{"id":14151,"url":"https://alion.io/job/brain-co-ai-application-security-engineer","title":"AI Application Security Engineer","company":{"id":2051367,"name":"Brain Co.","domain":"brain.co","url":"https://alion.io/company/brain-7","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":81,"open_postings":35,"ghost_share":0.229,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":139,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":135000,"max_usd":260000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1306},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":true},{"name":"CI/CD","optional":true},{"name":"Databricks","optional":true},{"name":"FedRAMP","optional":true},{"name":"Go","optional":true},{"name":"HIPAA","optional":true},{"name":"ISO 27001","optional":true},{"name":"LLM Guardrails","optional":true},{"name":"OWASP Top 10","optional":true},{"name":"Python","optional":true},{"name":"SOC 2","optional":true},{"name":"Threat Modeling","optional":true},{"name":"TypeScript","optional":true}],"status":"live","first_seen_at":"2026-05-07T04:02:17Z","employer_posted_date":"2026-05-07","last_verified_at":"2026-10-23T23:47:26Z","board_verified":true,"closed_at":null,"days_open":169,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":169},"description":"Our Mission\nRebuild how the world works, to make institutions work better for the people they serve.\nAbout Brain Co.\nBrain Co. builds AI-native operating systems for large, regulated institutions. Each system is built for a specific industry, powered by agents that push real workflows forward. Underneath it all is Atlas, our proprietary platform that keeps customers in control, secure by design, and never locked into one model.\nWhy Now\nBrain Co. is entering its next phase of production deployments on a national scale with an elite team built from Palantir, Google, Meta, and Nvidia, and a growing footprint across government, insurance, health, and financial services.\nJoining now means shaping both the company and a new category of applied AI. Every project here ships to production and is expected to create measurable customer value and impact.\nYou'll work alongside exceptional peers on some of the hardest problems in applied AI. It’s the kind of work you'll still be proud of in ten years from now.\nAbout the Role\nAs our Security Engineer, Application & AI, you will own the security of our products and application layer - secure development practices, agent security, third-party integration security, and data protection for AI products operating in some of the world's most regulated and sensitive environments.\nThis is a hands-on builder role. You will write code, ship security tooling, and work directly with product and ML engineers to build security in from the start rather than bolt it on after. You are expected to work AI-natively: using AI to write threat models, automate security review, scale code analysis, and build internal tooling. This is not a nice-to-have - it is how the role is designed to operate and how one person can have outsized impact across a fast-moving engineering organization.\nBrain Co.'s products are built on agentic infrastructure - AI that takes actions, calls tools, and operates inside complex institutional workflows. The degree varies by product, but the underlying security surface is consistent: how agents are authorized, what they can touch, and how that is controlled at the application layer. This role is specifically designed to address that surface, working alongside the Infrastructure Security Engineer who owns the platform layer underneath.\nWhat You'll Work On\nApplication Security\nOwn secure development practices across our products: AuthN/AuthZ patterns, secrets management, input handling, and secure-by-default standards that engineers can follow without security becoming a bottleneck.\n\nIntegrate security into the development lifecycle - code review, CI/CD pipelines, and pre-deployment checks - catching risk before it reaches production.\n\nConduct threat modeling across product features and release cycles, translating risk into concrete controls that ship alongside each product.\n\nBuild and maintain security tooling and automated checks that scale your reach across the codebase - using AI to move faster and cover more ground than manual review alone could.\n\nAgent & Integration Security\nOwn the application-layer security model for Brain Co.'s agentic products - how agents are scoped, what they are authorized to do on behalf of users, and where trust boundaries sit between the agent and the external systems it touches.\n\nDefine secure patterns for how agents integrate with third-party systems and APIs: how credentials are stored and scoped, how responses are validated before being acted on, and how each product limits what agents can do with what they get back.\n\nWork directly with product and ML engineers during feature development to define secure agent design patterns: tool scoping, permission boundaries, output validation, and safe handling of user context across multi-step workflows.\n\nBuild reusable secure-by-default patterns for agent development - design guidelines, review checklists, and code-level guardrails - so that security standards scale as new agent capabilities are built.\n\nProduce security artifacts for agent features and product deployments: threat models, architecture reviews, and documentation that supports delivery into regulated customer environments.\n\nData Protection\nDefine and enforce data protection standards at the application layer - ensuring sensitive customer data (PHI, PII, government records) is handled correctly as it flows through AI pipelines and surfaces in agent outputs.\n\nBuild safeguards against unauthorized data exposure across our products: access controls, output filtering, and audit logging that make data handling attributable and reviewable.\n\nDesign secure data handling patterns for AI features operating on regulated data, working with platform and ML teams to ensure the application layer upholds its share of the data protection contract.\n\nYou Might Be a Great Fit If You...\nHave 5+ years of experience in application security or product security, with hands-on experience on production systems at scale.\n\nAre a builder first - you write code and ship security tooling, and see embedding security into the engineering workflow as the job, not a side effect of it.\n\nHave deep fluency in application security fundamentals: OWASP Top 10, AuthN/AuthZ, secure SDLC, secrets management, secure integration patterns, and cryptography basics.\n\nUnderstand the security surface of agentic AI across the product layer - how agents should be designed, scoped, and reviewed for risk - and can work shoulder-to-shoulder with engineers to build those standards in.\n\nHave experience protecting sensitive data at the application layer: access controls, audit logging, and preventing data exposure through third-party integrations and AI-generated outputs.\n\nWork AI-natively - you already use AI to write better code, move faster, and do more with less, and you bring that same instinct to security work.\n\nThink in attack surfaces and trust boundaries and can move cleanly from threat model to concrete shipped control.\n\nAre comfortable working alongside delivery teams shipping into regulated industries, understanding their constraints and translating them into product-level security requirements.\n\nThrive in high-agency environments and want to own and grow the application security function as the company scales.\n\nBonus Points For\nExperience with agent security, LLM application security, or building authorization and guardrail systems for agentic pipelines.\n\nFamiliarity with compliance frameworks relevant to government and healthcare: FedRAMP, HIPAA, SOC 2, ISO 27001.\n\nProficiency in Python, Go, or TypeScript for security tooling and automation.\n\nExperience with SAST/DAST tooling or integrating automated security checks into developer workflows at scale.\n\nWhy Join Us\nDefine what application and AI security looks like at a company building frontier AI for governments, hospitals, and critical industries - from the ground up.\n\nWork directly alongside product and ML teams shipping agentic AI into some of the world's most demanding institutional environments.\n\nBuild the security function AI-natively - using the same technology you're helping secure to scale your own work and impact.\n\nWork alongside senior engineers from Tesla, DeepMind, Databricks, and other top engineering organizations.\n\nShip fast, learn constantly, and see your work protect production systems used by millions of people.\n\nEarn competitive compensation and meaningful equity in a high-growth company.\n\nBenefits\nCompetitive salary plus equity\n\nDaily lunches\n\nCommuter benefits\n\n401(k)\n\nMedical, Dental, and Vision\n\nUnlimited PTO","description_format":"text","description_chars":7555,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Unlimited PTO"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Artificial Intelligence","Operating Systems","Health Insurance & Benefits"],"lifecycle":[{"event":"open","at":"2026-05-07T04:02:17Z"}],"visa":[],"liveness":{"score":30,"band":"fade","label":"Fading","p_open":1,"p_active":0.678,"p_room":0.44,"age_days":169,"expected_fill_days":139,"reasons":["conf:0","velocity","win:tail","crowd:"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/brain-co-ai-application-security-engineer","json_url":"https://alion.io/job/brain-co-ai-application-security-engineer.json","meta":{"generated_at":"2026-10-24T02:17:30Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3721,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-25T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2051367},"rest":"https://alion.io/mcp/rest/get_company?id=2051367"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbrain-co-ai-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbrain-co-ai-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbrain-co-ai-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/brain-co-ai-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbrain-co-ai-application-security-engineer"}]}