Senior Application Security Engineer – GenAI Security Evaluation

🔥 12 hours ago

🌐 Indonesia, Nigeria, +2 more countries – Remote

🇮🇩 Indonesia – Remote 🇳🇬 Nigeria – Remote 🇹🇷 Turkey – Remote 🇺🇸 United States – Remote

⏳ Contract/Temporary

🟠 Senior

💻 Application Engineer

👻 Ghost score 12%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Gramian Consulting

WebsiteLinkedInAll Job Openings

2 - 10 employees

Founded 2025

💼 Consulting

📦 Logistics

📣 Marketing

Consulting • Logistics • Marketing

Gramian Consulting is a remote-first consulting firm that connects engineering and data/AI talent with organizations through talent augmentation, recruiting, dedicated teams, and contractor management. The firm provides Data & AI services including LLM training and fine-tuning, AI agents and assistants, MLOps, and AI infrastructure, and it offers mentorship and education programs for career readiness, interview preparation, and international market orientation. Rooted in hands-on engineering and recruiting experience, Gramian helps clients scale technical teams and extract business value from AI while developing individual talent.

📋 Description

• Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities. • Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components. • Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences. • Evaluate static application security testing (SAST) tools and assess their ability to detect genuine vulnerabilities while avoiding false positives. • Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries. • Annotate security findings, including affected assets, root causes, controls, severity, and residual risk. • Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients. • Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors. • Recommend appropriate security controls and remediation approaches. • Participate in technical calibration, peer reviews, and quality assurance activities.

🎯 Requirements

• 5+ years of professional experience in application security, product security, or security-focused software engineering. • Strong experience conducting secure code reviews and identifying application-level vulnerabilities. • Practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST). • Hands-on experience with security analysis tools such as CodeQL or Semgrep. • Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications. • Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP). • Strong understanding of authorization models, including actors, identities, trust boundaries, multi-tenant authorization, access control, OAuth, IAM, identity management, permitted data access and actions, purpose and recipient restrictions, and document-level access control. • Production-level coding experience in Python and/or TypeScript. • Ability to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives. • Strong analytical skills and ability to communicate technical security findings clearly.

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume