Senior Software Engineer | AI Security Engineering

NinjaOne is an IT operations platform company that provides endpoint management, patching, backup, and remote access solutions. The Senior Software Engineer will build and operate an AI-powered vulnerability platform, developing reliable workflows for vulnerability discovery, finding validation, patch testing, and secure agent execution. The role partners with security and engineering teams to deliver actionable findings across the cloud platform and endpoint agents.

Responsibilities:

• Build and operate a production AI vulnerability platform with resumable workflows, bounded agent execution, model routing, and per-repository budgets across AWS Bedrock and OpenAI-compatible APIs
• Engineer repository context, threat models, and coverage tracking so agents can reason about entry points, trust boundaries, tenant isolation, and relevant code paths
• Build independent validation, stable finding identity, and deduplication. Ground reachability and exploitability of judgments in code, deployment evidence, and reproducible tests
• Develop patch and regression-test workflows that demonstrate a failing test before a fix and a passing test afterward, check for regressions, and require human review before merging
• Protect agent execution with sandboxing, least-privilege tool access, and controls for untrusted repository content, prompt injection, secrets, and sensitive data
• Partner with security and engineering teams to deliver findings through SARIF and existing workflows. Measure validated finding quality, coverage, reliability, and cost per validated finding; communicate results and share engineering practices
• Other duties as needed

Requirements:

• 8+ years of software engineering experience, including ownership of production services or automation platforms, and hands-on experience building LLM-backed applications or agent workflows
• Strong Python skills, including asynchronous concurrency, typing, testing, packaging, and profiling
• You can design, ship, debug, and maintain production-quality software
• Experience building multi-step workflows with durable state, idempotent retries, task queues, termination conditions, observability, and resource limits
• You can explain the failure modes and tradeoffs of systems you have shipped
• Hands-on experience with LLM APIs, tool calling, structured outputs, context management, and evaluation
• You can assess when to use an agent framework and when simpler orchestration is more reliable
• Experience with AWS or comparable cloud infrastructure and distributed systems
• Familiarity with model provider integrations, container isolation, and secure handling of code and credentials
• Working knowledge of application security, including authentication, authorization, common vulnerability classes, and trust boundaries
• You can use evidence to distinguish a plausible hypothesis from an actionable finding
• Ability to work through ambiguity, collaborate with product and security engineers, and communicate technical decisions and results to engineering and leadership audiences
• Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent practical experience
• You do not need expertise in both areas
• Vulnerability Discovery: static analysis, syntax trees and call graphs, code retrieval, threat modeling, or sandboxed proof-of-concept execution
• Finding Validation: security triage, clustering or near-duplicate detection, benchmark design, ground-truth labeling, or automated patching and test infrastructure
• You understand how to measure precision and the limits of recall estimates without a labeled dataset
• This position is NOT eligible for Visa sponsorship
• Experience reading C or C++ and understanding native-code vulnerabilities is valuable for our endpoint agents
• SARIF, SAST/SCA integrations, durable execution frameworks, or tracing and evaluation tools for LLM applications
• Securing agentic systems through authorization, sandboxing, tool permissions, or defenses against malicious inputs
• Open-source contributions, security research, program repair, or other examples of software you have built and operated