{"id":3290317,"url":"https://alion.io/job/highlevel-lead-security-engineer-penetration-testing-ai-security","title":"Lead Security Engineer - Penetration Testing & AI Security","company":{"id":3882884,"name":"HighLevel","domain":"highlevel.co","url":"https://alion.io/company/highlevel-3","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_company_offices","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":107000,"max_usd":242000,"period":"year","method":"global_role_seniority_cell","sample_n":753},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"Fine-tuning","optional":false},{"name":"Function Calling","optional":false},{"name":"Go","optional":false},{"name":"JavaScript","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"LLM Guardrails","optional":false},{"name":"Machine Learning","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"OWASP","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Red Teaming","optional":true}],"status":"live","first_seen_at":"2026-09-13T20:05:00Z","employer_posted_date":null,"last_verified_at":"2026-09-13T20:05:00Z","board_verified":false,"closed_at":null,"days_open":46,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":46},"description":"About Us\n\nHighLevel is an AI powered, all-in-one white-label sales & marketing platform that empowers agencies, entrepreneurs, and businesses to elevate their digital presence and drive growth. We are proud to support a global and growing community of over 1 million businesses, comprised of agencies, consultants, and businesses of all sizes and industries. HighLevel empowers users with all the tools needed to capture, nurture, and close new leads into repeat customers. As of mid 2025, HighLevel processes over 4 billion API hits and handles more than 2.5 billion message events every day. Our platform manages over 470 terabytes of data distributed across five databases, operates with a network of over 250 microservices, and supports over 1 million hostnames.\nOur People\nWith over 1,500 team members across 15+ countries, we operate in a global, remote-first environment. We are building more than software; we are building a global community rooted in creativity, collaboration, and impact. We take pride in cultivating a culture where innovation thrives, ideas are celebrated, and people come first, no matter where they call home.\nOur Impact\nAs of mid 2025, our platform powers over 1.5 billion messages, helps generate over 200 million leads, and facilitates over 20 million conversations for the more than 1 million businesses we serve each month. Behind those numbers are real people growing their companies, connecting with customers, and making their mark - and we get to help make that happen.\nLearn more about us on our YouTube Channel or Blog Posts\n\nAbout the Role\nWe are looking for a Lead Security Engineer – Application Security & AI Security with 8+ years of cybersecurity experience and strong expertise in securing modern applications, APIs, cloud-native services, and AI-enabled systems.\n\nApplication Security and AI Security will be the primary focus of this role. You will lead security reviews, threat modeling, application assessments, secure SDLC improvements, and vulnerability management across HighLevel’s products.\n\nYou will also serve as an AI Security specialist, assessing and adversarially testing LLM applications, AI agents, RAG implementations, and AI integrations. This is a hands-on, Lead-level individual-contributor role working closely with Engineering, Product, Infrastructure, and AI/ML teams.\n\nWhat You’ll Be Doing\n\nApplication Security, Secure SDLC & DevSecOps\n\nLead Application Security initiatives across web, mobile, API, microservices, and cloud-native products.\n\nConduct architecture reviews, threat modeling, secure design and code reviews, and hands-on security assessments.\n\nIdentify weaknesses in authentication, authorization, tenant isolation, business logic, data protection, and API security.\n\nDefine practical security standards, requirements, guardrails, and reusable secure engineering patterns.\n\nImprove security testing across CI/CD pipelines using SAST, DAST, SCA, secret scanning, container scanning, and Infrastructure as Code scanning.\n\nDrive risk-based vulnerability triage and remediation in partnership with engineering teams.\n\nDevelop security automation and promote secure coding through developer guidance, documentation, and training.\n\nAI Security Assessment & Adversarial Testing\n\nLead security reviews of LLM applications, AI agents, RAG architectures, machine learning services, and third-party AI integrations.\n\nAssess AI architectures, including model APIs, data pipelines, vector stores, prompts, fine-tuning workflows, plugins, and agent tool chains.\n\nConduct adversarial testing for prompt injection, jailbreaking, sensitive-data disclosure, system-prompt leakage, output manipulation, insecure tool use, excessive agency, and model abuse.\n\nEvaluate applicable risks involving data poisoning, model inversion, training-data extraction, adversarial evasion, and model exfiltration.\n\nTest security controls such as guardrails, input/output filtering, access controls, human approvals, logging, monitoring, and abuse detection.