Senior AI Security Engineer - LLM Vulnerability

Be Additive Corporation; Brasil; Vor Ort; BRL 180.000 - 320.000; Vollzeit

Zusammenfassung

Be Additive Corporation seeks experienced security engineers to evaluate static analysis detection on GenAI applications. You will create runnable agent/RAG codebases with vulnerabilities, fixed variants, and near-miss cases, tracing assets, data paths, controls, and root causes.

You will define authorization contexts and write deterministic tests to validate behavior, then recommend security controls. Ideal candidates have 5+ years in security-focused software engineering, hands-on experience

Qualifikationen

• 5+ years in application/product security or security-focused software engineering.
• Experience with source-to-sink analysis, taint analysis, SAST, CodeQL, or Semgrep.
• Hands-on experience building LLM agents or RAG systems using LangChain, LlamaIndex, OpenAI/Anthropic SDKs, or MCP.
• Strong authorization knowledge, including actors, trust boundaries, tenants, OAuth, IAM, identity, permitted data/actions, purposes, recipients, and document-level access control.
• Production coding experience in Python and/or TypeScript, with strong judgment in distinguishing genuine SID/EA findings from non-findings.

Aufgaben

• Evaluate how static analysis tools detect vulnerabilities in GenAI apps.
• Build runnable agent and RAG codebases with realistic vulnerabilities and fixed variants.
• Trace, annotate, test, and explain findings; define authorization contexts.
• Write deterministic tests validating vulnerable, fixed, and negative behavior.
• Recommend security controls and participate in calibration and peer review.

Kenntnisse

Python

TypeScript

Threat modeling

OAuth

IAM

Secure coding

Tools

CodeQL

Semgrep

SAST

LangChain

LlamaIndex

OpenAI SDK

Anthropic SDK

MCP

Jobbeschreibung

About the Role

We’re looking for experienced security engineers to evaluate how effectively static analysis tools detect vulnerabilities in GenAI applications. You’ll build small, runnable agent and RAG codebases containing realistic examples of Sensitive Information Disclosure and Excessive Agency, along with fixed and near‑miss versions. You’ll then trace, annotate, test, and explain each finding.

What You’ll Do

Build runnable agent/RAG repositories with code-reachable Sensitive Information Disclosure or Excessive Agency vulnerabilities across tool calling, memory, and MCP. Create vulnerable, fixed, and hard-negative variants with minimal security-relevant differences. Trace and annotate assets, data/action paths, controls, root causes, severity, and residual risk. Define authorization contexts and write deterministic tests validating vulnerable, fixed, and negative behavior. Recommend security controls and participate in calibration and peer review.

What We’re Looking For

5+ years in application/product security or security-focused software engineering, including secure code review. Experience with source-to-sink analysis, taint analysis, SAST, CodeQL, or Semgrep. Hands-on experience building LLM agents or RAG systems using frameworks such as LangChain, LlamaIndex, OpenAI/Anthropic SDKs, or MCP. Strong authorization knowledge, including actors, trust boundaries, tenants, OAuth, IAM, identity, permitted data/actions, purposes, recipients, and document-level access control. Production coding experience in Python and/or TypeScript, with strong judgment in distinguishing genuine SID/EA findings from non-findings. Experience with OWASP LLM security risks, MCP, threat modeling, or security evaluation is a plus.