policy enforcement
• Apply recognized AI and application security frameworks — such as the OWASP Top 10, OWASP Top 10 for LLM Applications, NIST AI Risk Management Framework, and MITRE ATLAS — to assess and manage risk
• Manage third-party AI red-teaming engagements and third-party application penetration testing — defining scope, coordinating with vendors, and driving findings through remediation
• Mentor and educate developers on secure coding, secure AI development, and emerging application security threats
• Contribute to enterprise application and AI security standards, reference architectures, and governance policy

Requirements

• Minimum 3 years experience in application security or product security and 7 total cumulative experience across software development and information security
• Demonstrated experience securing generative AI and/or agentic AI systems, or strong, current hands-on knowledge of LLM and agentic AI security risks and the ability to apply it in a production environment
• Deep familiarity with authentication and authorization protocols and standards (e.g., OAuth 2.0, OpenID Connect, SAML, JWT) and common identity and access pitfalls
• Strong working knowledge of the secure software development lifecycle (SDLC) and experience embedding security into developer workflows
• Strong familiarity with DevOps/CI-CD pipelines and modern deployment practices, including deploying serverless functions and containerized workloads to Kubernetes, and securing those build and deployment pipelines
• Hands-on experience with application security testing tools and techniques, including SAST, DAST, SCA, and manual secure code review
• Solid understanding of the OWASP Top 10, CWE, and CVSS scoring, and the ability to triage and prioritize vulnerabilities
• Practical knowledge of web, API, and cloud application architectures, and the security risks associated with each
• Ability to read and understand code in one or more common languages (e.g., Python, JavaScript/TypeScript, Java, C#, or Go)
• Strong written and verbal communication skills, with the ability to explain security concepts to both technical and non-technical audiences
• Strong collaboration and influencing skills, including the ability to influence engineering teams without direct authority and to communicate risk clearly to both developers and leadership
• Strong attention to detail and sound, risk-based judgment

Preferred Qualifications

• Bachelor’s degree or higher in Computer Science, Information/Cyber Security, or a related field, or equivalent work experience
• Hands-on experience with AI agent frameworks and tooling and with the Model Context Protocol (MCP)
• Experience with AI red-teaming, adversarial testing of LLMs and agents, or building AI security guardrails and evaluation pipelines
• Relevant certifications such as CSSLP, GIAC GWAPT, OffSec OSWE, CISSP, or a recognized AI security certification
• Experience securing cloud-native environments (AWS, Azure, or GCP) and infrastructure-as-code
• Experience integrating security tooling into CI/CD platforms such as GitHub Actions, GitLab CI, or Jenkins
• Hands-on experience with GitHub Advanced Security (code scanning, secret scanning, and dependency review/Dependabot)
• Familiarity with the NIST Secure Software Development Framework (SSDF), OWASP SAMM, and software supply chain security (e.g., SLSA)
• Experience in financial services or another regulated industry
• Prior experience mentoring developers or leading security champion / secure-by-design programs