{"id":4090081,"url":"https://alion.io/job/reveal-application-security-engineer-ai-governance-cloud-security","title":"Application Security Engineer (AI Governance & Cloud Security)","company":{"id":2046491,"name":"Reveal","domain":"revealdata.com","url":"https://alion.io/company/revealdata","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Jobvite","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Chicago, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":136000,"max":null,"currency":"USD","period":"year","gross":null,"usd_annual":136000},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitLab CI","optional":false},{"name":"JavaScript","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Wiz","optional":false},{"name":"EU AI Act","optional":true},{"name":"FedRAMP","optional":true},{"name":"ISO 27001","optional":true},{"name":"Jira","optional":true},{"name":"LLM Guardrails","optional":true},{"name":"Ruby","optional":true},{"name":"SIEM","optional":true},{"name":"Slack","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-11-11T19:59:12Z","employer_posted_date":"2026-11-11","last_verified_at":"2026-11-11T19:59:12Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Description\nJob Description\nPosition:Application Security Engineer (AI Governance & Cloud Security)\nLocation: Chicago/U.S.\nReports To: Director, IT, Info Security and Compliance\nJob Overview\nReveal is hiring an Application Security Engineer to secure how we build software and how we adopt AI. This role sits at the point where three things meet: the security of the code and services we ship, the governance of the AI agents and models we put into production, and the posture of the cloud they all run on.\nYou will own the tooling that makes that possible - Onyx Security as the control plane for AI agents and models, and Wiz across our cloud accounts and repositories - and you will be the person engineering teams come to when a design, a pipeline or a new AI tool needs a security opinion. The work is hands-on: threat modeling, code review, remediation alongside the teams that own the fix, and the policy and reporting that lets leadership and auditors see where we stand.\nThis role follows a hybrid model (4 days in office, 1 day work from home) for candidates residing in Illinois. Candidates based outside of Illinois may be considered for a remote work arrangement.\nResponsibilities & Duties\nApplication security: Run threat modeling and secure design reviews for new features, services and integrations.\nApplication security: Perform manual code review and triage findings from SAST, DAST, SCA and secrets scanning.\nApplication security: Embed security checks into CI/CD pipelines without slowing delivery.\nApplication security: Lead remediation with engineering teams and track findings to closure against SLAs.\nApplication security: Support penetration tests, bug reports and customer security questionnaires.\nAI governance: Own the Onyx Security platform as the control plane for AI agents and models across SaaS, cloud, endpoints and code.\nAI governance: Use Onyx AI Observability to discover sanctioned and shadow AI, and review prompts, responses and agent actions.\nAI governance: Write and enforce natural-language governance policies and real-time guardrails in Onyx.\nAI governance: Manage agent permissions and secure MCP server connections to prevent over-privileged access.\nAI governance: Detect and respond to prompt injection, data exfiltration and AI misuse, and tune Onyx Guardian Agent remediation.\nAI governance: Maintain the AI acceptable-use policy, AI inventory and risk assessments with GRC, mapped to NIST AI RMF and ISO/IEC 42001.\nAI governance: Evaluate new AI tools, agents and vendors before adoption, and report AI adoption and risk metrics to leadership.\nCloud and code security: Own Wiz configuration, integrations, policies and alert routing across cloud accounts.\nCloud and code security: Triage Wiz Issues and toxic combinations, and drive fixes for misconfigurations, vulnerabilities and exposed secrets.\nCloud and code security: Use Wiz Code and IaCscanning to catch risk in repositories and Terraformbefore deployment.\nCloud and code security: Use Wiz AI Security Posture Management (AI-SPM) to inventory AI services and models running in the cloud.\nCloud and code security: Build reports and dashboards on cloud risk trends for Security leadership and audits.\nPerform other duties and responsibilities as assigned to support team, department, and organizational goals.\nCharacteristics\nBreadth across domains: comfortable moving between application security, AI governance and cloud posture rather than specialisingin only one.\nInvestigative mindset: naturally curious, andinclined to dig into an alert or a finding until the underlying cause is understood.\nProactive problem solver:anticipates security issues at design time rather than discovering them at deployment.\nAutonomous and collaborative:takes ownership of the role and works effectively with distributed engineering teams.