EPAM Systems

Lead AI Security Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnie·PoznańFull-time

#463619·Dodano 14 dni temu·1

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Application Securitythreat modelingSecure Code ReviewCI/CDSASTDASTSCASoftware Supply Chain Securitysecrets managementPrompt Engineering

Podsumowanie oferty

Secure software across the full development lifecycle, embedding security into design, code, build and release. Build AI-assisted AppSec automations and secure AI- and LLM-powered applications, working with engineering teams and CI/CD pipelines.

Wymagania

Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
Hands-on application security experience across the software development lifecycle.
Strong understanding of application vulnerability classes, mitigations, the OWASP Top 10, and secure coding principles.
Practical experience with application security tooling such as SAST, DAST, SCA, and secrets scanning, including integration with CI/CD.
Working knowledge of at least one programming language, such as Python, Java, C#, JavaScript, TypeScript, or Go, sufficient to read code and assess vulnerabilities.
Experience with threat modeling and secure design review methodologies.
Understanding of DevOps/DevSecOps, CI/CD pipelines, and secure-by-design principles.
Familiarity with cloud application security on at least one major cloud platform: Azure, AWS, or GCP.
Experience participating in several production projects or engineering teams.
Ability to work with developers, architects, QA engineers, DevOps, product, and security teams, and influence without owning the codebase.
Ability to follow, maintain, and improve defined security processes.
Practical understanding of AI-assisted productivity and automation, including some of: building or configuring AI agents; automating security or engineering tasks; integrating LLMs with tools, APIs, documents, or workflows; prompt engineering; creating AI-assisted runbooks, scripts, queries, or documentation; and secure use of AI tools with awareness of sensitive-data handling and access control.
Good communication skills and ability to explain security risks, technical decisions, and remediation plans to technical and non-technical stakeholders.

Nice to have:

Experience with application security tools such as Snyk, Checkmarx, Veracode, SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, or OWASP ZAP.
Experience with software supply chain security, including SBOM, SLSA, Sigstore, and dependency and artifact integrity controls.
Experience with Infrastructure as Code and policy-as-code tools such as Terraform, Bicep, ARM templates, OPA, Checkov, or Trivy.
Experience with container and Kubernetes security, including image scanning, registries, runtime protection, and network policies.
Experience with API security, secrets management such as HashiCorp Vault or Azure Key Vault, and microservice security patterns.
Understanding of a compliance or security framework such as ISO 27001, NIST, CIS Benchmarks, PCI DSS, HIPAA, SOC 2, or SOX.
Experience integrating security findings with SIEM/SOAR, ticketing, and vulnerability management workflows.
Experience with AI/LLM platforms or frameworks such as Azure OpenAI, Azure AI Foundry, Amazon Bedrock, Microsoft Copilot Studio, LangChain, or AutoGen.
Understanding of AI/LLM application security risks, including prompt injection, insecure output handling, data leakage, excessive agency, insecure tool use, model governance, and AI supply chain risks.
Security certifications such as CSSLP, GWAPT/GWEB, OSCP/OSWE, CISSP, CISM, or CCSP; AI-900 or AI-102 certifications are also a plus.

Obowiązki

Embed security across the software development lifecycle and promote shift-left and secure-by-design practices.
Perform and facilitate threat modeling, architecture security reviews, design reviews, and secure code reviews; advise developers on remediation.
Implement and operate application security tooling, including SAST, DAST, IAST, SCA, secrets scanning, and IaC scanning in CI/CD pipelines.
Triage and prioritize findings, reduce false positives, and work with development teams through remediation.
Define security gates and policies in CI/CD pipelines and secure the software supply chain, including dependencies, SBOM generation, artifact integrity, signing, and build pipelines.
Coordinate application penetration testing and validate vulnerability fixes.
Drive secrets management, secure configuration, API security, container and image security, and microservice security.
Establish a security champions program and deliver secure-coding training, guidelines, and reusable security patterns.
Maintain application security standards, baselines, and policy-as-code; contribute to vulnerability management and risk-acceptance processes.
Build and maintain AI-assisted automations and agentic workflows for AppSec tasks, including vulnerability triage, code review, threat modeling support, remediation guidance, and compliance evidence collection.
Integrate AI agents and LLM-backed automations into the SDLC and CI/CD pipelines using function calling, REST, and webhooks.
Develop and tune prompts and prompt templates; implement retrieval over codebases, security standards, and remediation guidance, such as RAG.
Add evaluation, validation, guardrails, and human approval checkpoints to AI-assisted AppSec workflows.
Implement security and privacy controls for AppSec AI usage, including least-privilege access, source-code and secrets handling, prompt-injection resistance, and auditability.
Design and operate security controls for AI- and LLM-powered application features, and define guardrails for secure AI adoption in product engineering.

Benefity

Career development programs, mentoring, soft skills, and well-being programs.
Certifications in Anthropic, Gemini, GCP, Azure, and AWS.
English classes.
Employee Stock Purchase Plan with a 15% discount.
Benefits package including health insurance, multisport, and shopping vouchers.
Referral bonuses up to $2,000.
Free snacks and coffee.
Corporate, social, and well-being events.

Pakiet relokacyjny

Kursy językowe

Udziały pracownicze

Ubezpieczenie

Karta sportowa

Premie

Darmowe przekąski

Napoje w biurze

Spotkania integracyjne

Inne informacje

Remote work is available within Poland; the offer also states an opportunity to work abroad for up to 60 days annually.

EPAM Systems

1648 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz