Senior AI Security Analyst & AppSec Leader

AGODA COMPANY PTE. LTD.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Agoda is seeking a Staff AI Security Analyst to augment day-to-day application security with AI. You will own production-grade AI tooling, lead AI-assisted vulnerability management, and coordinate zero-day responses within a fast-paced DevSecOps environment.

You will mentor the team, ship automation-first security solutions, and collaborate with engineering to strengthen security across web, API, and mobile applications.

Qualifications

• 6 to 10 years of experience in application security, product security, or offensive security, with strong web and API penetration testing skills and hands on vulnerability management at scale.
• Vulnerability triage and prioritization using CVSS, EPSS, KEV, and business context.

Responsibilities

• Vulnerability management: Own daily triage of scanner findings, bug bounty, and pentest results; prioritize fixes and drive closure within SLA.
• Zero-day response: Assess exposure to zero-day vulnerabilities and coordinate urgent patching with engineering teams.
• Penetration testing: Lead manual and AI-assisted pentests of web, API, and mobile apps; verify AI findings by hand.
• Automated security testing: Design CI/CD security checks and monitor AI-driven testing priorities.
• AI tooling for AppSec: Build and own production AI agents to automate AppSec tasks and measure improvements.
• Leadership and mentorship: Guide AI AppSec roadmap and mentor junior analysts to raise AI fluency.

Skills

Application security

Penetration testing

Vulnerability management

AI security

Leadership

Tools

Python

LLM APIs

Code search

Job description

Agoda is seeking a Staff AI Security Analyst to augment day-to-day application security with AI. You will own production-grade AI tooling, lead AI-assisted vulnerability management, and coordinate zero-day responses within a fast-paced DevSecOps environment.

You will mentor the team, ship automation-first security solutions, and collaborate with engineering to strengthen security across web, API, and mobile applications.