\nClear communicator: can explain the same risk to an engineer, to leadership and to an auditor, and be understood by all three.\nEducation & Experience\n4+ years in application security, product security or security engineering.\nSolid grasp of OWASP Top 10, OWASP Top 10 for LLM Applications and agentic AI risks, including Model Context Protocol (MCP) security.\nAbility to read and review code in at least one of Python, JavaScript/TypeScript, Java or C#.\nExperience securing AWS, Azure or GCP workloads, containers and Kubernetes.\nFamiliarity with CI/CD tooling (GitHub Actions, GitLab CI or Azure DevOps) and infrastructure as code.\nClear written communication for engineers, leadership and auditors.\nPreferred Experience\nExperience building an AI governance program: AI inventory, model risk reviews, acceptable-use policy.\nHands-on experience with Wiz, including policy tuning, Issue triage and integrations (Jira, Slack, SIEM).\nHands-on experience with Onyx Security or a comparable AI security and governance platform, including AI discovery, guardrails and agent permissions.\nKnowledge of NIST AI RMF, ISO/IEC 42001 and the EU AI Act.\nExperience supporting SOC 2, ISO 27001 or FedRAMP audits.\nBackground in legal tech, eDiscovery or other environments handling sensitive client data.\nScripting for automation (Python, Bash, Ruby) and experience with the Wiz API.\nCertifications such as OSWE, GWAPT, CSSLP, CCSP or AWS Security Specialty, or the Wiz certifications.\nBenefits and Perks include but are not limited to:\n401k match program\nComprehensive health benefits (Medical, Dental, Vision, and HSA/FSA)\nGroup Term Life Insurance and Voluntary Life Insurance option\nPaid holidays\nPaid vacation, sick, and personal days\nFSA dependent care benefit\nChildbirth recovery and bonding leave policies\nShort and long-term disability benefits\nAccess to onsite gym and recreational area at our Chicago office\nFriendly, collaborative, in-office work environment with ample opportunity for professional development.\nFor Illinois-based roles, the budgeted annual salary range is $136,000to $160,000. Compensation for this role will depend on a number offactors, including a candidate's qualifications, skills, competencies, and experience, and may fall outside of the range shown. Reveal offers a competitive total rewards package, which includes the Benefits and Perks set forth above.\nThis job description reflects the present requirements of the position. As duties and responsibilities change and develop, the job description will be reviewed and subject to amendment.\nHiring Policy\nReveal is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Reveal does not discriminate in employment on the basis of race, color, religion, sex (including pregnancy and gender identity), national origin, political affiliation, sexual orientation, marital status, disability, genetic information, age, membership in an employee organization, retaliation, parental status, military service, or other non-merit factor.\nReveal considers candidates with existing visas but does not sponsor new visa applications.","description_format":"text","description_chars":6997,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Life insurance","Professional development"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Artificial Intelligence","Cloud Security","Application Security","Legal Services"],"lifecycle":[{"event":"open","at":"2026-11-11T19:59:12Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 7 · green card filings: 1","filings_12m":7,"filings_prev_12m":7,"green_card_filings_12m":1,"median_offered_wage_usd":156875,"route":null,"cap_exempt":false,"checked_at":"2026-11-11T07:38:50+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":20,"reasons":["conf:3","win:early"],"computed_at":"2026-11-11T23:54:01Z"},"pay":{"stated_usd_annual":136000,"is_top_pay":true},"html_url":"https://alion.io/job/reveal-application-security-engineer-ai-governance-cloud-security","json_url":"https://alion.io/job/reveal-application-security-engineer-ai-governance-cloud-security.json","meta":{"generated_at":"2026-11-11T23:54:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":47580,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2046491},"rest":"https://alion.io/mcp/rest/get_company?id=2046491"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Freveal-application-security-engineer-ai-governance-cloud-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Freveal-application-security-engineer-ai-governance-cloud-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Freveal-application-security-engineer-ai-governance-cloud-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/reveal-application-security-engineer-ai-governance-cloud-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Freveal-application-security-engineer-ai-governance-cloud-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4090081}},{"tool":"search_jobs","arguments":{"company":"revealdata.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4090081},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}