Lead AI Security Engineer

We are seeking a Lead AI Security Engineer to secure software across the full development lifecycle. This role embeds security into design, code, build and release; operates application security tooling and pipelines; partners with engineering to drive remediation; and applies AI both to accelerate AppSec work and to secure AI
- and LLM-powered applications. Responsibilities Embed security into the full software development lifecycle and drive shift-left and secure-by-design practices across engineering teamsPerform and facilitate threat modeling, architecture security reviews, and design reviews for applications, services, and APIsConduct secure code reviews (manual and AI-assisted) and advise developers on secure coding patterns and remediationImplement, configure, tune, and operate application security tooling, including SAST, DAST, IAST, SCA, secrets scanning, and IaC scanning, integrated into CI/CD pipelinesTriage, validate, prioritize, and reduce false positives in security findings, and partner with development teams to track issues through to remediationDefine, implement, and maintain security gates and policies in CI/CD pipelines that balance risk reduction with developer velocitySecure the software supply chain, including dependency and open-source risk management, SBOM generation, artifact integrity and signing, and build pipeline hardeningSupport and coordinate application penetration testing and validate fixes for identified vulnerabilitiesDrive secrets management, secure configuration, API security, container and image security, and microservice security practicesEstablish and run a security champions program, and develop and deliver secure-coding training, guidelines, and reusable security patterns for developersDefine and maintain application security standards, baselines, and policy-as-code, and contribute to vulnerability management and risk-acceptance processesBuild, deploy, and maintain AI-assisted automations and agentic workflows that reduce manual effort across daily application security activities, such as: vulnerability triage, deduplication, prioritization, and false-positive reduction; automated and assisted code review with concrete remediation guidance and example fixes; threat modeling support and abuse-case and attack-path generation; finding enrichment, root-cause analysis, and remediation-PR drafting; compliance evidence collection; secure-coding documentation, query, and runbook automationBuild and integrate AI agents and LLM-backed automations into the SDLC and CI/CD pipelines, connecting models to scanners, code hosts, ticketing, and security tooling via function calling, REST, and webhooksDevelop, test, and maintain reusable prompts, structured-prompting patterns, and prompt templates for recurring AppSec tasks, and tune them for accuracy, signal quality, and safe behaviorImplement retrieval over codebases, security standards, and remediation guidance (for example RAG) so AI assistants answer from current, authoritative internal context rather than guessworkBuild evaluation, validation, and human-in-the-loop checkpoints into AI-assisted AppSec workflows, including output verification, guardrails, and approval gates before findings, fixes, or pipeline decisions are acted onImplement security and privacy controls for AppSec AI usage, including least-privilege access for agents, source-code and secrets handling, prompt-injection resistance, and auditability of AI-driven actionsDesign, implement, and operate security controls for AI
- and LLM-powered application features, including input and output validation, prompt-injection and jailbreak defenses, tool
- and function-call authorization, rate limiting, and model and data access governance, aligned to the OWASP Top 10 for LLM ApplicationsDefine and enforce guardrails for secure adoption of AI in product engineering, covering prompt security, model and tool access control, output handling, data protection, auditability, and human-in-the-loop processes, and advise development teams on building AI features securely Requirements Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experienceHands-on application security experience across the software development lifecycleStrong understanding of common application vulnerability classes and mitigations, including the OWASP Top 10, and of secure coding principlesPractical experience with application security tooling, such as SAST, DAST, SCA, and secrets scanning, and integrating it into CI/CDWorking knowledge of at least one programming language (for example Python, Java, C#, JavaScript/TypeScript, or Go) sufficient to read code and assess vulnerabilitiesExperience with threat modeling and secure design review methodologiesUnderstanding of DevOps/DevSecOps practices, CI/CD pipelines, and secure-by-design principlesFamiliarity with cloud application security concepts across at least one major cloud platform such as Azure, AWS, or GCPExperie