Lead AI Security Engineer — Enterprise AppSec Platform

Decagon; New York (NY); On-site; USD 200,000 - 400,000; Full time

Benefits offered by this job

Medical, Dental, and Vision benefits

Life Insurance and Disability Benefits

401K or pension

Job summary

Decagon is seeking a Senior Security Engineer to lead the application security strategy for our AI-powered conversational platform. You will embed security into products across design, code, and deployment, collaborating with engineering teams to protect enterprise customers at scale.

You will drive threat modeling, secure coding practices, and vulnerability management, establish testing programs (SAST/DAST/IAST), review architecture, and build automation to maintain velocity without sacrificing

Qualifications

• 5+ years hands-on application security engineering experience
• Expertise in secure software development practices, including threat modeling and vulnerability assessment
• Strong software engineering background with multi-language review experience
• Experience implementing application security testing tools and CI/CD integration
• Knowledge of OWASP Top 10 and modern security frameworks

Responsibilities

• Design and implement application security controls across our AI agent platform
• Collaborate with product engineering to integrate security in SDLC
• Establish SAST/DAST/IAST testing programs for AI apps
• Lead security code reviews and architecture assessments for new features
• Build tooling to identify and remediate vulnerabilities quickly while preserving velocity

Skills

Application security

Threat modeling

Secure code review

CI/CD security

AI/ML security

Tools

Semgrep

CodeQL

Cursor Bug Bot

XBOW

Job description

Decagon is seeking a Senior Security Engineer to lead the application security strategy for our AI-powered conversational platform. You will embed security into products across design, code, and deployment, collaborating with engineering teams to protect enterprise customers at scale.

You will drive threat modeling, secure coding practices, and vulnerability management, establish testing programs (SAST/DAST/IAST), review architecture, and build automation to maintain velocity without sacrificing