Senior Application Security Engineer - GenAI Security Evaluation
New
G
Gramian ConsultancyAI security
Workable locations: Bangladesh. Brazil. Colombia. Egypt. Ghana. IndiaContractSenior
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Experience
- 5+ years of professional experience in application security, product security, or security-focused software engineering.
- Required Skills
- PythonTypeScript
Requirements
- Have 5+ years of professional experience in application security, product security, or security-focused software engineering.
- Have strong experience conducting secure code reviews and identifying application-level vulnerabilities.
- Have practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST).
- Have hands-on experience with security analysis tools such as CodeQL or Semgrep.
- Have hands-on experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.
- Be familiar with frameworks and technologies such as LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).
- Have a strong understanding of authorization models, including actors, identities, trust boundaries, multi-tenant access control, OAuth, IAM, permitted data access and actions, purpose and recipient restrictions, and document-level access control.
- Have production-level coding experience in Python and/or TypeScript.
- Be able to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.
- Have strong analytical skills and be able to communicate technical security findings clearly.
Responsibilities
- Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
- Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
- Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
- Evaluate static application security testing (SAST) tools for detecting genuine vulnerabilities while avoiding false positives.
- Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
- Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
- Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
- Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
- Recommend appropriate security controls and remediation approaches.
- Participate in technical calibration, peer reviews, and quality assurance activities.
View Full Description & ApplyYou'll be redirected to the employer's site
