Application Security Engineer

Tempus is seeking an Application Security Engineer in Chicago, IL to help secure the software development lifecycle end-to-end. The role partners with product and engineering teams to assess applications and cloud-hosted services, strengthen SDLC controls, and address security risks in AI and LLM-enabled systems.

Key Responsibilities

• Embed security into the SDLC through threat modeling, design reviews, security requirements, and security-focused code reviews with product and development teams.
• Plan and conduct application security assessments and penetration tests for web applications, APIs, and cloud-hosted services, then document findings with clear risk ratings and practical remediation guidance.
• Threat model and assess AI and LLM-enabled features, including agents, RAG pipelines, and tool or MCP integrations, using adversarial prompt testing and validating guardrails, permissions, and data access controls.
• Select, integrate, and tune SAST, DAST, software composition analysis, and secrets scanning in CI/CD pipelines.
• Build automation and secure-by-default patterns, including guardrails that prevent whole classes of vulnerabilities.
• Use AI-assisted tooling to scale code review, triage, and remediation while applying human judgment to validate results.
• Reproduce, triage, and prioritize application security vulnerabilities, and work with developers through remediation.
• Communicate the nature, severity, and business risk of security issues to development teams and leadership.
• Design, implement, and document application security controls, standards, and secure coding guidance.
• Run and support the vulnerability disclosure program.
• Coach developers on secure design and coding through consulting, training, and day-to-day collaboration.

Required Qualifications

• 3 to 5 years of experience in application security, penetration testing, or software engineering with a security focus.
• Hands-on experience testing web applications, APIs, and cloud-hosted services using proxying and penetration testing tools such as Burp Suite, with strong knowledge of common security flaws and mitigations (including OWASP Top 10).
• Experience performing security design reviews at the architecture level.
• Working experience securing AI and LLM-enabled applications, including how they are designed and how they fail (prompt injection, data leakage, excessive agency, insecure output handling), informed by OWASP Top 10 for LLM Applications.
• Practical experience using at least one threat modeling method, such as STRIDE, PASTA, or attack trees.
• Experience with SAST, DAST, and SCA tools, including integrating them into CI/CD pipelines.
• Proficiency in Python, Go, or JavaScript for security tooling and automation, with the ability to read and review code.
• Solid understanding of network and web protocols (TCP/IP, HTTP/S), authentication and authorization (such as OAuth/OIDC), and cryptography fundamentals.
• Ability to collaborate effectively with software development teams and Product Managers.
• Excellent written and verbal communication skills, including clear explanation of complex topics.

Technologies

• Burp Suite, OWASP Top 10
• Python, Go, JavaScript
• TCP/IP, HTTP/S
• OAuth/OIDC
• SAST, DAST, SCA, software composition analysis, secrets scanning
• CI/CD
• STRIDE, PASTA
• OWASP Top 10 for LLM Applications
• MCP, RAG pipelines

Bonus Qualifications

• Hands-on AI red teaming or security testing of agentic or RAG systems, familiarity with MITRE ATLAS or the NIST AI Risk Management Framework.
• Experience with Docker, Kubernetes, GCP, or AWS, and infrastructure-as-code scanning.
• Bug bounty or vulnerability disclosure program experience.
• Experience with HIPAA and healthcare data protection.
• Interest in working in biotech, genomics, and precision medicine.
• Certifications such as GWAPT, OSCP, CSSLP, CISSP, or ISC2 CC (Certified in Cybersecurity).

Location and Compensation

• Location: Chicago, IL (onsite)
• Salary: USD 85,000 to 130,000 per year
• Experience: Minimum 3 years