Security Engineer (Ai)

Job Description

We are looking for experienced Security Engineers specializing in security and privacy design reviews, threat modeling, application security, and AI Agent Security.

The ideal candidate should have hands-on experience conducting security assessments, identifying vulnerabilities, performing adversarial testing, and securing applications, APIs, cloud environments, and AI/LLM integrations.

Key Skills Required

• Strong experience in security and privacy design reviews for services, applications, APIs, cloud environments, and AI integrations.

• Proven expertise in threat modeling, including attack-surface analysis, trust-boundary identification, threat scenarios, attack paths, mitigations, and residual-risk assessment.

• Hands-on security and adversarial testing across applications, APIs, and third-party AI/LLM agents.

• Knowledge of AI Agent Security risks, including:

  • Prompt Injection

  • Unsafe Tool Usage

  • Excessive Agency

  • Permission-Scope Weaknesses

  • Guardrail Bypass

  • Sensitive Data Exposure

• Understanding of cloud security, API security, authentication, authorization, and least-privilege design principles.

• Familiarity with STRIDE, Attack Trees, and MITRE ATT&CK mapping.

• Ability to document risk-rated, evidence-backed findings and communicate effectively with engineering, privacy, security, and vendor stakeholders.

• Python or Go scripting and security automation experience preferred.

• OSCP, CISSP, or other relevant security certifications preferred.

Roles & Responsibilities

• Conduct security and privacy design reviews of services, applications, APIs, and AI integrations.

• Review architecture, data flows, trust boundaries, identity, and access controls.

• Develop threat models for critical services and AI agents.

• Document attack surfaces, abuse cases, attack paths, recommended mitigations, and residual risks.

• Perform hands-on adversarial testing of third-party AI agents.

• Conduct prompt-injection testing, unsafe tool-use scenarios, permission validation, excessive-agency testing, and sensitive-data exposure assessments.

• Produce clear, risk-rated, evidence-backed findings with practical remediation recommendations.

• Collaborate with engineering teams throughout remediation, validation, and retesting.

• Develop reusable security-review checklists, threat-model templates, adversarial test cases, and reporting standards.

• Provide weekly reports covering review throughput, risk themes, and remediation progress.