Principal Application & AI Security Engineer

8+ years of experience in application security or secure software engineering, with demonstrated responsibility for production software and security controls.

A degree in computer science, cybersecurity, engineering, or a related field is welcome but not required. Equivalent practical experience is fully recognized.

Deep application and API security expertise, including authentication, authorization, session management, data protection, input validation, and multi-tenant isolation. This is the core of the role.

Ability to review, write, test, and improve production-quality code in one or more languages commonly used in cloud applications, automation, and security engineering.

Experience leading source-code reviews, application and API security testing, threat modeling, and architecture reviews for complex systems.

Experience integrating and tuning security tooling in CI/CD and converting findings into risk-based automated controls.

Production experience with a major cloud provider (Azure, AWS, or comparable) and practical understanding of cloud identity, platform services, and the shared-responsibility model.

Demonstrated ability to set technical direction, create reusable capabilities across multiple products, and influence senior stakeholders without relying on formal authority.

Ability to explain material security risk clearly to engineers, product leaders, executives, customers, and assurance stakeholders.

Strong written and verbal English communication skills.

We conduct pre-employment drug and background screening.

Practical AI-agent security experience, including excessive permissions, insecure tool invocation, untrusted inputs, memory or context risks, sensitive-data exposure, insufficient human oversight, and unsafe autonomous action.

Experience applying AI to security testing, code analysis, vulnerability triage, or security automation.

Experience securing distributed, event-driven, multi-tenant, or critical enterprise systems where authorization and data boundaries are material risks.

Container, Kubernetes, infrastructure-as-code, and software-supply-chain security.

Incident response, vulnerability investigation, exploit validation, and remediation verification.

Hands-on depth with Veracode, Burp Suite Professional, or equivalents, and practical familiarity with OWASP application, API, and agentic AI security guidance.

Certifications are a plus, demonstrated hands-on ability matters more. Relevant credentials include OSCP, GIAC GWAPT, GWEB, GCSA, AZ-500, AWS Certified Security - Specialty, CISSP, or CCSP.