Application Security Engineer II

Overview:

Who are you Youre a hands-on Application Security Engineer who is energized by the intersection of security and AI. You like to build, not just review you write automation, wire up agents, and turn repetitive security work into self-serve tooling that developers actually use. Youre comfortable across the core of AppSec (threat modeling, secure design and code review, penetration testing, vulnerability remediation) and you bring a builders mindset that multiplies your impact. Youre looking to grow your technical depth while contributing to a security program that treats AI as a first-class engineering capability, not an afterthought. Youre required to be in the office 2 days/week.

In This Role, You Will:

• Build and maintain AI-powered security automation agents, skills, and pipelines that automate threat modeling, vulnerability triage, finding deduplication, and report generation across diverse tech stacks.
• Develop and extend agentic workflows that integrate LLMs into security tooling through APIs and MCP (Model Context Protocol) connectors to systems like Jira, Confluence, and cloud security platforms.
• Integrate and run security tooling across the SDLC embedding SAST, DAST, and SCA into CI/CD pipelines and improving signal quality with AI-assisted triage.
• Perform threat modeling, secure code and design reviews, and targeted penetration testing for new and existing features, including cloud-native, GenAI, and AI/ML systems.
• Apply AI security frameworks in practice OWASP LLM Top 10, OWASP AI Testing Guide, and MITRE ATLAS to assess prompt injection, model abuse, data exposure, and agent-misuse risks.
• Write internal tools and scripts (Python, TypeScript, JavaScript, Bash) to automate security testing and governance, including support for cloud-native apps on AWS.
• Partner with engineering teams to remediate vulnerabilities surfaced through scans, manual testing, or AI-assisted analysis, and clearly communicate risk to technical audiences.

Heres What You Need:

• 3 5 years of hands-on experience in application security or secure software development.
• Solid scripting/programming skills able to automate tasks and build internal tools in Python, JavaScript/TypeScript, or Bash.
• Working experience integrating security tools into CI/CD pipelines and the SDLC.
• Familiarity with at least one major cloud platform (AWS preferred; GCP or Azure acceptable) and cloud-native security principles.
• Proficiency with common security testing and cloud security tools (e.g., Burp Suite, Checkmarx, Mend, Veracode, ZAP, Wiz).
• Strong grasp of AppSec fundamentals OWASP Top 10, CWE, secure coding practices, and common web/API vulnerability classes. This is the hard floor for the role.
• Exposure to LLMs and AI agents and a genuine drive to build with them youve experimented with AI tooling and want to do it professionally. You do not need to have shipped production AI tooling; thats what youll grow into here.
• Hands-on experience building with LLM APIs, AI agents, or automation frameworks (e.g., Claude, MCP, function/tool calling), or exposure to securing AI/ML and GenAI features.
• DevSecOps, IaC security, or supply-chain experience, and relevant certifications (e.g., AWS Security Specialty, OSCP, GWAPT)

Why You ll Love This Role

• Youll build AI-driven security automation that scales across hundreds of apps and services and see it adopted by real developers.
• Youll join the ASRE team and grow your skills at the leading edge of AI-assisted Application Security.
• Youll work alongside engineers who take security seriously and give you the room to ship and iterate.
• Youll have a clear runway to grow into a Senior role as your technical depth and ownership expand.

Disclaimer : This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.