Application Security Engineer

Responsibilities

• Conduct security and privacy design reviews for applications, APIs, cloud services, engineering proposals, and AI integrations.
• Review system architecture and data flows, including access controls, trust boundaries, authentication, authorization, and other security safeguards.
• Perform threat modeling for critical services and AI agents, mapping attack surfaces, scenarios, attack paths, mitigations, and residual risks.
• Deliver hands-on security and adversarial testing for AI/LLM agents, including:
  • Prompt injection
  • Tool misuse
  • Excessive agency
  • Unauthorized data access
  • Permission and access-control issues
  • External integrations
  • Sensitive-data exposure
• Identify, validate, and document security vulnerabilities, then provide practical remediation recommendations.
• Collaborate with engineering, security, privacy, and third-party teams to drive remediation and validate security controls.
• Develop reusable security assessment assets including methodologies, checklists, threat models, test cases, and reporting templates.
• Support security automation and AI-assisted security workflows where appropriate.

Requirements

• 8+ years of professional experience in security engineering, application security, product security, offensive security, systems architecture, or a related technical security field.
• Experience reviewing complex technical designs and identifying security risks in:
  • Applications
  • APIs
  • Cloud services
  • Microservices
  • Distributed systems
• Strong understanding of threat modeling, vulnerability assessment, and risk modeling.
• Strong understanding of authentication and authorization, least-privilege principles, and data protection.
• Strong understanding of security architecture.
• Hands-on experience with security testing, vulnerability investigation, penetration testing, adversarial testing, or security-control validation.
• Strong technical communication skills, with the ability to explain security findings to engineering and business stakeholders.

Technologies

• Python
• Go
• Bash

Preferred Qualifications

• Experience assessing AI/LLM applications and autonomous AI agents.
• Knowledge of prompt injection, jailbreaks, unsafe tool use, excessive agency, and AI data-security risks.
• Experience with privacy and security design reviews.
• Experience securing cloud environments.
• Security automation experience using Python, Go, Bash (or similar languages).
• Familiarity with application-security frameworks and industry security practices.

Key Skills

• Application Security
• AI/LLM Security
• Threat Modeling
• Penetration Testing
• Adversarial Testing
• Cloud Security
• API Security
• Security Architecture
• Vulnerability Assessment
• Privacy & Data Protection
• Python/Go/Bash
• Security Automation

Onsite (in person) work location: Seattle, Washington and Sunnyvale, California.