Senior Application Security Engineer (AI)

Ki; Greater London; On-site; GBP 90,000 - 140,000; Full time

Job summary

Ki is seeking a Senior Application Security Engineer in London to empower engineering and product teams to safely adopt AI and embed robust security controls across services and workflows. You will design cloud-native guardrails and automate processes to make secure paths the easiest path for builders.

You will protect the full development lifecycle from agentic AI integrations to everyday tools, collaborating across product groups, mentoring teams, and driving threat modelling, secure CI/CD

Qualifications

• Strong ability to write and review code (Python, TypeScript, Kotlin, Terraform) with background in software development, SRE, DevOps, or security engineering.
• In-depth understanding of securing AI/LLM apps, agentic tooling, and developer AI tools, including prompt injection mitigation, model risks, guardrails, telemetry, and frontier models via APIs or locally.
• Practical experience with agentic development using coding harnesses.
• Solid knowledge of cloud providers (GCP preferred; Azure or AWS beneficial) and network infrastructure.
• Solid understanding of Kubernetes, Docker, and container security.
• Experience implementing and managing security testing programs (SCA, SAST, DAST) in pipelines (GitHub Actions) and release management.
• Capability to develop secure, automated infrastructure using Terraform.
• Interest in both offensive and defensive security aspects.
• Ability to work collaboratively in enterprise-wide agile development environments.
• Outstanding written and verbal communication, able to explain vulnerabilities to technical teams and stakeholders, share knowledge, and mentor colleagues.

Responsibilities

• Provide practical implementation advice and guidance on securing AI-powered applications, aligning with OWASP ASVS and OWASP Top 10 for LLMs.
• Lead threat modelling sessions for AI and agentic systems during the design phase using STRIDE and AI-specific frameworks.
• Establish secure guardrails, allowlists, telemetry, and safe-by-default configurations for developer AI tooling.
• Manage security testing workflows in the SDLC, using scanners to check standard and AI-specific risks like prompt injection and data leakage.
• Coordinate regular penetration tests, vulnerability triage, and cloud security posture management across GCP and Azure.
• Automate security tasks by contributing code to infrastructure and security tooling around cloud platforms.
• Foster secure practices by leading the Security Champions network, coordinating security discussions, and delivering AI tooling safety training.
• Share expertise, document processes, and mentor team members to build security capability across engineering.
• Provide constructive feedback on Ki’s architecture and lead technical security discussions.

Skills

Python

TypeScript

Kotlin

Terraform

Threat modelling

DevOps

SRE

Security engineering

Communication

Tools

Google Cloud Platform

Azure

AWS

Kubernetes

Docker

GitHub Actions

SCA

SAST

DAST

Job description

Who are we?

Look at the latest headlines and you will see something Ki insures. Think space shuttles, world tours, wind farms, and even footballers’ legs.

Ki’s mission is simple. Digitally disrupt and revolutionise a 335-year-old market. Working with Google and UCL, Ki has created a platform that uses algorithms, machine learning and large language models to give insurance brokers quotes in seconds, rather than days.

Ki is proudly the biggest global algorithmic insurance carrier. It is the fastest growing syndicate in the Lloyd's of London market, and the first ever to make $100m in profit in 3 years.

Ki’s teams have varied backgrounds and work together in an agile, cross-functional way to build the very best experience for its customers. Ki has big ambitions but needs more excellent minds to challenge the status-quo and help it reach new horizons.

Where you come in?

As our Senior Application Security Engineer, you’ll empower our engineering and product teams to safely adopt AI and embed robust technical security controls directly into our services and workflows. By designing cloud-native security guardrails and automating processes, you’ll make the secure path the easiest path for our builders.

Your work will span our entire development lifecycle, protecting everything from agentic LLM integrations to the everyday tools we use. You’ll act as a trusted subject matter expert, collaborating closely across our product groups to foster a proactive, risk-conscious security culture. Through continuous mentorship and forward-thinking threat modelling, you’ll help us securely scale and drive a digital revolution in the global insurance market.

What you will be doing:

• Provide practical implementation advice and guidance on securing AI-powered applications, aligning with frameworks like OWASP ASVS and the OWASP Top 10 for LLM Applications.
• Lead threat modelling sessions for AI and agentic systems during the technical design phase using STRIDE and AI-specific frameworks.
• Establish secure guardrails, allowlists, telemetry, and safe-by-default configurations for developer AI tooling.
• Manage security testing workflows in the SDLC, utilizing scanners to check for standard and AI-specific risks such as prompt injection and data leakage.
• Coordinate regular penetration tests, vulnerability triage, and cloud security posture management across GCP and Azure platforms.
• Automate security tasks by contributing code to infrastructure and security tooling around our cloud platforms.
• Foster secure practices by facilitating the Security Champions network, organizing security discussions, and delivering AI tooling safety training.
• Share expertise, document processes, and mentor team members to build security capability across engineering.
• Provide constructive feedback on Ki’s architecture and lead technical security discussions.

• Strong ability to write and review code (preferably in Python, TypeScript, Kotlin and Terraform), with a background in software development, SRE, DevOps, or practical security engineering.
• In-depth understanding of securing AI/LLM applications, agentic tooling, and developer AI tools, including prompt injection mitigation, model integration risks, guardrails, telemetry, and the use of frontier models via APIs or locally.
• Practical experience with agentic development using coding harnesses is essential.
• Solid knowledge of major public cloud providers (preferably Google Cloud Platform, with Azure or AWS as beneficial) and network infrastructure.
• Solid understanding of the Kubernetes ecosystem, Docker, and container security.
• Experience implementing and managing security testing programs (SCA, SAST, DAST) within pipelines like GitHub Actions, alongside release packaging and artifact management.
• Capability to develop secure, automated infrastructure using Terraform.
• You enjoy learning about both the offensive and defensive aspects of security.
• Ability to work collaboratively within enterprise-wide agile development environments.
• Outstanding communication skills (both written and verbal), with the ability to explain complex vulnerabilities to technical teams and business stakeholders, share knowledge, and mentor colleagues.

Benefits

You’ll get a highly competitive remuneration and benefits package. This is kept under constant review to make sure it stays relevant. We understand the power of saying thank you and take time to acknowledge and reward extraordinary effort by teams or individuals.

What to expect during the recruitment process:

1. Initial recruiter screening call
2. Interview with hiring manager
3. Technical Interview (this may vary depending on the role)
4. Values Interview