Security Engineer – Agentic AI

Job not on LinkedIn

🔥 17 hours ago

🇺🇸 United States – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 25%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.Why this score:

• Open for 1 day.
• Jobs at this company usually fill in 153 days.
• No salary listed.

Apply Now

Find Similar Remote Jobs

Brahma

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2022

₿ Crypto

💳 Fintech

🔌 API

💰 $4.2M Seed Round - Brahma on 2022-02

Crypto • Fintech • API

Brahma is a developer-focused orchestration layer that connects onchain financial logic to offchain payment and settlement systems. It enables programmable capital flows across blockchains, strategies, and traditional payment rails, providing smart accounts, automated agents, and programmable card issuance so apps can turn onchain positions into real-world spending. Brahma abstracts infrastructure and settlement for developers, letting them build onchain or hybrid apps without running backend ops.

📋 Description

• Threat model agents, tools, MCP servers, and multi-agent workflows using OWASP Top 10 for LLM Applications, OWASP Agentic AI threats, and MITRE ATLAS • Run a lightweight pre-launch security review gate • Review agentic code and designs, publish secure defaults, and make risk trade-offs explicit and owned • Teach secure agent practices through guides, threat-model walkthroughs, demos, and office hours • Design authentication and authorization for agents and tools using OAuth 2.0/OIDC, token exchange, scoped short-lived credentials, per-tool least privilege, and fail-closed MCP authorization • Harden containers and sandboxes with filesystem isolation, egress control, and human approval for irreversible actions • Build gateway defenses against prompt injection, tool abuse, excessive agency, and data exfiltration using input/output filtering, PII/DLP, and policy-as-code • Build automated adversarial tests for injection, tool misuse, exfiltration, and goal drift in CI and on a schedule • Govern MCP servers, skills, plugins, models, and dependencies through review, allow-listing, signing, SBOMs, and scanning • Make model, tool, and agent calls traceable and feed guardrail events and anomalies into monitoring and alerting • Monitor controls, tune guardrails, and keep them patched and current in production • Own agent-related incident response and lead technical response • Map controls to ISO 27001, ISO/IEC 42001, SOC 2, GDPR, and TPN and keep evidence audit-ready • Build controls, tooling, and tests; review code and designs; share security knowledge across Brahma teams • Follow emerging agent and AI threats, test new attack classes in bounded experiments, and bring proven defenses into production

🎯 Requirements

• 5+ years in security engineering with a strong application or product security component • Fluent Python • Track record of shipping security tooling, controls, and automated tests as production code • Hands-on experience securing LLM applications or agents against prompt injection and unsafe tool use • Deep knowledge of OAuth 2.0, OIDC, token exchange, workload identity, and least-privilege design • Experience leading structured threat modelling and turning findings into prioritised engineering work • Experience embedding security scanning and checks into CI/CD • Experience securing containerised workloads • Ability to explain risk and trade-offs clearly to engineers and leadership, and to document decisions • Track record of teaching and documenting security practices for colleagues and other teams • Nice to have: experience with garak, PyRIT, promptfoo, or similar • Nice to have: practical use of OPA/Rego, Cedar, or similar • Nice to have: familiarity with gVisor, Firecracker, seccomp, or Landlock • Nice to have: experience building or securing MCP servers, LLM gateways, or guardrail services • Nice to have: working knowledge of GCP IAM, Workload Identity, Secret Manager, and Cloud Logging • Nice to have: exposure to ISO/IEC 42001, NIST AI RMF, or MPA/TPN content security • Nice to have: OSCP, GIAC, CSSLP, or equivalent certification

🏖️ Benefits

• No formal on-call rotation yet, though one may be introduced

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume