{"id":3851909,"url":"https://alion.io/job/agoda-staff-ai-security-analyst","title":"Staff AI Security Analyst","company":{"id":200,"name":"Agoda","domain":"agoda.com","url":"https://alion.io/company/agoda","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":75,"open_postings":80,"ghost_share":0.038,"stale_share":0.638,"repost_share":0.1,"time_to_fill_p50_days":61,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Singapore"],"countries":["SG"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":10900,"max":16300,"currency":"SGD","period":"month","gross":null,"usd_annual":153120},"salary_estimate":null,"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"CVSS","optional":false},{"name":"EPSS","optional":false},{"name":"Fine-tuning","optional":false},{"name":"KEV","optional":false},{"name":"LLM","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"SBOM","optional":false}],"status":"live","first_seen_at":"2026-11-06T02:48:17Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-10T10:02:35Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"About Agoda\nAt Agoda, we bridge the world through travel. Our story began in 2005, when two lifelong friends and entrepreneurs, driven by their passion for travel, launched Agoda to make it easier for everyone to explore the world. \nToday, we are part of Booking Holdings [NASDAQ: BKNG], with a diverse team of over 7,000 people from 90 countries, working together in offices around the globe. Every day, we connect people to destinations and experiences, with our great deals across our millions of hotels and holiday properties, flights, and experiences worldwide.\nNo two days are the same at Agoda. Data and technology are at the heart of our culture, fueling our curiosity and innovation. If you’re ready to begin your best journey and help build travel for the world, join us.\nGet to Know Our Team \nThe Security Department oversees security, compliance, GRC, and security operations for all Agoda. We are vigilant in ensuring there is no breach or vulnerability threatening our company or endangering our employees in order to keep Agoda safe and protected. This would be a great challenge for those who want to work with the best technology in a dynamic and advanced environment. \nThe Opportunity \nYou will be joining Agoda's AppSec Analyst team at a pivotal moment: AI is changing both how we defend Agoda and what we need to defend. As Staff AI Security Analyst, your primary focus will be augmenting day-to-day application security work with AI, including vulnerability management and triage, zero-day response, and penetration testing of our applications, AI agents, and AI integrations. \nThis is a builder's role. You will ship and own production-grade AI tooling and automation, not one-off scripts, so a lean team can keep pace with a fast-moving DevSecOps environment where code ships continuously. You will bring a proactive, automation-first mindset, and as a senior member of the team, you will mentor others and raise the team's AI fluency. \nWhat You Will Do \nVulnerability management: Own daily triage of scanner, bug bounty, and pentestfindings, using AI to cut duplicates and false positives. Prioritizebased on exploitability and business impact, and drive fixes to verified closure within SLA. \nZero-day response: Assess exposure to zero-day and newly disclosed vulnerabilities within hours, using AI, dependency inventories, and code search. Coordinate urgent patching or mitigation with engineering teams and track every affected service to closure. \nPenetration testing: Lead manual and AI-assisted pentestsofweb, API, and mobile apps, verifying every AI finding by hand. Test AI agents and integrations for prompt injection, jailbreaks, tool abuse, and data leakage, and review third-party AI components and MCP servers. \nAutomated security testing: Design and suggest adversarial and automated security checks into CI/CD.Track how attackers use AI, such as automated exploit generation and faster vulnerability discovery, and adjust testing priorities to match. \nAI tooling for AppSec: Build and own production AI agents that automate AppSec work, grounded in internal standards and past findings. Red-team them against prompt injection, and measure triage accuracy, time saved, and false-finding rates. \nLeadership and mentorship: Contribute towards the AI AppSec roadmap and define what AI may do on its own, what needs human approval, and what data it can access. Track how attackers use AI, and mentor junior analysts to raise the team's AI fluency. \nWhat You Will Bring \nApplication and offensive security: 6 to 10 years of experience in application security, product security, or offensive security, with strong web and API penetration testing skills and hands on vulnerability management at scale. \nVulnerability triage and prioritization: Proven ability to validateand reproduce bug bounty and external researcher reports, recommend appropriate rewards, and prioritize remediation using CVSS, EPSS, KEV, and business context. \nSupply chain and incident response: Deep understanding of dependency and software supply chain risks, including SCA and SBOM practices, with experience responding to zero day and high-profilevulnerabilities across large engineering organizations. \nAI security and technical leadership: Hands on experience building LLM tools or agents using Python, LLM APIs, RAG, or evaluation methods, and testing AI applications and agents. Demonstrated ability to mentor others and lead technical work across teams. \nIt is Great if You Have \nExperience running or managing a bug bounty program on platforms such as HackerOne. \nExperience fine-tuning or adapting models for security tasks. \nExperience with MCP servers, agent frameworks, and AI red-teaming tools. \nExperience building security automation into CI/CD and developer workflows. \nBackground in software development and cloud-native application security. \nRelevant certifications (e.g., OSCP, OSWE, GWAPT), published CVEs or research, or conference talks. \nSalary and Location \nThis role is based in Singapore. \nMonthly base salary: SGD 10,900-16,300 \nPlease review our Hiring Process Guidelines before your interview - click here to learn how interviewing at Agoda works. \n\nPlease review our Hiring Process Guidelines before your interview - click here to learn how interviewing at Agoda works.\nDiscover more about working at Agoda\nAgoda Careers https://careersatagoda.com\nFacebook https://www.facebook.com/agodacareers/\nLinkedIn https://www.linkedin.com/company/agoda\nYouTube https://www.youtube.com/agodalife\nEqual Opportunity Employer \nAt Agoda, we pride ourselves on being a company represented by people of all different backgrounds and orientations. We prioritize attracting diverse talent and cultivating an inclusive environment that encourages collaboration and innovation. Employment at Agoda is based solely on a person’s merit and qualifications. We are committed to providing equal employment opportunity regardless of sex, age, race, color, national origin, religion, marital status, pregnancy, sexual orientation, gender identity, disability, citizenship, veteran or military status, and other legally protected characteristics.\nWe will keep your application on file so that we can consider you for future vacancies and you can always ask to have your details removed from the file. For more details please read our privacy policy.\nDisclaimer\nWe do not accept any terms or conditions, nor do we recognize any agency’s representation of a candidate, from unsolicited third-party or agency submissions. If we receive unsolicited or speculative CVs, we reserve the right to contact and hire the candidate directly without any obligation to pay a recruitment fee.","description_format":"text","description_chars":6685,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Singapore","iso":"SG","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Travel Agencies","Travel Technology"],"lifecycle":[{"event":"open","at":"2026-11-06T03:52:20Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":4,"expected_fill_days":61,"reasons":["conf:2","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-11-10T06:52:35Z"},"pay":{"stated_usd_annual":153120,"is_top_pay":false},"html_url":"https://alion.io/job/agoda-staff-ai-security-analyst","json_url":"https://alion.io/job/agoda-staff-ai-security-analyst.json","meta":{"generated_at":"2026-11-10T12:55:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30046,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":200},"rest":"https://alion.io/mcp/rest/get_company?id=200"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fagoda-staff-ai-security-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fagoda-staff-ai-security-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fagoda-staff-ai-security-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/agoda-staff-ai-security-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fagoda-staff-ai-security-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3851909}},{"tool":"search_jobs","arguments":{"company":"agoda.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3851909},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}