\n\nDevelop repeatable AI security testing methodologies, playbooks, automation, and test cases using tools such as Garak, PyRIT, or similar frameworks.\n\nAssess security and supply-chain risks associated with third-party models, AI platforms, and AI-enabled SaaS products.\n\nReporting, Collaboration & Leadership\n\nProduce clear security reports containing evidence, risk ratings, business impact, and actionable remediation guidance.\n\nCommunicate security risks effectively to developers, architects, product leaders, and executive stakeholders.\n\nPartner with external consultants, researchers, and bug bounty programs for specialized assessments where required.\n\nMentor engineers and help establish a security-conscious engineering culture.\n\nStay current with developments in Application Security, AI Security, and adversarial testing.\n\nWhat You’ll Bring\n\n8+ years of cybersecurity experience, with deep hands-on expertise in Application Security, product security, penetration testing, or security engineering.\n\nExperience conducting threat modeling, architecture reviews, secure code reviews, penetration testing, and vulnerability validation.\n\n1-3 years of AI Security experience, with AI/ML security, adversarial testing of AI systems, or applied AI research with a security focus.\n\nStrong knowledge of web, mobile, API, and cloud-native security, including OWASP guidance and business-logic risks.\n\nStrong understanding of authentication and authorization technologies, including OAuth 2.0, OIDC, JWT, SAML, and modern access-control models.\n\nHands-on DevSecOps experience with CI/CD security automation, SAST, DAST, SCA, secret scanning, containers, and Infrastructure as Code.\n\nPractical knowledge of Docker, Kubernetes, microservices, and cloud security.\n\nDemonstrated experience assessing or securing LLM applications, RAG systems, AI agents, machine learning models, or AI-enabled products.\n\nUnderstanding of AI threats such as prompt injection, jailbreaking, data leakage, insecure tool use, excessive agency, model misuse, and AI supply-chain risks.\n\nFamiliarity with OWASP guidance for LLM applications, MITRE ATLAS, NIST AI RMF, and related AI security practices.\n\nProgramming or scripting proficiency in Python, Go, JavaScript, Bash, or a similar language.\n\nStrong written and verbal communication skills, with the ability to influence technical and non-technical stakeholders.\n\nPreferred Qualifications\n\nExperience building or scaling Application Security practices within a SaaS or product-led technology organization.\n\nHands-on experience red teaming LLM applications, RAG systems, AI agents, or AI-enabled products.\n\nExperience developing security automation, internal testing tools, or reusable security guardrails.\n\nContributions to security research, open-source projects, bug bounty programs, or responsible vulnerability disclosure.\n\nRelevant certifications such as OSCP, OSWE, GWAPT, GIAC, CISSP, or an AI Security credential.\n\nEqual Employment Opportunity Information\nThe company is an Equal Opportunity Employer. As an employer subject to affirmative action regulations, we invite you to voluntarily provide the following demographic information. This information is used solely for compliance with government record keeping, reporting, and other legal requirements. Providing this information is voluntary and refusal to do so will not affect your application status. This data will be kept separate from your application and will not be used in the hiring decision.\n\nOriginally posted on Himalayas","description_format":"text","description_chars":7535,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Information Security","Application Security","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-10-26T19:11:04Z"}],"visa":[],"liveness":{"score":11,"band":"cold","label":"Long shot","p_open":0.4,"p_active":0.783,"p_room":0.36,"age_days":45,"expected_fill_days":30,"reasons":["seen:45","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/highlevel-lead-security-engineer-penetration-testing-ai-security","json_url":"https://alion.io/job/highlevel-lead-security-engineer-penetration-testing-ai-security.json","meta":{"generated_at":"2026-10-30T05:32:54Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7717,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3882884},"rest":"https://alion.io/mcp/rest/get_company?id=3882884"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhighlevel-lead-security-engineer-penetration-testing-ai-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhighlevel-lead-security-engineer-penetration-testing-ai-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhighlevel-lead-security-engineer-penetration-testing-ai-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/highlevel-lead-security-engineer-penetration-testing-ai-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhighlevel-lead-security-engineer-penetration-testing-ai-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3290317}},{"tool":"search_jobs","arguments":{"company":"highlevel.co","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3290317},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}