Application Security Engineer

What you'll do

• Embed security into the SDLC through threat modeling, design reviews, code reviews, and security requirements.
• Conduct application security assessments and penetration tests, document findings, and work with developers through remediation.
• Assess AI and LLM-enabled features and integrate security tools and automated guardrails into CI/CD pipelines.

What they ask for

• Hands-on testing experience with web applications, APIs, and cloud-hosted services, and knowledge of common security flaws and mitigations.
• Experience with architecture-level security design reviews, threat modeling, and SAST, DAST, and SCA tools in CI/CD.
• Working experience securing AI and LLM-enabled applications, including risks such as prompt injection and data leakage.
• Proficiency in Python, Go, or JavaScript; ability to read and review code; understanding of network and web protocols, authentication and authorization, and cryptography fundamentals.

Nice to have

• Hands-on AI red teaming or agentic/RAG security testing; familiarity with MITRE ATLAS or the NIST AI Risk Management Framework.
• Experience with Docker, Kubernetes, GCP or AWS, infrastructure-as-code scanning, vulnerability disclosure programs, or HIPAA.

Pay

USD $85,000-$130,000 base salary (CHI)

Tools

Burp Suite, OWASP Top 10, STRIDE, PASTA, Python, Go, JavaScript, CI/CD

AI focus

Threat model and test AI/LLM-enabled systems, including agents, RAG pipelines, tool and MCP integrations, adversarial prompts, guardrails, permissions, and data access controls; use AI-assisted tools for code review, triage, and remediation.