Lead Security Engineer - Penetration Testing & AI Security

Application Security, Secure SDLC & DevSecOps

• Lead Application Security initiatives across web, mobile, API, microservices, and cloud-native products.

• Conduct architecture reviews, threat modeling, secure design and code reviews, and hands-on security assessments.

• Identify weaknesses in authentication, authorization, tenant isolation, business logic, data protection, and API security.

• Define practical security standards, requirements, guardrails, and reusable secure engineering patterns.

• Improve security testing across CI/CD pipelines using SAST, DAST, SCA, secret scanning, container scanning, and Infrastructure as Code scanning.

• Drive risk-based vulnerability triage and remediation in partnership with engineering teams.

• Develop security automation and promote secure coding through developer guidance, documentation, and training.

AI Security Assessment & Adversarial Testing

• Lead security reviews of LLM applications, AI agents, RAG architectures, machine learning services, and third-party AI integrations.

• Assess AI architectures, including model APIs, data pipelines, vector stores, prompts, fine-tuning workflows, plugins, and agent tool chains.

• Conduct adversarial testing for prompt injection, jailbreaking, sensitive-data disclosure, system-prompt leakage, output manipulation, insecure tool use, excessive agency, and model abuse.

• Evaluate applicable risks involving data poisoning, model inversion, training-data extraction, adversarial evasion, and model exfiltration.

• Test security controls such as guardrails, input/output filtering, access controls, human approvals, logging, monitoring, and abuse detection.

• Develop repeatable AI security testing methodologies, playbooks, automation, and test cases using tools such as Garak, PyRIT, or similar frameworks.

• Assess security and supply-chain risks associated with third-party models, AI platforms, and AI-enabled SaaS products.

Reporting, Collaboration & Leadership

• Produce clear security reports containing evidence, risk ratings, business impact, and actionable remediation guidance.

• Communicate security risks effectively to developers, architects, product leaders, and executive stakeholders.

• Partner with external consultants, researchers, and bug bounty programs for specialized assessments where required.

• Mentor engineers and help establish a security-conscious engineering culture.

• Stay current with developments in Application Security, AI Security, and adversarial testing.

• 8+ years of cybersecurity experience, with deep hands-on expertise in Application Security, product security, penetration testing, or security engineering.

• Experience conducting threat modeling, architecture reviews, secure code reviews, penetration testing, and vulnerability validation.

• 1-3 years of AI Security experience, with AI/ML security, adversarial testing of AI systems, or applied AI research with a security focus.

• Strong knowledge of web, mobile, API, and cloud-native security, including OWASP guidance and business-logic risks.

• Strong understanding of authentication and authorization technologies, including OAuth 2.0, OIDC, JWT, SAML, and modern access-control models.

• Hands-on DevSecOps experience with CI/CD security automation, SAST, DAST, SCA, secret scanning, containers, and Infrastructure as Code.

• Practical knowledge of Docker, Kubernetes, microservices, and cloud security.

• Demonstrated experience assessing or securing LLM applications, RAG systems, AI agents, machine learning models, or AI-enabled products.

• Understanding of AI threats such as prompt injection, jailbreaking, data leakage, insecure tool use, excessive agency, model misuse, and AI supply-chain risks.

• Familiarity with OWASP guidance for LLM applications, MITRE ATLAS, NIST AI RMF, and related AI security practices.

• Programming or scripting proficiency in Python, Go, JavaScript, Bash, or a similar language.

• Strong written and verbal communication skills, with the ability to influence technical and non-technical stakeholders.

• Experience building or scaling Application Security practices within a SaaS or product-led technology organization.

• Hands-on experience red teaming LLM applications, RAG systems, AI agents, or AI-enabled products.

• Experience developing security automation, internal testing tools, or reusable security guardrails.

• Contributions to security research, open-source projects, bug bounty programs, or responsible vulnerability disclosure.

• Relevant certifications such as OSCP, OSWE, GWAPT, GIAC, CISSP, or an AI Security credential.