Senior Application Security Engineer - GenAI Security Evaluation
Core
Build runnable repositories with realistic Sensitive Information Disclosure and Excessive Agency vulnerabilities in Generative AI applications to evaluate static analysis tools.
Role type
Senior IC application security engineer (GenAI security evaluation)
Builds
Runnable agent and RAG repositories containing vulnerable, fixed, and near-miss code variants
Domain
Generative AI security, Application Security Testing (AST), Static Application Security Testing (SAST)
Deliverable
production ML models
Required skills
SAST tool evaluation, source-to-sink analysis, LLM agent development, RAG system implementation, authorization context definition, deterministic test development, Python, TypeScript, CodeQL, Semgrep
Preferred skills
MCP familiarity, LangChain, LlamaIndex, OAuth, IAM, multi-tenant authorization models
Technologies
Python, TypeScript, CodeQL, Semgrep, LangChain, LlamaIndex, OpenAI SDK, Anthropic SDK, MCP
Responsibilities
Build runnable agent and RAG repositories with Sensitive Information Disclosure and Excessive Agency vulnerabilities; Develop realistic security scenarios involving tool calling and agent memory; Create vulnerable, fixed, and hard-negative code variants; Evaluate SAST tools for vulnerability detection accuracy; Perform source-to-sink analysis and trace data flows; Annotate security findings with root causes and severity; Define authorization contexts covering actors and trust boundaries; Develop deterministic tests to validate security behaviors; Recommend security controls and remediation approaches.
Seniority
Senior, hands-on IC
