AI-Driven AppSec Engineer – Cloud Security & AI Tools

Karbon; San Francisco (CA); On-site; USD 131,000 - 169,000; Full time

Benefits offered by this job

Flexible Time Off

Company paid medical for you and anysp

Paid dental and vision for dependents

401(k) with company matching

Flexible Spending Account

Up to 8 weeks paid parental leave

Work-from-home stipend

Job summary

Karbon seeks an AppSec Engineer to join our expanding security team, focusing on development and cloud security with AI integration.

You will promote secure coding practices across feature design, reviews, and threat modelling, while collaborating with product and engineering teams. The role requires strong communication, cloud security experience, and hands-on work securing AI-enabled applications, APIs, and pipelines.

Qualifications

• Strong communication and collaboration across teams to embed security in development.
• Experience securing web apps, APIs, and AI-enabled systems; knowledge of threat modelling.
• Familiarity with cloud security (Azure preferred) and secure SDLC practices.

Responsibilities

• Embed security from start in feature design and development.
• Balance security with delivery, communicating risks to non-technical stakeholders.
• Review AI tooling usage and AI-generated code for risks.
• Apply AI-assisted tooling to accelerate security work (triage, detection, review).
• Collaborate with external pen testers and refine security roadmap.

Skills

Strong communication skills

Security mindset

Collaboration across teams

Problem solving

Ability to communicate security risks

Proactive learning

Education

Security certifications (OSCP/AWAE, GIAC, Burp Practitioner, PJPT, MS/AWS)

Tools

Microsoft .NET/C#

JavaScript (React/EmberJS)

Python

Azure

AWS / GCP

PowerShell / Bash

AI tooling (Claude Code, GitHub Copilot)

Burp Suite / SAST / DAST tooling

Job description

Karbon seeks an AppSec Engineer to join our expanding security team, focusing on development and cloud security with AI integration.

You will promote secure coding practices across feature design, reviews, and threat modelling, while collaborating with product and engineering teams. The role requires strong communication, cloud security experience, and hands-on work securing AI-enabled applications, APIs, and pipelines.