Lead Security Engineer – Penetration Testing, AI Security

🔥 3 minutes ago

🇮🇳 India – Remote

⏰ Full Time

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 14%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

HighLevel

WebsiteLinkedInAll Job Openings

201 - 500 employees

Founded 2018

💼 Consulting

📦 Logistics

☁️ SaaS

💰 Series A on 2021-11

Consulting • Logistics • SaaS

HighLevel is an all-in-one marketing and sales platform designed to help businesses grow and succeed. The platform consolidates various marketing tools into a single solution, providing features such as lead capture through landing pages, surveys, forms, and calendars, as well as tools for nurturing leads via automated messaging across multiple channels including phone, SMS, email, and social media. HighLevel offers customizable solutions like online appointment scheduling, multi-channel follow-up campaigns, and pipeline management. Additionally, businesses can build websites, funnels, and landing pages using the intuitive page builder. HighLevel supports integrating with existing systems via API, and offers a membership platform for community building and course management. The platform is targeted towards marketers and offers white-labeling options for businesses to brand the software as their own. With a community-driven development approach and award-winning support, HighLevel is focused on empowering businesses to streamline their operations and enhance their marketing efficiencies.

📋 Description

• Lead Application Security initiatives across web, mobile, API, microservices, and cloud-native products • Conduct architecture reviews, threat modeling, secure design and code reviews, and hands-on security assessments • Identify weaknesses in authentication, authorization, tenant isolation, business logic, data protection, and API security • Define security standards, requirements, guardrails, and reusable secure engineering patterns • Improve security testing across CI/CD pipelines using SAST, DAST, SCA, secret scanning, container scanning, and Infrastructure as Code scanning • Drive risk-based vulnerability triage and remediation with engineering teams • Develop security automation and promote secure coding through guidance, documentation, and training • Lead security reviews of LLM applications, AI agents, RAG architectures, machine learning services, and third-party AI integrations • Assess AI architectures, including model APIs, data pipelines, vector stores, prompts, fine-tuning workflows, plugins, and agent tool chains • Conduct adversarial testing for prompt injection, jailbreaking, sensitive-data disclosure, system-prompt leakage, output manipulation, insecure tool use, excessive agency, and model abuse • Evaluate risks involving data poisoning, model inversion, training-data extraction, adversarial evasion, and model exfiltration • Test guardrails, input/output filtering, access controls, human approvals, logging, monitoring, and abuse detection • Develop repeatable AI security testing methodologies, playbooks, automation, and test cases using Garak, PyRIT, or similar frameworks • Assess security and supply-chain risks associated with third-party models, AI platforms, and AI-enabled SaaS products • Produce security reports with evidence, risk ratings, business impact, and actionable remediation guidance • Communicate security risks to developers, architects, product leaders, and executive stakeholders • Partner with external consultants, researchers, and bug bounty programs for specialized assessments • Mentor engineers and help establish a security-conscious engineering culture • Stay current with Application Security, AI Security, and adversarial testing developments

🎯 Requirements

• 8+ years of cybersecurity experience, with deep hands-on expertise in Application Security, product security, penetration testing, or security engineering • Experience conducting threat modeling, architecture reviews, secure code reviews, penetration testing, and vulnerability validation • 1–3 years of AI Security experience, with AI/ML security, adversarial testing of AI systems, or applied AI research with a security focus • Strong knowledge of web, mobile, API, and cloud-native security, including OWASP guidance and business-logic risks • Strong understanding of OAuth 2.0, OIDC, JWT, SAML, and modern access-control models • Hands-on DevSecOps experience with CI/CD security automation, SAST, DAST, SCA, secret scanning, containers, and Infrastructure as Code • Practical knowledge of Docker, Kubernetes, microservices, and cloud security • Demonstrated experience assessing or securing LLM applications, RAG systems, AI agents, machine learning models, or AI-enabled products • Understanding of prompt injection, jailbreaking, data leakage, insecure tool use, excessive agency, model misuse, and AI supply-chain risks • Familiarity with OWASP guidance for LLM applications, MITRE ATLAS, NIST AI RMF, and related AI security practices • Programming or scripting proficiency in Python, Go, JavaScript, Bash, or a similar language • Strong written and verbal communication skills • Preferred: experience building or scaling Application Security practices within a SaaS or product-led technology organization • Preferred: hands-on experience red teaming LLM applications, RAG systems, AI agents, or AI-enabled products • Preferred: experience developing security automation, internal testing tools, or reusable security guardrails • Preferred: contributions to security research, open-source projects, bug bounty programs, or responsible vulnerability disclosure • Preferred: relevant certifications such as OSCP, OSWE, GWAPT, GIAC, CISSP, or an AI Security credential

🏖️ Benefits

• Remote work in India • Global, remote-first work environment • Equal Employment Opportunity Employer • Opportunity to work with a global team across 15+ countries