Lead AI Security Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnie·WrocławFull-time

#463616·Dodano wczoraj·1

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Application Securitythreat modelingSecure Code ReviewSASTDASTSCACI/CDsecrets managementPrompt Engineering

Podsumowanie oferty

Secure software across the full development lifecycle, embedding security in design, code, build, and release. Build AI-assisted AppSec automations and secure AI- and LLM-powered applications, integrating security tooling and agents with CI/CD pipelines.

Wymagania

Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
Hands-on application security experience across the software development lifecycle; understanding of common vulnerability classes, the OWASP Top 10, and secure coding principles.
Practical experience with application security tooling such as SAST, DAST, SCA, and secrets scanning, including integration with CI/CD.
Working knowledge of at least one programming language, such as Python, Java, C#, JavaScript, TypeScript, or Go, sufficient to read code and assess vulnerabilities.
Experience with threat modeling and secure design review methodologies.
Understanding of DevOps/DevSecOps, CI/CD pipelines, and secure-by-design principles.
Familiarity with cloud application security on at least one major cloud platform, such as Azure, AWS, or GCP.
Experience participating in several production projects or engineering teams.
Ability to work with developers, architects, QA engineers, DevOps, product, and security teams and influence without owning the codebase.
Ability to follow, maintain, and improve defined security processes.
Practical understanding of AI-assisted productivity and automation beyond basic chatbot usage, including AI agents, automating security or engineering tasks, integrating LLMs with tools, APIs, documents, or workflows, prompt engineering, and secure handling of sensitive data and access.
Good communication skills and ability to explain security risks, technical decisions, and remediation plans to technical and non-technical stakeholders.

Nice to have:

Experience with application security tools such as Snyk, Checkmarx, Veracode, SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, or OWASP ZAP.
Experience with software supply chain security, including SBOM, SLSA, Sigstore, and dependency and artifact integrity controls.
Experience with Infrastructure as Code and policy-as-code tools such as Terraform, Bicep, ARM templates, OPA, Checkov, or Trivy.
Experience with container and Kubernetes security, including image scanning, registries, runtime protection, and network policies.
Experience with API security, secrets management tools such as HashiCorp Vault or Azure Key Vault, and microservice security patterns.
Understanding of a compliance or security framework such as ISO 27001, NIST, CIS Benchmarks, PCI DSS, HIPAA, SOC 2, or SOX.
Experience integrating security findings with SIEM/SOAR, ticketing, and vulnerability management workflows.
Experience with AI/LLM platforms or frameworks such as Azure OpenAI, Azure AI Foundry, Amazon Bedrock, Microsoft Copilot Studio, LangChain, or AutoGen.
Understanding of AI and LLM application security risks, including prompt injection, insecure output handling, data leakage, excessive agency, insecure tool use, model governance, and AI supply chain risks.
Security certifications such as CSSLP, GWAPT, GWEB, OSCP, OSWE, CISSP, CISM, or CCSP; AI-related certifications such as AI-900 or AI-102 are a plus.

Obowiązki

Embed security across the software development lifecycle and promote shift-left and secure-by-design practices.
Perform threat modeling, architecture security reviews, and design reviews for applications, services, and APIs.
Conduct manual and AI-assisted secure code reviews; advise developers on secure coding and remediation.
Implement and operate application security tooling, including SAST, DAST, IAST, SCA, secrets scanning, and IaC scanning in CI/CD pipelines.
Triage and prioritize security findings, reduce false positives, and work with development teams through remediation.
Define security gates and policies in CI/CD pipelines; secure the software supply chain through dependency risk management, SBOM generation, artifact integrity and signing, and pipeline hardening.
Coordinate application penetration testing and validate fixes; drive secrets management, secure configuration, API security, container and image security, and microservice security.
Run a security champions program and deliver secure-coding training, guidelines, and reusable security patterns.
Maintain application security standards, baselines, and policy-as-code; contribute to vulnerability management and risk acceptance.
Build and maintain AI-assisted automations and agentic workflows for AppSec tasks, including vulnerability triage, code review, threat modeling, finding enrichment, remediation drafting, compliance evidence collection, and documentation automation.
Integrate AI agents and LLM-backed automations into the SDLC and CI/CD pipelines, connecting models with scanners, code hosts, ticketing, and security tools using function calling, REST, and webhooks.
Develop and tune prompts and prompt templates; implement retrieval over codebases and security guidance, such as RAG.
Add evaluation, validation, human review, guardrails, and approval gates to AI-assisted AppSec workflows; implement least-privilege access, source-code and secrets handling, prompt-injection resistance, and auditability.
Design and operate controls for AI- and LLM-powered application features, including input and output validation, prompt-injection and jailbreak defenses, tool-call authorization, rate limiting, and model and data access governance aligned with the OWASP Top 10 for LLM Applications.
Define guardrails for secure AI adoption in product engineering and advise development teams on building AI features securely.

Benefity

Career development programs.
Mentoring, soft skills, and well-being programs.
Certifications in Anthropic, Gemini, GCP, Azure, and AWS.
English classes.
Employee Stock Purchase Plan with a 15% discount.
Benefits package including health insurance, multisport, and shopping vouchers.
Referral bonuses up to $2,000.
Offices with entertainment and relaxation zones, table tennis, football, free snacks, and coffee.
Corporate, social, and well-being events.

Kursy językowe

Udziały pracownicze

Ubezpieczenie

Premie

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

Inne informacje

Remote work is available within Poland, with an opportunity to work abroad for up to 60 days annually.

EPAM Systems

1581 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz