Lead - AI and Application Security

Lead – AI and Application security

The Role

We are looking for an AI and Application Security Engineer with strong hands-on experience in secure SDLC practices, application security testing, red teaming, code review, container/image review, release security testing, SAST, and AI implementation security reviews. The role involves identifying security risks across applications, APIs, AI-enabled features, and cloud-hosted workloads, and partnering with engineering teams to implement scalable, practical, and measurable security improvements.

Responsibilities

• Perform application security assessments across web applications, APIs, mobile applications, services, and integrations as part of the secure SDLC.
• Conduct release security testing, including manual testing, SAST result validation, vulnerability verification, and security sign-off support before production releases.
• Perform secure code reviews and identify vulnerabilities related to authentication, authorization, input validation, session management, insecure dependencies, business logic flaws, and API security.
• Conduct container and image security reviews, including dependency, package, secret, configuration, and vulnerability checks before deployment.
• Perform AI implementation security reviews for AI-enabled features, LLM integrations, prompt flows, data exposure risks, model misuse scenarios, and security control gaps.
• Plan and execute red teaming and adversarial testing activities for applications, APIs, and AI-enabled workflows, including abuse-case testing and AI-driven security testing techniques.
• Use tools such as Burp Suite, Nessus, SAST platforms, dependency scanners, and other application security testing tools to identify, validate, and track vulnerabilities.
• Apply OWASP Top 10, OWASP API Security Top 10, STRIDE threat modeling, and secure design principles to assess application and AI implementation risks.
• Work closely with engineering, DevOps, product, and security teams to prioritize vulnerabilities, define remediation actions, and verify fixes.
• Maintain clear documentation of findings, risk ratings, remediation recommendations, vulnerability status, and release security outcomes.

Requirements

• 3–5 years of relevant experience in application security, product security, secure SDLC, DevSecOps, or AI/application security testing.
• Bachelor's degree in computer science, information security, engineering, or a related field.
• Mandatory hands-on experience with SDLC security testing, release security testing, SAST, secure code reviews, and vulnerability validation.
• Mandatory experience with application security testing tools such as Burp Suite and vulnerability assessment tools such as Nessus.
• Strong working knowledge of OWASP Top 10, OWASP API Security Top 10, STRIDE threat modeling, secure coding practices, and application risk assessment.
• Hands-on experience in red teaming, abuse-case testing, adversarial testing, or offensive security testing for applications, APIs, or AI-enabled systems.
• Experience reviewing AI implementations, including LLM integrations, prompt security, data leakage risks, insecure AI workflows, model misuse scenarios, and AI-specific threat vectors.
• Experience with container/image security reviews, dependency scanning, package vulnerability checks, and secrets/configuration review.