EPAM Systems

Lead AI Security Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnie·ŁódźFull-time

#463622·Dodano 14 dni temu·0

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

Application SecurityLLM SecuritySecure Code Reviewthreat modelingSASTDASTCI/CDSoftware Supply Chain Securitysecrets managementPrompt Engineering

Podsumowanie oferty

Secure software across the full development lifecycle, including AI- and LLM-powered applications. Build AI-assisted AppSec automations and integrate security into design, code, build, and release.

Wymagania

Bachelor's degree in Computer Science, Information Security, Engineering, or equivalent practical experience.
Hands-on application security experience across the software development lifecycle.
Strong understanding of common application vulnerability classes and mitigations, including the OWASP Top 10, and secure coding principles.
Practical experience with application security tooling such as SAST, DAST, SCA, and secrets scanning, and integrating it into CI/CD.
Working knowledge of at least one programming language, such as Python, Java, C#, JavaScript/TypeScript, or Go, sufficient to read code and assess vulnerabilities.
Experience with threat modeling and secure design review methodologies.
Understanding of DevOps/DevSecOps, CI/CD pipelines, and secure-by-design principles.
Familiarity with cloud application security concepts on at least one major cloud platform, such as Azure, AWS, or GCP.
Experience participating in several production projects or engineering teams.
Ability to work with developers, architects, QA engineers, DevOps, product, and security teams, and to influence without owning the codebase.
Ability to follow, maintain, and improve defined security processes.
Practical understanding of AI-assisted productivity and automation beyond basic chatbot usage, including some experience with AI agents, task automation, integrating LLMs with tools or workflows, prompt engineering, AI-assisted runbooks or documentation, and secure AI tool usage.
Good communication skills and ability to explain security risks, technical decisions, and remediation plans to technical and non-technical stakeholders.

Nice to have:

Experience with application security tools such as Snyk, Checkmarx, Veracode, SonarQube, Semgrep, GitHub Advanced Security, Burp Suite, or OWASP ZAP.
Experience with software supply chain security, including SBOM, SLSA, Sigstore, and dependency and artifact integrity controls.
Experience with Infrastructure as Code and policy-as-code tools such as Terraform, Bicep, ARM templates, OPA, Checkov, or Trivy.
Experience with container and Kubernetes security, including image scanning, registries, runtime protection, and network policies.
Experience with API security, secrets management such as HashiCorp Vault or Azure Key Vault, and microservice security patterns.
Understanding of at least one compliance or security framework, such as ISO 27001, NIST, CIS Benchmarks, PCI DSS, HIPAA, SOC 2, or SOX.
Experience integrating security findings with SIEM/SOAR, ticketing, and vulnerability management workflows.
Experience with AI/LLM platforms or frameworks such as Azure OpenAI, Azure AI Foundry, Amazon Bedrock, Microsoft Copilot Studio, LangChain, or AutoGen.
Understanding of AI and LLM application security risks, including prompt injection, insecure output handling, data leakage, excessive agency, insecure tool use, model governance, and AI supply chain risks.
Security certifications such as CSSLP, GWAPT/GWEB, OSCP/OSWE, CISSP, CISM, or CCSP; AI-related certifications such as AI-900 or AI-102 are a plus.

Obowiązki

Embed security into the software development lifecycle and promote shift-left and secure-by-design practices.
Perform and facilitate threat modeling, architecture security reviews, and design reviews for applications, services, and APIs.
Conduct manual and AI-assisted secure code reviews; advise developers on secure coding and remediation.
Implement and operate application security tooling, including SAST, DAST, IAST, SCA, secrets scanning, and IaC scanning integrated with CI/CD.
Triage, validate, prioritize, and reduce false positives in security findings; work with development teams through remediation.
Define security gates and policies in CI/CD pipelines.
Secure the software supply chain through dependency and open-source risk management, SBOM generation, artifact integrity and signing, and build pipeline hardening.
Coordinate application penetration testing and validate fixes.
Drive secrets management, secure configuration, API security, container and image security, and microservice security practices.
Establish a security champions program and deliver secure-coding training, guidelines, and reusable security patterns.
Maintain application security standards, baselines, and policy-as-code; contribute to vulnerability management and risk-acceptance processes.
Build and maintain AI-assisted automations and agentic workflows for AppSec activities, including vulnerability triage, code review, threat modeling, finding enrichment, remediation drafting, compliance evidence collection, and documentation automation.
Integrate AI agents and LLM-backed automations into the SDLC and CI/CD pipelines, connecting models to scanners, code hosts, ticketing, and security tooling through function calling, REST, and webhooks.
Develop and tune reusable prompts and prompt templates for AppSec tasks.
Implement retrieval over codebases, security standards, and remediation guidance, such as RAG.
Build evaluation, validation, guardrails, and human-in-the-loop checkpoints into AI-assisted AppSec workflows.
Implement security and privacy controls for AppSec AI usage, including least-privilege agent access, source-code and secrets handling, prompt-injection resistance, and auditability.
Design and operate security controls for AI- and LLM-powered application features, including input and output validation, prompt-injection and jailbreak defenses, tool-call authorization, rate limiting, and model and data access governance aligned with the OWASP Top 10 for LLM Applications.
Define guardrails for secure AI adoption in product engineering and advise teams on building AI features securely.

Benefity

Career development programs.
Thought leadership, mentoring, soft skills, and well-being programs.
Certifications in Anthropic, Gemini, GCP, Azure, and AWS.
English classes.
Employee Stock Purchase Plan with a 15% discount.
Benefits package including health insurance and multisport.
Shopping vouchers.
Referral bonuses up to $2,000.
Offices with entertainment and relaxation zones, table tennis, football, free snacks, and coffee.
Corporate, social, and well-being events.
Business-driven relocation opportunities.

Pakiet relokacyjny

Kursy językowe

Ubezpieczenie

Karta sportowa

Udziały pracownicze

Premie

Darmowe przekąski

Spotkania integracyjne

Inne informacje

Remote work is available within Poland.
Opportunity to work abroad for up to 60 days annually.

EPAM Systems

1648 aktywnych ofert

Zobacz wszystkie oferty

Aplikuj teraz