Lead AI Security Engineer

EPAM is a global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, the company empowers clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.

• Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience
• Hands-on application security experience across the software development lifecycle
• Strong understanding of common application vulnerability classes, mitigations, and secure coding principles including OWASP Top 10
• Practical experience with application security tooling such as SAST, DAST, SCA, and secrets scanning integrated into CI/CD
• Working knowledge of at least one programming language such as Python, Java, C#, JavaScript, TypeScript, or Go
• Experience with threat modeling and secure design review methodologies
• Understanding of DevOps/DevSecOps practices, CI/CD pipelines, and secure-by-design principles
• Familiarity with cloud application security on platforms like Azure, AWS, or GCP
• Experience working in production projects or engineering teams
• Ability to collaborate with developers, architects, QA engineers, DevOps, product, and security teams
• Ability to follow, maintain, and improve defined security processes
• Practical understanding of AI-assisted productivity and automation including AI agent building, LLM integration, prompt engineering, and secure AI tool usage
• Good communication skills for explaining security risks and remediation plans to technical and non-technical stakeholders

Nice to have:

• Experience with platforms/tools such as Snyk, Checkmarx, Veracode, SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, OWASP ZAP
• Experience with software supply chain security including SBOM, SLSA, Sigstore, and artifact integrity controls
• Experience with Infrastructure as Code security tools like Terraform, Bicep, ARM templates, OPA, Checkov, or Trivy
• Experience with container and Kubernetes security
• Experience with API security, secrets management tools like HashiCorp Vault, Azure Key Vault, and microservice security patterns
• Understanding of security frameworks such as ISO 27001, NIST, CIS Benchmarks, PCI DSS, HIPAA, SOC 2, or SOX
• Experience integrating security findings with SIEM/SOAR, ticketing, and vulnerability management workflows
• Experience with AI/LLM platforms or frameworks like Azure OpenAI, Azure AI Foundry, Amazon Bedrock, Microsoft Copilot Studio, LangChain, or AutoGen
• Awareness of AI and LLM security risks including prompt injection, data leakage, model governance, and the OWASP Top 10 for LLM Applications
• Security certifications such as CSSLP, GWAPT, OSCP, OSWE, CISSP, CISM, CCSP, and AI-related certifications like AI-900 or AI-102

• Embed security into the full software development lifecycle and drive shift-left and secure-by-design practices across engineering teams
• Perform and facilitate threat modeling, architecture security reviews, and design reviews for applications, services, and APIs
• Conduct secure code reviews (manual and AI-assisted) and advise developers on secure coding patterns and remediation
• Implement, configure, tune, and operate application security tooling including SAST, DAST, IAST, SCA, secrets scanning, and IaC scanning integrated into CI/CD pipelines
• Triage, validate, and prioritize security findings and partner with development teams to track issues through remediation
• Define, implement, and maintain security gates and policies in CI/CD pipelines
• Secure the software supply chain, including dependency and open-source risk management, SBOM generation, artifact integrity and signing, and build pipeline hardening
• Support and coordinate application penetration testing and validate identified vulnerability fixes
• Drive secrets management, secure configuration, API security, container and image security, and microservice security practices
• Establish and run a security champions program and deliver secure-coding training, guidelines, and reusable security patterns
• Define and maintain application security standards, baselines, and policy-as-code, contributing to vulnerability management and risk-acceptance
• Build, deploy, and maintain AI-assisted automations and agentic workflows for daily application security activities
• Build and integrate AI agents and LLM-backed automations into the SDLC and CI/CD pipelines
• Develop, test, and maintain reusable prompts and structured-prompting patterns for AppSec tasks
• Implement retrieval over codebases and security standards for AI assistants to use authoritative internal context
• Build evaluation, validation, and human-in-the-loop checkpoints into AI-assisted AppSec workflows
• Implement security and privacy controls for AppSec AI usage, including least-privilege access, prompt-injection resistance, and auditability
• Design, implement, and operate security controls for AI- and LLM-powered application features aligned to the OWASP Top 10 for LLM Applications
• Define and enforce guardrails for AI adoption in product engineering and advise teams on secure AI feature development

By applying, candidates agree to the processing of their personal data by EPAM Systems (Poland) sp. z o.o. for recruitment purposes in accordance with the company's Privacy Policy. Benefits listed are available to employees only. The company is open to working with contractors under individually agreed B2B terms. Selected candidates will be contacted exclusively.