Remote GenAI Security Engineer (SAST, LLM/RAG)

Gramian Consulting Group; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Gramian Consultancy is seeking experienced Application Security Engineers to support an AI security evaluation project. You will assess how static analysis tools identify vulnerabilities in Generative AI applications, building runnable examples of SID and EA vulnerabilities and fixed/near-miss versions.

Responsibilities include analyzing code paths, defining authorization contexts, developing deterministic tests, and documenting findings to improve tool reliability and evaluation of AI systems

Qualifications

• 5+ years of professional experience in application security or security-focused software engineering.
• Strong experience conducting secure code reviews and identifying application-level vulnerabilities.
• Practical knowledge of source-to-sink analysis, taint analysis, and SAST.
• Hands-on experience with CodeQL or Semgrep.
• Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.
• Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and MCP.
• Strong understanding of authorization models, including multi-tenant access control and OAuth/IAM.
• Production-level coding in Python and/or TypeScript.
• Ability to distinguish genuine SID/EA vulnerabilities from non-findings.
• Strong analytical skills and clear communication of security findings.

Responsibilities

• Build runnable agent and RAG repositories containing code-reachable SID and EA vulnerabilities.
• Develop realistic security scenarios involving tool calling, agent memory, MCP, and other components.
• Create vulnerable, fixed, and hard-negative code variants with minimal differences.
• Evaluate SAST tools and assess detection of real vulnerabilities vs false positives.
• Perform source-to-sink analysis and trace data flows, actions, and trust boundaries.
• Annotate findings with assets, root causes, controls, severity, and residual risk.
• Define authorization contexts covering actors, tenants, identities, data, actions, purposes, recipients.
• Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
• Recommend security controls and remediation approaches.
• Participate in calibration, peer reviews, and QA activities.

Skills

Secure code reviews

SAST

CodeQL

Semgrep

LLM agents

RAG apps

Python

TypeScript

OAuth

IAM

LangChain

MCP

Tools

CodeQL

Semgrep

OpenAI SDKs

LlamaIndex

LangChain

Job description

Gramian Consultancy is seeking experienced Application Security Engineers to support an AI security evaluation project. You will assess how static analysis tools identify vulnerabilities in Generative AI applications, building runnable examples of SID and EA vulnerabilities and fixed/near-miss versions.

Responsibilities include analyzing code paths, defining authorization contexts, developing deterministic tests, and documenting findings to improve tool reliability and evaluation of AI systems