Senior AI Security Engineer | Remote

Curvia AI; India; Remote; INR 1,200,000 - 1,800,000; Full time

Job summary

Curvia AI is seeking an experienced security engineer to assess how static analysis detects vulnerabilities in GenAI apps. You will build runnable agent and RAG codebases with realistic vulnerabilities, then trace, annotate, test, and explain findings to improve detection and resilience.

Responsibilities include creating vulnerable, fixed, and near-miss variants, mapping data flows, and defining authorization contexts, while contributing to security controls and peer review.

Qualifications

• 5+ years in application security or security-focused software engineering.
• Experience with source-to-sink taint analysis, SAST, CodeQL or Semgrep.
• Hands-on experience building LLM agents or RAG systems.
• Strong authorization knowledge including OAuth, IAM, trust boundaries.
• Production coding in Python and/or TypeScript with good findings judgment.
• OWASP LLM security risks, MCP, threat modelling or security evaluation is a plus.

Responsibilities

• Build runnable agent/RAG repositories with code-reachable vulnerabilities across tool calling, memory, and MCP.
• Create vulnerable, fixed, and hard-negative variants with minimal security differences.
• Trace and annotate assets, data paths, controls, root causes, severity and residual risk.
• Define authorization contexts and write deterministic tests validating behaviors.
• Recommend security controls and participate in calibration and peer review.

Skills

SAST

CodeQL

Semgrep

LangChain

LlamaIndex

OpenAI SDK

Anthropic SDK

MCP

OAuth

IAM

Python

TypeScript

Threat Modelling

OWASP LLM Security

Security Evaluation

Job description

Curvia AI is a London, UK-based technology and AI solutions company that transforms complexity into opportunity through enterprise solutions, AI-powered automation, and data-driven insights. We build practical, scalable, and human-centered technology grounded in integrity, security, and responsible innovation.

About the Role

We’re looking for experienced security engineers to evaluate how effectively static analysis tools detect vulnerabilities in GenAI applications. You’ll build small, runnable agent and RAG codebases containing realistic examples of Sensitive Information Disclosure and Excessive Agency, along with fixed and near-miss versions. You’ll then trace, annotate, test, and explain each finding.

• Commitments Required: Full-time 40h per week with 4 hours PST overlap.
• Employment type: Contractor assignment (no medical/paid leave)
• Years of Experience: 5+ years of professional experience.

What We’re Looking For

• 5+ years in application/product security or security-focused software engineering, including secure code review.
• Experience with source-to-sink analysis, taint analysis, SAST, CodeQL, or Semgrep.
• Hands-on experience building LLM agents or RAG systems using frameworks such as LangChain, LlamaIndex, OpenAI/Anthropic SDKs, or MCP.
• Strong authorisation knowledge, including actors, trust boundaries, tenants, OAuth, IAM, identity, permitted data/actions, purposes, recipients, and document-level access control.
• Production coding experience in Python and/or TypeScript, with strong judgment in distinguishing genuine SID/EA findings from non-findings.
• Experience with OWASP LLM security risks, MCP, threat modelling, or security evaluation is a plus.

What You’ll Do

• Build runnable agent/RAG repositories with code-reachable Sensitive Information Disclosure or Excessive Agency vulnerabilities across tool calling, memory, and MCP.
• Create vulnerable, fixed, and hard-negative variants with minimal security-relevant differences.
• Trace and annotate assets, data/action paths, controls, root causes, severity, and residual risk.
• Define authorisation contexts and write deterministic tests validating vulnerable, fixed, and negative behaviour.
• Recommend security controls and participate in calibration and peer review.