Staff AI Security Engineer

AGODA COMPANY PTE. LTD.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Agoda is seeking an AI Security Engineer to join the AppSec Engineering team. You will design and operate AI-powered security systems, focusing on secure-by-design AI agents and scalable threat modeling across design reviews.

This role requires hands-on security engineering, knowledge of LLM risks, and experience securing agentic, production-grade systems. You will partner with product, data, and engineering teams and stay ahead of industry frameworks.

Qualifications

• 3+ years SDLC experience in Python, Go, TypeScript/Node.js, Kotlin or similar.
• 6+ years of experience in security engineering, AppSec, threat modeling, secure coding, IAM, or cloud security.
• 2+ years of cloud security and 1+ year building LLM applications, agents, MCP integrations, or evaluation pipelines.

Responsibilities

• Design, build, and operate AI-powered security engineering systems, end-to-end in production.
• Build AI-assisted threat modeling from design docs, flag high-risk changes, route reviews.
• Harden AI developer platforms (Cursor, Codex, Claude) and implement governance controls.
• Lead security design reviews and threat modeling for AI systems and agents.
• Define and implement security controls and guardrails for AI agents (identity, credentials, least privilege, sandboxing, human-in-the-loop).
• Develop defenses against AI-specific threats (prompt injection, data exfiltration, insecure output handling).
• Build agentic security tooling to automate AppSec workflows from intake to remediation.
• Measure and improve tooling quality (precision, coverage, false positives) and share learnings across teams.
• Collaborate with product, platform, data, and AI engineering as embedded security owner.
• Stay ahead of AI security research and industry frameworks.

Skills

Python

Go

TypeScript/Node.js

Kotlin

Security engineering

AppSec

Threat modeling

IAM

Cloud security

LLM security

Red-teaming

Job description

About Agoda

At Agoda, we bridge the world through travel. Our story began in 2005, when two lifelong friends and entrepreneurs, driven by their passion for travel, launched Agoda to make it easier for everyone to explore the world.Today, we are part of Booking Holdings [NASDAQ: BKNG], with a diverse team of over 7,000 people from 90 countries, working together in offices around the globe. Every day, we connect people to destinations and experiences, with our great deals across our millions of hotels and holiday properties, flights, and experiences worldwide.No two days are the same at Agoda. Data and technology are at the heart of our culture, fueling our curiosity and innovation. If you're ready to begin your best journey and help build travel for the world, join us.

Get to Know Our Team

The Security Department oversees application security, compliance, GRC, and security operations for all Agoda. We are vigilant in ensuring there is no breach or vulnerability threatening our company or endangering our employees in order to keep Agoda safe and protected. This would be a great challenge for those who want to work with the best technology in a dynamic and advanced environment.

The Opportunity

You will be joining the AppSec Engineering team at a pivotal moment: AI is changing both how we defend Agoda and what we need to defend. As an AI Security Engineer, you will build AI-powered security engineering capabilities that let a lean team secure a fast paced DevSecOps environment where code ships continuously, and you will make sure the AI systems and agents Agoda builds are secure by design. This is a builder's role with a primary focus on security engineering and threat modeling: you will ship and own production systems, not just own one-off scripts.

What You Will Do

• Design, build, and operate AI-powered security engineering systems, such as LLM-driven secure code review, finding triage and de-duplication, and automated fix suggestions, and own them end-to-end in production.
• Build AI-assisted threat modeling that scales our design reviews: drafting threat models from design docs and architecture, flagging high-risk changes, and routing the reviews that need a human in the room.
• Harden the AI developer platforms our engineers use every day, such as Cursor, Codex and Claude, always-on agent platforms including MCP/plugin governance and policy controls.
• Lead security design reviews and threat modeling for the AI systems and agents built at Agoda, including LLM-integrated products, RAG pipelines, MCP/tool integrations, and internal agentic platforms.
• Define and implement security controls and guardrails for AI agents: agent identity and delegated credentials, least-privilege tool access, sandboxing, human-in-the-loop approval for risky actions, and audit logging.
• Develop defenses against AI-specific threats such as prompt injection, data exfiltration through tools, insecure output handling, and model and supply chain risks, and turn them into secure-by-default patterns and standards for engineering teams.
• Build agentic security tooling that automates AppSec workflows end-to-end, from intake and risk scoring to ticketing and remediation tracking, keeping outcomes measurable, auditable, and safe.
• Measure and continuously improve the quality of our AI security tooling (precision, coverage, false-positive rate) by tuning models, prompts, and pipelines.
• Partner with product, platform, data, and AI engineering teams as an embedded security owner, and work closely with AppSec analysts to turn their findings into scalable, automated fixes.
• Stay ahead of AI security research and industry frameworks, and share what you learn across Agoda's engineering community.

What You Will Bring

• Software engineering: 3+ years of SDLC experience in Python, Go, TypeScript/Node.js, Kotlin, or similar, building and operating production systems.
• Security: 6+ years of relevant experience in security engineering, AppSec, threat modeling, secure coding, IAM, software development, or cloud security. Knowledge of secure distributed systems, OWASP Top 10, OAuth 2.0/OIDC, service authentication, and least privilege.
• Cloud and AI security: 2+ years of cloud security experience and 1+ year building LLM applications, agents, MCP integrations, RAG, or evaluation pipelines. Familiarity with key LLM risks and OWASP Top 10 for LLM Applications or MITRE ATLAS.
• Security Knowledge: Applies an offensive security mindset to identify, validate, and assess vulnerabilities in applications and AI systems. Uses threat modeling and security testing to recommend practical mitigations.

It is Great if You Have

• Experience securing agentic, code-execution, or LLM-integrated systems in production (sandboxing, isolation, guardrails).
• Experience building developer-facing security tooling or security automation integrated into CI/CD.
• Experience with LLM evaluation or red-teaming of AI systems, or contributi