Senior Application Security Engineer – GenAI Security Evaluation

Posted 58mins ago

Employment Information

Industry

Education

Salary

Experience

Job Type

Location

Report this job

Job expired or something wrong with this job?

Job Description

Application security engineer evaluating SAST detection of LLM-agent and RAG vulnerabilities. Building vulnerable, fixed, and negative repositories for Gramian’s AI security evaluation project.

Responsibilities:

Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
Evaluate SAST tools and assess their ability to detect genuine vulnerabilities while avoiding false positives.
Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
Recommend appropriate security controls and remediation approaches.
Participate in technical calibration, peer reviews, and quality assurance activities.

Requirements:

5+ years of professional experience in application security, product security, or security-focused software engineering.
Strong experience conducting secure code reviews and identifying application-level vulnerabilities.
Practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST).
Hands-on experience with security analysis tools such as CodeQL or Semgrep.
Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.
Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).
Strong understanding of authorization models, actors, identities, trust boundaries, multi-tenant authorization, access control, OAuth, IAM, identity management, permitted data access and actions, purpose and recipient restrictions, and document-level access control.
Production-level coding experience in Python and/or TypeScript.
Ability to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.
Strong analytical skills and ability to communicate technical security findings clearly.

Senior Application Security Engineer – GenAI Security Evaluation

Employment Information

Report this job

Job Description

Responsibilities:

Requirements:

Gramian Consulting

Report this job

Similar Jobs

Gramian Consulting

phia, LLC

STCU

ETAP - Operation Technology, Inc.

OutSystems

Torc Robotics

Knauf

Avnet

Sandvik

Sandvik Group

Seco Tools

A.C.Coy Company

ABB

Centene Corporation

NVIDIA

Bragi

Newfold Digital

Malwarebytes

ANDRITZ

Amprius Technologies, Inc.