Senior Application Security Engineer - GenAI Security Evaluation

Gramian Consulting Group; Indonesia; Remote; IDR 2,169,590,000 - 3,254,384,000; Full time

Job summary

Gramian Consultancy is seeking a Senior Application Security Engineer to lead GenAI security evaluation efforts. You will assess static analysis tools against LLM agents and RAG applications, building runnable samples showing SID and EA vulnerabilities, with deterministic tests and documented findings.

You will analyze data flows, authentication contexts, and authorization models, ensuring robust security controls and clear remediation guidance across multi-tenant environments.

Qualifications

• 5+ years of professional experience in application security, product security, or security-focused software engineering.
• Strong experience conducting secure code reviews and identifying application-level vulnerabilities.
• Hands-on experience building LLM agents or RAG applications.
• Production-level coding experience in Python and/or TypeScript.
• Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).

Responsibilities

• Build runnable agent and RAG repositories containing code-reachable vulnerabilities (SID/EA).
• Develop realistic security scenarios involving tool calling, agent memory, MCP, and LLM components.
• Create vulnerable, fixed, and negative code variants with minimal security differences.
• Evaluate SAST tools and assess their accuracy in detecting real vulnerabilities.
• Perform source-to-sink analysis and trace data flows, action paths, and trust boundaries.
• Annotate findings with assets, root causes, controls, severity, and residual risk.
• Define authorization contexts covering actors, tenants, identities, data, actions, purposes, recipients.
• Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
• Recommend security controls and remediation approaches.
• Participate in calibration, peer reviews, and QA activities.

Skills

Secure code reviews

SAST tooling

Python

TypeScript

LLM agents

RAG apps

OAuth/IAM

Tools

CodeQL

Semgrep

LangChain

LlamaIndex

OpenAI SDK

Anthropic SDK

MCP

Job description

Senior Application Security Engineer - GenAI Security Evaluation

Gramian Consultancy is a boutique consultancy specializing in IT professional services and engineering talent solutions. With a strong background in software engineering and leadership, we help companies build high-performing teams by matching them with professionals who truly fit their needs.

About the Role

We are looking for experienced Application Security Engineers and Security-Focused Software Engineers to support a specialized AI security evaluation project.

In this role, you will assess how effectively static analysis tools identify security vulnerabilities in Generative AI applications, particularly LLM agents and Retrieval-Augmented Generation (RAG) systems. You will build small, runnable repositories containing realistic examples of Sensitive Information Disclosure (SID) and Excessive Agency (EA) vulnerabilities, alongside fixed and near-miss versions.

You will analyze code paths, identify security weaknesses, define authorization contexts, develop deterministic tests, and document findings. Your work will help improve the reliability of security tools and strengthen how AI systems are evaluated for application-level vulnerabilities.

LOCATION: Remote

EXPERIENCE: 5+ years in application/product security or security-focused software engineering

PROJECT: GenAI application security evaluation and AI training

TECHNICAL FOCUS: Python, TypeScript, SAST, CodeQL, Semgrep, LLM agents, RAG, and MCP

AI EXPERIENCE: Hands-on experience building LLM agents or RAG applications is required.

Key Responsibilities

• Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
• Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
• Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
• Evaluate static application security testing (SAST) tools and assess their ability to detect genuine vulnerabilities while avoiding false positives.
• Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
• Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
• Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
• Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
• Recommend appropriate security controls and remediation approaches.
• Participate in technical calibration, peer reviews, and quality assurance activities.

Requirements

• 5+ years of professional experience in application security, product security, or security-focused software engineering.

Strong experience conducting secure code reviews and identifying application-level vulnerabilities.

Practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST).

Hands-on experience with security analysis tools such as CodeQL or Semgrep.

Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.

Familiarity with frameworks and technologies such as LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).

Strong understanding of authorization models, including:

Actors, identities, and trust boundaries.

Multi-tenant authorization and access control.

OAuth, IAM, and identity management.

Permitted data access and actions.

Purpose and recipient restrictions.

Document-level access control.

Production-level coding experience in Python and/or TypeScript.

Ability to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.

Strong analytical skills and the ability to communicate technical security findings clearly.