Senior AI Security Engineer - LLM Vulnerability

Codefeast; Meerut; Hybrid; INR 1,200,000 - 2,400,000; Full time

Job summary

Codefeast is seeking an AI Security Engineer to safeguard AI-powered applications, focusing on sensitive information disclosure and excessive agency vulnerabilities. You will build secure AI agent and RAG codebases and conduct thorough security reviews.

You will identify LLM vulnerabilities across tool calling, agent memory, and MCP, perform deterministic tests on SAST tooling, and advise on remediation strategies to reduce risk across multi-tenant environments.

Qualifications

• Experience in Application Security, Product Security, or Security Engineering.
• Strong programming skills in Python and/or TypeScript.
• Hands-on experience with LLM agents and RAG applications.
• Familiarity with LangChain, LlamaIndex, OpenAI/Anthropic SDKs, or MCP.
• Experience with CodeQL, Semgrep, SAST, and secure code review.
• Knowledge of OAuth, IAM, authorization, multi-tenancy, and access controls.
• Understanding of Sensitive Information Disclosure and Excessive Agency Vulnerabilities.

Responsibilities

• Build and test vulnerable and secure AI agent/RAG codebases.
• Identify LLM vulnerabilities across tool calling, agent memory, and MCP.
• Perform secure code reviews, source-to-sink analysis, and taint analysis.
• Evaluate SAST tools and validate findings through deterministic tests.
• Analyze authorization, access controls, data flows, and security boundaries.
• Recommend security fixes and remediation strategies.

Skills

Python

TypeScript

LLM agents

Application Security

Secure coding

OAuth/IAM

Multi-tenancy

Vulnerability assessment

Tools

LangChain

LlamaIndex

OpenAI SDK

Anthropic SDK

MCP

CodeQL

Semgrep

SAST

Job description

We are looking for AI Security Engineers with expertise in application security, product security, and GenAI/LLM security to identify and evaluate vulnerabilities in AI-powered applications, particularly Sensitive Information Disclosure (SID) and Excessive Agency (EA).

Responsibilities:

• Build and test vulnerable and secure AI agent/RAG codebases.
• Identify LLM vulnerabilities across tool calling, agent memory, and MCP.
• Perform secure code reviews, source-to-sink analysis, and taint analysis.
• Evaluate SAST tools and validate findings through deterministic tests.
• Analyze authorization, access controls, data flows, and security boundaries.
• Recommend security fixes and remediation strategies.

Requirements:

• Experience in Application Security, Product Security, or Security Engineering.
• Strong programming skills in Python and/or TypeScript.
• Hands-on experience with LLM agents and RAG applications.
• Familiarity with LangChain, LlamaIndex, OpenAI/Anthropic SDKs, or MCP.
• Experience with CodeQL, Semgrep, SAST, and secure code review.
• Knowledge of OAuth, IAM, authorization, multi-tenancy, and access controls.
• Understanding of Sensitive Information Disclosure and Excessive Agency Vulnerabilities.

Good to Have:

• OWASP Top 10 for LLM Applications.
• MCP security and AI agent threat modeling.
• Prompt injection and RAG security.
• AI security evaluation experience.