Member of Technical Staff – Information Security

About the role

What you will own

1. Application Security: Conduct security assessments of web applications, APIs, and mobile applications using manual and automated techniques, with strong knowledge of OWASP Top 10 and secure coding practices.
2. AI & LLM Security: Threat-model and assess AI applications for prompt injection, jailbreaks, data leakage, insecure outputs, hallucinations, and guardrail bypasses using frameworks such as OWASP LLM Top 10 and MITRE ATLAS.
3. Agent & MCP Security: Secure AI agents, tools, connectors, and MCP servers through least privilege, credential protection, approval controls, and auditability.
4. AI-Assisted Development Security: Build controls around AI-generated code, including secret leakage, insecure coding patterns, dependency/model supply-chain risks, and code provenance.
5. Security Automation with AI: Build AI-assisted solutions for security triage, false-positive reduction, secure code review, evidence collection, and customer security questionnaires.
6. Security Testing & Tooling: Work with SAST, DAST, IAST, Burp Suite and similar tools, while developing AI-specific testing and model red-teaming capabilities.
7. CI/CD Security: Implement automated security checks and security gates across development and deployment pipelines, including AI-generated code.
8. Vulnerability Management: Demonstrate proof of concept for vulnerabilities, work closely with engineering teams on remediation, and verify fixes before closure.
9. Compliance & Risk: Support ISO 27001 and SOC 2 Type 2 audits and extend security controls for AI systems, considering ISO 42001, NIST AI RMF, EU AI Act, GDPR, HIPAA and DPDPA.
10. Third-Party & AI Vendor Risk: Assess AI vendors, model providers and subprocessors for data retention, training usage, residency, isolation, and security controls.
11. Customer & Stakeholder Security: Handle enterprise security reviews, RFP/RFQ security requirements, audits, and AI-specific customer security questions.
12. Security Culture & Collaboration: Maintain security policies and documentation, conduct security awareness programs, and collaborate with Development, QA, Infrastructure and Legal to embed security throughout the lifecycle.

What we are looking for

• Education: Bachelor's degree in Computer Science or related field.
• Experience: 3–6 years in Information Security, Application Security, vulnerability management, and security assessments.
• AI Security: Hands-on exposure to securing or attacking LLM applications, RAG pipelines, or AI agents through professional work, research, CTFs, bug bounty, or open source.
• Technical Skills: Ability to read code in Ruby, Java, Swift and JavaScript; Python for security tooling; AWS security; Jenkins/CI-CD.
• Certifications: CISSP, CISA, CISM, CEH, OSCP or ISO 27001 certifications are a plus, but not mandatory.
• Nice to have: AI red teaming, MCP/agent frameworks, LLM security automation, evaluation frameworks, and experience taking AI products through enterprise security reviews.