AI Security Engineer / Product Security Engineer

Techolution LLC; India; À distance; INR 11 439 000 - 14 299 000; Plein temps

Résumé du poste

Techolution LLC is seeking a Product Security Engineer to strengthen enterprise AI-powered products. This remote, full-time role requires hands-on security testing of web applications and APIs, plus expertise in securing AI-enabled workflows and RAG pipelines.

You'll own vulnerabilities from discovery through remediation, collaborate with engineering teams, and help shape secure SDLC practices across CI/CD pipelines while delivering weekly risk-focused reports to leadership.

Qualifications

• Hands-on experience in Application or Product Security with OWASP Top 10 knowledge.
• Proficient in Burp Suite or OWASP ZAP and manual testing.
• Experience with cloud IAM, containers, Kubernetes, CI/CD security.
• Ability to investigate attack paths beyond scanners.
• Strong ability to communicate risks to engineers and leadership.

Responsabilités

• Perform hands-on testing of web apps and APIs to uncover vulnerabilities.
• Assess AI-powered applications, RAG pipelines, and multi-agent workflows for security risks.
• Validate findings with Burp Suite, ZAP, and source-code reviews, and reproduce attack paths.
• Identify cloud security weaknesses across IAM, configurations, and CI/CD.
• Own findings through remediation and retesting with engineering teams.
• Develop security automation and integrate controls into CI/CD pipelines.
• Collaborate with developers and platform teams to embed secure design practices.
• Provide weekly security reports on risk, severity, and progress.
• Continuously improve security by adapting to evolving threats.

Connaissances

App & API Security

Penetration Testing

GenAI Security

Exploit Reasoning

Source-Code Review

Cloud-Native Security

Vulnerability Management

Security Automation

Secure SDLC

Technical Communication

Description du poste

At Techolution, we build enterprise AI-powered solutions that automate complex business processes and deliver measurable business outcomes. As our AI capabilities expand, securing applications, APIs, cloud environments, and intelligent AI-agent workflows is critical to protecting our products, customers, and enterprise data.

Title : Product Security Engineer

Location :Remote Work

Employment Type: Full-time

Exp Range : 2+ Years

Key Responsibilities:

• Application & API Security: Conduct hands-on penetration testing of web applications and APIs. Identify, exploit, and validate vulnerabilities involving authentication, authorization, access control, injection, business logic, and OWASP Top 10 risks. Go beyond automated scanner findings to independently discover and demonstrate exploitable attack paths.
• AI & Agent Security: Perform hands-on security assessments of LLM-powered applications, RAG pipelines, and AI-agent and multi-agent workflows. Investigate indirect prompt injection, sensitive data exfiltration, RAG poisoning, authorization and trust-boundary bypasses, excessive agent permissions, privilege escalation, and unsafe tool execution. Demonstrate practical attack scenarios and assess their impact on enterprise data, systems, and business workflows.
• Exploit Validation & Root-Cause Analysis: Use Burp Suite or OWASP ZAP, HTTP traffic analysis, manual testing, and source-code review to investigate vulnerabilities. Reproduce attack paths, validate actual impact, identify root causes, and recommend actionable technical fixes rather than relying solely on scan reports.
• Cloud & Infrastructure Security: Identify and validate security weaknesses involving cloud IAM, application configurations, containers, Kubernetes/GKE, repositories, secrets management, and CI/CD pipelines. Investigate how infrastructure and application weaknesses could be chained into broader attacks.
• Vulnerability Ownership & Remediation: Own security findings from discovery through verified closure. Prioritize vulnerabilities based on exploitability, exposure, severity, and business impact. Work directly with engineering teams to implement fixes, retest remediation, and ensure that vulnerabilities are properly resolved.
• Security Automation & Prevention: Develop and improve repeatable security testing workflows. Automate relevant vulnerability checks and integrate preventive security controls into development and CI/CD pipelines. Help detect recurring engineering mistakes and prevent vulnerabilities before code reaches production.
• Secure SDLC & Engineering Collaboration: Partner with developers, architects, and platform teams to incorporate security into application design, code development, testing, and deployment. Promote secure coding practices, effective security gates, and practical controls that reduce recurring vulnerabilities.
• Security Reporting & Risk Reduction: Maintain visibility into discovered, validated, open, and remediated vulnerabilities. Provide weekly security reports covering attack paths, severity, business impact, remediation status, recurring weaknesses, and measurable progress in reducing product security risk.
• Continuous Security Improvement: Proactively assess evolving threats to enterprise applications and AI-powered systems, identify gaps in existing security controls, and recommend improvements to the organization's security testing and prevention capabilities. Contribute to building scalable security practices as the product and security function grow.

Qualifications:

• Application & API Security: Proven hands-on experience in Application Security or Product Security, with strong knowledge of web application security, API security, OWASP Top 10, authentication, authorization, access control, injection, and business logic vulnerabilities.
• Manual Penetration Testing: Ability to independently identify, exploit, validate, and document real-world vulnerabilities using Burp Suite, OWASP ZAP, HTTP traffic analysis, and other relevant security testing techniques. Must be comfortable investigating attack paths beyond automated scanner output.
• AI & GenAI Security: Practical understanding of security risks in LLM-powered applications, RAG pipelines, and AI-agent workflows, including direct and indirect prompt injection, sensitive data leakage, RAG poisoning, authorization bypasses, trust-boundary violations, excessive permissions, and unsafe tool execution.
• Exploit Reasoning & Technical Validation: Ability to explain an attacker’s approach, reproduce vulnerabilities, demonstrate technical impact, distinguish theoretical weaknesses from exploitable issues, and identify the underlying cause of a security finding.
• Source-Code Review & Remediation: Ability to review application code, trace vulnerabilities to their root causes, and recommend practical fixes that engineering teams can implement and validate.
• Cloud-Native & DevSecOps Security: Working knowledge of cloud security, IAM, containers, Kubernetes/GKE, GitHub repositories, secrets management, and CI/CD pipelines, including identifying security weaknesses across application infrastructure and software delivery workflows.
• Vulnerability Management & Ownership: Experience prioritizing security findings based on exploitability, exposure, severity, and business impact; collaborating with developers on remediation; retesting fixes; and driving vulnerabilities to verified closure.
• Security Automation & Secure SDLC: Familiarity with SAST, DAST, and SCA tools, security gates, and integrating practical security controls into development and deployment pipelines. Ability to identify opportunities to automate recurring security checks and prevent regressions.
• Enterprise Product Security: Ability to assess multiple applications, repositories, or products independently, work across engineering teams, and investigate security issues in a fast-paced product development environment.
• Technical Communication & Reporting: Ability to clearly communicate exploitation paths, technical findings, business risks, remediation recommendations, and security progress to engineers and leadership.