Senior Application Security Engineer

CRG is recruiting for an unnamed AI technology company seeking an AI Application Security Engineer. The role owns application and product security for AI-powered applications, including security controls, agentic AI risk reviews, tooling, and secure development practices.

Responsibilities:

• Designing, developing and implementing security controls across production applications
• Assessing security risks associated with agentic AI systems, including agent design, permissions, scoping and autonomous workflows
• Conducting security risk reviews of AI-powered product features and integrations
• Developing security tooling and automation using Python, Go or TypeScript
• Implementing secure software development lifecycle (SDLC) practices across engineering teams
• Conducting application threat modelling, security architecture reviews and code reviews
• Identifying and mitigating vulnerabilities relating to authentication, authorisation, secrets management and API security
• Developing secure integration patterns for AI agents interacting with internal systems, external APIs and third-party services
• Working closely with Software Engineers and AI/ML teams to embed security throughout the development lifecycle
• Implementing automated security testing and vulnerability detection capabilities
• Supporting secure CI/CD pipelines and deployment processes
• Establishing security standards and best practices for AI-powered applications
• Helping ensure applications meet security requirements within regulated environments
• Proactively identifying security risks and developing practical engineering solutions

Requirements:

• 5+ years of professional experience in Application Security or Product Security Engineering
• Proven experience securing production applications or products operating at scale
• Understanding of the security surface of agentic AI across the product layer, including agent design, scoping and security risk reviews
• Strong programming skills in Python, Go or TypeScript, with experience developing security tooling and automation
• Deep understanding of application security fundamentals, including OWASP Top 10
• Strong knowledge of authentication, authorisation and access control (AuthN/AuthZ)
• Experience implementing secure software development lifecycle (SDLC) practices
• Strong understanding of secrets management, secure integration patterns and cryptography fundamentals
• Experience conducting application threat modelling, security architecture reviews and vulnerability assessments
• Ability to identify and assess security risks within modern software applications
• Experience working collaboratively with Software Engineers and Product Teams to implement practical security solutions
• Strong communication skills and the ability to explain complex security risks to technical stakeholders
• Understanding agentic AI security is a mandatory requirement. Candidates must be comfortable discussing the security implications of AI agent design, permission boundaries, operational scoping and product-level risk assessments
• Has a genuine interest in AI security and understands the risks associated with autonomous AI systems
• Enjoys writing code and building practical security solutions
• Understands how to balance strong security controls with fast-moving product development
• Can assess the security implications of AI agent design and integration decisions
• Takes ownership of security challenges from initial assessment through to implementation
• Works collaboratively with Software Engineers, Product Managers and AI specialists
• Can clearly communicate technical security risks and recommendations
• Has a proactive approach to identifying and mitigating emerging security threats
• strong programming skills and an understanding of agentic AI security
• Hands-on experience securing AI-powered applications, LLM products or autonomous AI agents
• Experience developing security controls specifically for agentic AI workflows
• Knowledge of prompt injection, agent privilege escalation and AI-specific attack surfaces
• Experience developing automated security tooling and internal security platforms
• Familiarity with SAST, DAST and automated application security testing
• Experience working with sensitive customer information, including healthcare or financial data
• Knowledge of compliance frameworks including FedRAMP, HIPAA, SOC 2 or ISO 27001
• Previous experience working within government, healthcare, financial services or other regulated environments
• Experience working within high-growth technology startups
• Familiarity with AI-assisted software development and security tooling