AI Application Security Engineer

Wintermeyer Ventures; San Francisco (CA); Remote; USD 220,000 - 300,000; Full time

Job summary

Wintermeyer Ventures seeks a security-focused engineer to own application and product security for AI products used in regulated environments. You will partner with product and ML engineers to bake security into agentic workflows, integrations, and the development lifecycle.

The role requires hands-on coding in Python, Go, or TypeScript, strong security fundamentals, and experience with compliance frameworks.

Qualifications

• At least 5 years of application or product security experience on production systems at scale.
• Hands-on coding with Python, Go, or TypeScript for security tooling and automation.

Responsibilities

• Set secure development standards for authentication, authorization, secrets management, input handling, and secure-by-default patterns.
• Integrate security reviews and automated checks into code review, CI/CD pipelines, and pre-deployment workflows.
• Threat-model product features and translate risks into practical controls.
• Build security tooling and automated code analysis using AI to extend review coverage.
• Define how agents are scoped and authorized, including trust boundaries with external systems and APIs.
• Develop secure integration patterns for credential storage, response validation, and limiting agent actions.
• Work with product and ML engineers on tool permissions, output validation, and safe handling of user context across workflows.
• Create reusable agent security guidelines, review checklists, and code-level guardrails.

Skills

Python

Go

TypeScript

OWASP Top 10

AuthN/AuthZ

Secure SDLC

Secrets management

Cryptography basics

Agentic AI security

Compliance familiarity

Education

Bachelor's degree in Computer Science

Job description

About the Role

Own application and product security for AI products used in regulated environments. You will partner with product and machine learning engineers to build security into agentic workflows, integrations, and the development lifecycle.

What You'll Do

• Set secure development standards for authentication, authorization, secrets management, input handling, and secure-by-default patterns.
• Integrate security reviews and automated checks into code review, CI/CD pipelines, and pre-deployment workflows.
• Threat-model product features and translate identified risks into practical controls.
• Build security tooling and automated code analysis using AI to extend review coverage.
• Define how agents are scoped and authorized, including trust boundaries with external systems and APIs.
• Develop secure integration patterns for credential storage, response validation, and limiting agent actions.
• Work with product and ML engineers on tool permissions, output validation, and safe handling of user context across workflows.
• Create reusable agent security guidelines, review checklists, and code-level guardrails.

What We're Looking For

• At least 5 years of application or product security experience on production systems at scale.
• Recent hands-on coding experience and proficiency in Python, Go, or TypeScript for security tooling and automation.
• Strong application security fundamentals, including OWASP Top 10, AuthN/AuthZ, secure SDLC, secrets management, integration security, and cryptography basics.
• Understanding of product-layer security risks in agentic AI, including agent design, scoping, and risk review.
• Familiarity with compliance frameworks relevant to government and healthcare, such as FedRAMP, HIPAA, SOC 2, or ISO 27001.
• A computer science degree or equivalent experience.

Compensation & Benefits

Base salary: $220,000 to $300,000 annually. Visa sponsorship is available.

Location

On-site in San Francisco, California, or remote within the United States.