Senior Engineer - AI Security Engineering

Job description:

We are looking for a hands-on AI Security Engineer to assess and strengthen the security of AI-powered applications, autonomous agents, LLM integrations, and Model Context Protocol (MCP) implementations.

The role requires strong application security fundamentals, practical AI security testing experience, and the ability to build and maintain automated security testing workflows. The engineer will work closely with development teams to identify vulnerabilities, implement security controls, and ensure AI systems are secure by design.

Key Responsibilities:

• Conduct security assessments of LLM applications, AI agents, multi-agent workflows, RAG systems, and MCP implementations.
• Identify and validate AI-specific vulnerabilities, including prompt injection, tool misuse, data exfiltration, excessive agency, insecure output handling, and sensitive information disclosure.
• Perform adversarial testing and AI red teaming to identify weaknesses in AI applications and autonomous workflows.
• Assess MCP clients, servers, and tools for authentication, authorization, tool integrity, token security, and access control weaknesses.
• Evaluate security boundaries across agents, tools, external connectors, memory, and multi-tenant environments.
• Design and validate security guardrails, including least-privilege access, human approval controls, policy enforcement, and execution limits.
• Perform application security assessments covering web applications, APIs, microservices, cloud services, and containerized workloads.
• Design, develop, implement, and maintain SAST and DAST automation integrated with CI/CD pipelines.
• Automate security scans, vulnerability triage, false-positive handling, reporting, and remediation tracking.
• Integrate SAST, DAST, software composition analysis, secrets scanning, and API security testing into development workflows.
• Conduct threat modeling, secure architecture reviews, and security assessments during the software development lifecycle.
• Validate security findings, recommend practical fixes, and work with engineering teams on remediation.
• Apply OWASP Top 10 for LLM Applications, OWASP MCP Top 10, and relevant security guidance during assessments.
• Develop reusable AI security test cases, assessment playbooks, and automated regression testing.
• Evaluate security risks involving AI models, orchestration frameworks, vector databases, model APIs, and third-party integrations.
• Review AI execution logs, audit trails, and security monitoring controls to support incident investigation.
• Track vulnerabilities, remediation progress, and security metrics, and communicate risks to stakeholders.
• Stay updated with emerging AI threats, vulnerabilities, and security best practices.

Required Qualifications:

• 5+ years of experience in Application Security, Product Security, Penetration Testing, or Security Engineering.
• B.E./B.Tech in Computer Science, Information Technology, or an equivalent qualification.
• Strong hands-on experience in web application security, API security, authentication, authorization, and secure software development.
• Practical understanding of LLMs, AI agents, RAG, MCP, model APIs, and AI application architectures.
• Working knowledge of OWASP Top 10 for LLM Applications and OWASP MCP Top 10, with the ability to apply their guidance in assessments.
• Experience performing security testing of AI applications, including prompt injection, data leakage, and unauthorized tool execution.
• Proven experience building and maintaining SAST/DAST automation. This is mandatory.
• Experience integrating security testing into CI/CD pipelines and development workflows.
• Proficiency in Python or another scripting language for security automation and testing.
• Experience conducting threat modeling, security design reviews, vulnerability assessments, and remediation validation.
• Familiarity with cloud security, container security, IAM, OAuth 2.0, and API security.
• Strong problem-solving, communication, and cross-functional collaboration skills.

Preferred Qualifications:

• Experience securing production AI agents, MCP servers, or multi-agent applications.
• Experience with AI red teaming, adversarial testing, or AI security testing frameworks.
• Familiarity with security tools such as Semgrep, SonarQube, Checkmarx, Burp Suite, OWASP ZAP, Snyk, or equivalent platforms.
• Familiarity with AI security tools such as Promptfoo, Garak, or equivalent frameworks.
• Understanding of delegated authorization, OAuth/OIDC, token scopes, and agent identity management.
• Knowledge of NIST AI RMF, MITRE ATLAS, and AI security governance.
• Experience securing AI applications in financial services, payments, or other regulated environments.

Skills

Application Security, DAST, Penetration Testing, Product Security, Python, SAST, Security Engineering