Responsibilities:
• Review existing application stacks against security best practices, identify gaps, and work with development teams to define, prioritize, and track remediation plans
- Perform threat modeling and secure design reviews early in the development lifecycle to identify weaknesses before code is written
- Embed security controls into CI/CD pipelines and agentic delivery workflows, integrating automated testing and policy enforcement
- Apply recognized AI and application security frameworks — such as the OWASP Top 10, OWASP Top 10 for LLM Applications, NIST AI Risk Management Framework, and MITRE ATLAS — to assess and manage risk
- Manage third-party AI red-teaming engagements and third-party application penetration testing — defining scope, coordinating with vendors, and driving findings through remediation
- Mentor and educate developers on secure coding, secure AI development, and emerging application security threats
- Contribute to enterprise application and AI security standards, reference architectures, and governance policy
Requirements
- Minimum 3 years experience in application security or product security and 7 total cumulative experience across software development and information security
- Demonstrated experience securing generative AI and/or agentic AI systems, or strong, current hands-on knowledge of LLM and agentic AI security risks and the ability to apply it in a production environment
- Deep familiarity with authentication and authorization protocols and standards (e.g., OAuth 2.0, OpenID Connect, SAML, JWT) and common identity and access pitfalls
- Strong working knowledge of the secure software development lifecycle (SDLC) and experience embedding security into developer workflows
- Strong familiarity with DevOps/CI-CD pipelines and modern deployment practices, including deploying serverless functions and containerized workloads to Kubernetes, and securing those build and deployment pipelines
- Hands-on experience with application security testing tools and techniques, including SAST, DAST, SCA, and manual secure code review
- Solid understanding of the OWASP Top 10, CWE, and CVSS scoring, and the ability to triage and prioritize vulnerabilities
- Practical knowledge of web, API, and cloud application architectures, and the security risks associated with each
- Ability to read and understand code in one or more common languages (e.g., Python, JavaScript/TypeScript, Java, C#, or Go)
- Strong written and verbal communication skills, with the ability to explain security concepts to both technical and non-technical audiences
- Strong collaboration and influencing skills, including the ability to influence engineering teams without direct authority and to communicate risk clearly to both developers and leadership
- Strong attention to detail and sound, risk-based judgment
Preferred Qualifications
- Bachelor’s degree or higher in Computer Science, Information/Cyber Security, or a related field, or equivalent work experience
- Hands-on experience with AI agent frameworks and tooling and with the Model Context Protocol (MCP)
- Experience with AI red-teaming, adversarial testing of LLMs and agents, or building AI security guardrails and evaluation pipelines
- Relevant certifications such as CSSLP, GIAC GWAPT, OffSec OSWE, CISSP, or a recognized AI security certification
- Experience securing cloud-native environments (AWS, Azure, or GCP) and infrastructure-as-code
- Experience integrating security tooling into CI/CD platforms such as GitHub Actions, GitLab CI, or Jenkins
- Hands-on experience with GitHub Advanced Security (code scanning, secret scanning, and dependency review/Dependabot)
- Familiarity with the NIST Secure Software Development Framework (SSDF), OWASP SAMM, and software supply chain security (e.g., SLSA)
- Experience in financial services or another regulated industry
- Prior experience mentoring developers or leading security champion / secure-by-design programs
