EPAM Systems

Lead AI Security Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnie·KrakówFull-time

#463618·Dodano 14 dni temu·0

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Application Securitythreat modelingSecure Code ReviewSASTCI/CDsecrets managementLLM IntegrationSecure Software Supply Chain

Podsumowanie oferty

Secure software across the full development lifecycle, including AI- and LLM-powered applications. The role embeds security in design, code, build and release, and builds AI-assisted AppSec automations and integrations with CI/CD pipelines.

Wymagania

Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
Hands-on application security experience across the software development lifecycle.
Strong understanding of common application vulnerability classes and mitigations, including the OWASP Top 10, and secure coding principles.
Practical experience with application security tooling such as SAST, DAST, SCA and secrets scanning, and integrating it into CI/CD.
Working knowledge of at least one programming language, such as Python, Java, C#, JavaScript, TypeScript or Go, sufficient to read code and assess vulnerabilities.
Experience with threat modeling and secure design review methodologies.
Understanding of DevOps/DevSecOps practices, CI/CD pipelines and secure-by-design principles.
Familiarity with cloud application security concepts on at least one major cloud platform, such as Azure, AWS or GCP.
Experience participating in several production projects or engineering teams.
Ability to work with developers, architects, QA engineers, DevOps, product and security teams, and influence without owning the codebase.
Ability to follow, maintain and improve defined security processes.
Practical understanding of AI-assisted productivity and automation beyond basic chatbot usage, including experience with some of: building or configuring AI agents; automating security or engineering tasks with AI; integrating LLMs with tools, APIs, documents or workflows; prompt engineering and structured prompting; creating AI-assisted runbooks, scripts, queries or documentation; and securely using AI tools with awareness of sensitive-data handling and access control.
Good communication skills and ability to explain security risks, technical decisions and remediation plans to technical and non-technical stakeholders.

Nice to have:

Experience with application security tools such as Snyk, Checkmarx, Veracode, SonarQube, Semgrep, GitHub Advanced Security, Burp Suite or OWASP ZAP.
Experience with software supply chain security, including SBOM, SLSA, Sigstore, and dependency and artifact integrity controls.
Experience with Infrastructure as Code and policy-as-code tools such as Terraform, Bicep, ARM templates, OPA, Checkov or Trivy.
Experience with container and Kubernetes security, including image scanning, registries, runtime protection and network policies.
Experience with API security, secrets management tools such as HashiCorp Vault or Azure Key Vault, and microservice security patterns.
Understanding of at least one security or compliance framework, such as ISO 27001, NIST, CIS Benchmarks, PCI DSS, HIPAA, SOC 2 or SOX.
Experience integrating security findings with SIEM/SOAR, ticketing and vulnerability management workflows.
Experience with AI/LLM platforms or frameworks such as Azure OpenAI, Azure AI Foundry, Amazon Bedrock, Microsoft Copilot Studio, LangChain or AutoGen.
Understanding of AI and LLM application security risks, including prompt injection, insecure output handling, data leakage, excessive agency, insecure tool use, model governance and AI supply chain risks.
Security certifications such as CSSLP, GWAPT, GWEB, OSCP, OSWE, CISSP, CISM or CCSP; AI-related certifications such as AI-900 or AI-102 are a plus.

Obowiązki

Embed security throughout the software development lifecycle and promote shift-left and secure-by-design practices across engineering teams.
Facilitate threat modeling, architecture security reviews and design reviews for applications, services and APIs.
Conduct manual and AI-assisted secure code reviews; advise developers on secure coding patterns and remediation.
Implement, configure, tune and operate application security tooling, including SAST, DAST, IAST, SCA, secrets scanning and IaC scanning, integrated into CI/CD pipelines.
Triage, validate and prioritize security findings, reduce false positives, and work with development teams to track issues through remediation.
Define, implement and maintain security gates and policies in CI/CD pipelines.
Secure the software supply chain through dependency and open-source risk management, SBOM generation, artifact integrity and signing, and build-pipeline hardening.
Coordinate application penetration testing and validate fixes for identified vulnerabilities.
Drive secrets management, secure configuration, API security, container and image security, and microservice security practices.
Establish a security champions program and deliver secure-coding training, guidelines and reusable security patterns.
Maintain application security standards, baselines and policy-as-code; contribute to vulnerability management and risk-acceptance processes.
Build and maintain AI-assisted automations and agentic workflows for AppSec tasks, including vulnerability triage, deduplication, prioritization, code review, threat modeling support, remediation guidance, compliance evidence collection and documentation automation.
Integrate AI agents and LLM-backed automations into the SDLC and CI/CD pipelines, connecting models to scanners, code hosts, ticketing and security tooling via function calling, REST and webhooks.
Develop and maintain reusable prompts and prompt templates for AppSec tasks, tuning them for accuracy, signal quality and safe behavior.
Implement retrieval over codebases, security standards and remediation guidance, such as RAG, so AI assistants use current internal context.
Build evaluation, validation and human-in-the-loop checkpoints, including output verification, guardrails and approval gates, into AI-assisted AppSec workflows.
Implement security and privacy controls for AppSec AI usage, including least-privilege agent access, source-code and secrets handling, prompt-injection resistance and auditability.
Design and operate controls for AI- and LLM-powered application features, including input and output validation, prompt-injection and jailbreak defenses, tool and function-call authorization, rate limiting, and model and data access governance aligned with the OWASP Top 10 for LLM Applications.
Define guardrails for secure AI adoption in product engineering and advise development teams on building AI features securely.

Benefity

Career development programs.
Thought leadership, mentoring, soft-skills and well-being programs.
Certification opportunities, including Anthropic, Gemini, GCP, Azure and AWS.
English classes.
Participation in the Employee Stock Purchase Plan with a 15% discount.
Benefits package including health insurance, multisport and shopping vouchers.
Referral bonuses up to $2,000.
Office entertainment and relaxation zones, table tennis, football, free snacks and coffee.
Corporate, social and well-being events.
Business-driven relocation opportunities.

Pakiet relokacyjny

Kursy językowe

Ubezpieczenie

Karta sportowa

Udziały pracownicze

Premie

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

Inne informacje

Remote work is available within Poland; the offer describes the work mode as hybrid by design.
The offer states the opportunity to work abroad for up to 60 days annually.

EPAM Systems

1668 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz