Product Security Engineer - AI/LLM Security

We are looking for a Product Security Engineer to secure enterprise applications and AI-powered products across multiple engineering teams and repositories. This role requires strong hands-on security expertise, practical vulnerability discovery and exploitation skills, and the ability to independently assess, prioritize, and drive remediation of security risks across multiple products.

The ideal candidate can go beyond automated scanning to uncover real-world vulnerabilities, assess their business impact, work directly with engineering teams, and ensure security findings are remediated and verified in fast-moving development environments.

Title : Product Security Engineer - AI/LLM Security

Location :Remote Work

Employment Type: Full-time

Key Responsibilities:

• Own security assessments across multiple enterprise applications, AI-powered products, repositories, and engineering teams.
• Perform hands-on web, API, cloud, and Kubernetes security testing, including vulnerability discovery, exploitation, validation, and remediation verification.
• Identify security weaknesses through manual testing, source-code review, threat modeling, architecture reviews, and security tooling.
• Assess authentication, authorization, business logic, APIs, cloud configurations, IAM, containers, and Kubernetes environments.
• Test AI/LLM applications and agents for prompt injection, indirect prompt injection, sensitive-data leakage, insecure tool usage, authorization bypasses, and excessive agent permissions.
• Prioritize vulnerabilities based on exploitability, business impact, exposure, and risk—not solely on scanner severity or CVSS scores.
• Work directly with engineering teams to drive remediation, resolve blockers, retest fixes, and close security findings.
• Integrate security into the SDLC and CI/CD pipelines using SAST, DAST, SCA, secrets detection, and security gates.
• Establish repeatable security practices and scalable controls across multiple products, repositories, and engineering teams.
• Rapidly assess new applications, identify the highest-risk gaps, and recommend actionable security improvements.
• Communicate technical findings, business impact, and remediation priorities clearly to engineering teams and business stakeholders.

Required Qualifications :

• Hands-on experience in Product Security or Application Security or Application Security Engineering, or Offensive Security.
• Strong expertise in web and API security, OWASP Top 10, authentication and authorization vulnerabilities, and business logic flaws.
• Demonstrated ability to independently discover, reproduce, and validate real-world vulnerabilities beyond automated scanner findings.
• Strong experience with Burp Suite or OWASP ZAP, source-code security review, root-cause analysis, and remediation validation.
• Practical experience with threat modeling, secure architecture reviews, and identifying attack paths across applications and APIs.
• Experience securing cloud environments, IAM, containers, Kubernetes, and CI/CD pipelines.
• Experience implementing or operating SAST, DAST, SCA, and related security controls within the SDLC.
• Hands-on experience testing AI/LLM applications or agents and identifying security risks such as prompt injection, data leakage, or insecure tool execution.
• Proven ability to prioritize vulnerabilities across multiple applications and drive findings from discovery through remediation, retesting, and closure.
• Strong ownership, problem-solving, and execution skills, with the ability to work independently in fast-moving engineering environments.
• Strong communication skills, including the ability to explain technical vulnerabilities in terms of business risk and actionable remediation.

Nice to Have:

• Experience securing RAG-based applications, agentic AI systems, MCP integrations, or AI tool-calling workflows.
• Experience with AI red teaming and AI-specific threat modeling.
• GCP/GKE experience; AWS or Azure cloud security experience is also valuable.
• Security certifications such as OSCP, OSWE, GIAC, CREST, or equivalent practical experience.

What Success Looks Like:

• Security vulnerabilities are identified and validated before they become production incidents.
• Critical risks are prioritized based on actual exploitability and business impact.
• Engineering teams receive clear remediation guidance and security findings are tracked through verified closure.
• Security controls scal…