EPAM Systems

Lead AI Security Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnie·WarszawaFull-time

#463617·Dodano 14 dni temu·0

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Application Securitythreat modelingSecure Code ReviewSASTDASTCI/CDDevSecOpsAPI securitysecrets managementPrompt Engineering

Podsumowanie oferty

Lead AI Security Engineer securing software across the development lifecycle and building AI-assisted application security workflows. The role also secures AI- and LLM-powered applications, integrating security controls and automations into the SDLC and CI/CD pipelines.

Wymagania

Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
Hands-on application security experience across the software development lifecycle.
Strong understanding of common application vulnerabilities and mitigations, including the OWASP Top 10, and of secure coding principles.
Practical experience with application security tools such as SAST, DAST, SCA, and secrets scanning, and integrating them into CI/CD.
Working knowledge of at least one programming language, such as Python, Java, C#, JavaScript, TypeScript, or Go, sufficient to read code and assess vulnerabilities.
Experience with threat modeling and secure design review methodologies.
Understanding of DevOps/DevSecOps practices, CI/CD pipelines, and secure-by-design principles.
Familiarity with cloud application security concepts across at least one major cloud platform, such as Azure, AWS, or GCP.
Experience participating in several production projects or engineering teams.
Ability to work with developers, architects, QA engineers, DevOps, product, and security teams, and influence without owning the codebase.
Ability to follow, maintain, and improve defined security processes.
Practical understanding of AI-assisted productivity and automation beyond basic chatbot use, including some of: building or configuring AI agents; automating security or engineering tasks; integrating LLMs with tools, APIs, documents, or workflows; prompt engineering and structured prompting; creating AI-assisted runbooks, scripts, queries, or documentation; and using AI tools securely with awareness of sensitive data handling and access control.
Good communication skills and ability to explain security risks, technical decisions, and remediation plans to technical and non-technical stakeholders.

Nice to have:

Experience with application security tools such as Snyk, Checkmarx, Veracode, SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, or OWASP ZAP.
Experience with software supply chain security, including SBOM, SLSA, Sigstore, and dependency and artifact integrity controls.
Experience with Infrastructure as Code and policy-as-code security tools such as Terraform, Bicep, ARM templates, OPA, Checkov, or Trivy.
Experience with container and Kubernetes security, including image scanning, registries, runtime protection, and network policies.
Experience with API security, secrets management (such as HashiCorp Vault or Azure Key Vault), and microservice security patterns.
Understanding of a compliance or security framework such as ISO 27001, NIST, CIS Benchmarks, PCI DSS, HIPAA, SOC 2, or SOX.
Experience integrating security findings with SIEM/SOAR, ticketing, and vulnerability management workflows.
Experience with AI/LLM platforms or frameworks such as Azure OpenAI, Azure AI Foundry, Amazon Bedrock, Microsoft Copilot Studio, LangChain, or AutoGen.
Understanding of AI and LLM application security risks, including prompt injection, insecure output handling, data leakage, excessive agency, insecure tool use, model governance, and AI supply chain risks.
Security certifications such as CSSLP, GWAPT, GWEB, OSCP, OSWE, CISSP, CISM, or CCSP; AI-related certifications such as AI-900 or AI-102 are also a plus.

Obowiązki

Embed security across the software development lifecycle and promote shift-left and secure-by-design practices.
Facilitate threat modeling, architecture security reviews, and design reviews for applications, services, and APIs.
Conduct manual and AI-assisted secure code reviews and advise developers on secure coding and remediation.
Implement, configure, tune, and operate application security tools, including SAST, DAST, IAST, SCA, secrets scanning, and IaC scanning, integrated into CI/CD pipelines.
Triage, validate, prioritize, and reduce false positives in security findings, and work with development teams to track issues through remediation.
Define, implement, and maintain security gates and policies in CI/CD pipelines.
Secure the software supply chain through dependency and open-source risk management, SBOM generation, artifact integrity and signing, and build pipeline hardening.
Coordinate application penetration testing and validate fixes for identified vulnerabilities.
Drive secrets management, secure configuration, API security, container and image security, and microservice security practices.
Establish and run a security champions program; develop and deliver secure-coding training, guidelines, and reusable security patterns.
Define and maintain application security standards, baselines, and policy-as-code, and contribute to vulnerability management and risk-acceptance processes.
Build, deploy, and maintain AI-assisted automations and agentic workflows for application security tasks, including vulnerability triage, deduplication, prioritization, code review, threat modeling support, finding enrichment, root-cause analysis, remediation-PR drafting, compliance evidence collection, and documentation and runbook automation.
Build and integrate AI agents and LLM-backed automations into the SDLC and CI/CD pipelines, connecting models to scanners, code hosts, ticketing, and security tools using function calling, REST, and webhooks.
Develop, test, and maintain prompts, structured-prompting patterns, and prompt templates for application security tasks, and tune them for accuracy, signal quality, and safe behavior.
Implement retrieval over codebases, security standards, and remediation guidance, such as RAG, for AI assistants.
Add evaluation, validation, human-in-the-loop checkpoints, output verification, guardrails, and approval gates to AI-assisted application security workflows.
Implement security and privacy controls for application security AI usage, including least-privilege agent access, source-code and secrets handling, prompt-injection resistance, and auditability.
Design, implement, and operate security controls for AI- and LLM-powered application features, including input and output validation, prompt-injection and jailbreak defenses, tool- and function-call authorization, rate limiting, and model and data access governance aligned with the OWASP Top 10 for LLM Applications.
Define and enforce guardrails for secure AI adoption in product engineering, covering prompt security, model and tool access control, output handling, data protection, auditability, and human-in-the-loop processes; advise development teams on building AI features securely.

Benefity

Career development programs, mentoring, and soft skills and well-being programs.
Certification opportunities in Anthropic, Gemini, GCP, Azure, and AWS.
English classes.
Participation in the Employee Stock Purchase Plan with a 15% discount.
Benefits package including health insurance, multisport, and shopping vouchers.
Referral bonuses up to $2,000.
Offices with entertainment and relaxation zones, table tennis, football, free snacks, and coffee.
Corporate, social, and well-being events.
Opportunity to work abroad for up to 60 days annually.
Business-driven relocation opportunities.

Kursy językowe

Udziały pracownicze

Ubezpieczenie

Karta sportowa

Premie

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

EPAM Systems

1668 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz