[Hiring] Senior Application Security Engineer @Gramian Consulting Group

Role Description

We are looking for experienced Application Security Engineers and Security-Focused Software Engineers to support a specialized AI security evaluation project.

In this role, you will:

• Assess how effectively static analysis tools identify security vulnerabilities in Generative AI applications, particularly LLM agents and Retrieval-Augmented Generation (RAG) systems.
• Build small, runnable repositories containing realistic examples of Sensitive Information Disclosure (SID) and Excessive Agency (EA) vulnerabilities, alongside fixed and near-miss versions.
• Analyze code paths, identify security weaknesses, define authorization contexts, develop deterministic tests, and document findings.
• Help improve the reliability of security tools and strengthen how AI systems are evaluated for application-level vulnerabilities.

LOCATION: Remote

EXPERIENCE: 5+ years in application/product security or security-focused software engineering

PROJECT: GenAI application security evaluation and AI training

TECHNICAL FOCUS: Python, TypeScript, SAST, CodeQL, Semgrep, LLM agents, RAG, and MCP

AI EXPERIENCE: Hands-on experience building LLM agents or RAG applications is required.

Qualifications

• 5+ years of professional experience in application security, product security, or security-focused software engineering.
• Strong experience conducting secure code reviews and identifying application-level vulnerabilities.
• Practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST).
• Hands-on experience with security analysis tools such as CodeQL or Semgrep.
• Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.
• Familiarity with frameworks and technologies such as LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).
• Strong understanding of authorization models, including:
• Actors, identities, and trust boundaries.
• Multi-tenant authorization and access control.
• OAuth, IAM, and identity management.
• Permitted data access and actions.
• Purpose and recipient restrictions.
• Document-level access control.
• Production-level coding experience in Python and/or TypeScript.
• Ability to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.
• Strong analytical skills and the ability to communicate technical security findings clearly.

Requirements

• Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
• Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
• Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
• Evaluate static application security testing (SAST) tools and assess their ability to detect genuine vulnerabilities while avoiding false positives.
• Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
• Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
• Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
• Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
• Recommend appropriate security controls and remediation approaches.
• Participate in technical calibration, peer reviews, and quality assurance activities.

Company Description

Gramian Consultancy is a boutique consultancy specializing in IT professional services and engineering talent solutions. With a strong background in software engineering and leadership, we help companies build high-performing teams by matching them with professionals who truly fit their needs.