Application & AI Security Engineer

Job Summary

We are looking for a skilled Application Security & AI Security Engineer with 4-6 years of hands-on experience in application penetration testing, AI agent penetration testing, vulnerability management, and security monitoring. The ideal candidate will have strong offensive security skills, practical knowledge of AI/LLM vulnerabilities, experience assessing APIs and cloud environments, and working knowledge of SIEM tools for security monitoring and incident investigation.

What this role entails

1. Application & AI Penetration Testing

• Conduct penetration testing on web applications, APIs, networks, and cloud environments (Google Cloud Platform).
• Perform manual and automated security testing of web applications, APIs, AI agents, LLM applications, chatbots, and RAG systems.
• Identify issues such as broken authentication and authorization, injection, business-logic flaws, prompt injection, jailbreaks, excessive agency, sensitive-data leakage etc. and insecure tool use.
• Identify, exploit, and document security flaws and misconfigurations.
• Prepare detailed technical reports and executive summaries for stakeholders.
• Contribute to improving internal security testing processes and automation.

2. Vulnerability Management & Secure Development

• Assess application, cloud, and infrastructure vulnerabilities; prioritize findings by severity, exploitability, and business impact.
• Support threat modeling, secure design reviews, and integration of security testing into the SDLC/DevOps process.
• Collaborate with development and infrastructure teams to remediate identified vulnerabilities.
• Stay updated on the latest exploits, vulnerabilities (CVEs), and industry trends.

3. SIEM & Security Monitoring

• Use SIEM platforms such as Wazuh or other open-source SIEM solutions to monitor logs, triage alerts, and investigate suspicious security activity.
• Support detection-rule tuning, incident investigations, and mapping relevant techniques to MITRE ATT&CK.

4. Cloud & Infrastructure Security

• GCP configurations, IAM permissions, network exposure, storage access, secrets handling, and container security basics.

Requirements

• 4-6 years of hands-on experience in application security, penetration testing, or offensive security. Strong understanding of web/API security, OWASP Top 10, authentication, authorization and common application vulnerabilities.
• Practical understanding of AI/LLM security, including prompt injection, data leakage, and AI agent/tool risks.
• Strong understanding of OWASP Top 10, MITRE ATT&CK, and other industry standards.
• Proficiency in tools like Burp Suite, Metasploit, Nmap, Wireshark, Nessus, Nikto, SQLmap.
• Hands-on experience with scripting languages such as Python, Bash.
• Exposure to SIEM operations, log analysis, alert triage
• Understanding of Secure SDLC and DevOps principles.

Preferred Certifications

• OSCP, PNPT, eCPPT, Burp Suite Certified Practitioner, or relevant AI security training.
• CPT (Certified Penetration Tester)
• GPEN (GIAC Penetration Tester)
• CRTP / CRTE / PNPT / eJPT / eCPPT (as relevant)

Soft Skills

• Strong analytical and problem-solving skills.
• Excellent communication skills able to explain technical details to non-technical stakeholders.
• Team player with the ability to work independently under minimal supervision.
• Attention to detail and ability to document findings clearly.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.