Security Engineer

ERPMARK INC; Seattle (WA); On-site; USD 120,000 - 180,000; Full time

Job summary

ERPMARK INC. seeks an experienced Security Engineer to support Engineering Security initiatives—focusing on security reviews, threat modeling, and third-party AI agent security testing.

You will work with Engineering, Security, and Privacy teams to identify risks, perform hands-on assessments, and provide remediation guidance. Ideal candidates have 3+ years in security engineering or related fields, with hands-on testing, strong threat modeling knowledge, and excellent communication skills to

Qualifications

• 3+ years of professional experience in security engineering or related fields.
• Experience reviewing complex designs and identifying security risks across applications, APIs, cloud services, microservices, or distributed systems.
• Strong knowledge of threat modeling, vulnerability classification, least privilege, and data protection.
• Hands-on security testing, vulnerability investigation, penetration testing, or security-control validation.
• Strong communication skills to explain findings to diverse stakeholders.

Responsibilities

• Conduct security and privacy design reviews of services, applications, APIs, engineering proposals, and AI integrations.
• Evaluate architecture, data flows, access controls, trust boundaries, and security safeguards.
• Perform threat modeling for critical services and AI agents, identifying attack surfaces, scenarios, paths, mitigations, and residual risks.
• Conduct hands-on security testing of third-party AI agents including data access/permissions, excessive agency, and external integrations.
• Document findings, risk assessments, evidence, and remediation recommendations; partner with engineering teams through remediation and validation.
• Develop repeatable security assessment processes, including checklists, threat models, test cases, reporting templates, and automation workflows.

Skills

Security Engineering

Threat Modeling

Vulnerability Classification

Least Privilege

Data Protection

Communication Skills

Tools

Python

Go

Bash

Job description

Location: Seattle, WA – Preferred / Sunnyvale, CA – Local Candidates Preferred

Employment Type: W2 Only no c2c

Role Overview

We are looking for experienced Security Engineers to support Engineering Security initiatives focused on security and privacy reviews, threat modeling, and third-party AI Agent security testing.

The selected candidate will work closely with Engineering, Security, Privacy, and third-party teams to identify security risks, perform hands‑on assessments, and provide actionable remediation guidance.

Key Responsibilities

• Conduct security and privacy design reviews of services, applications, APIs, engineering proposals, and AI integrations.
• Evaluate architecture, data flows, access controls, trust boundaries, and security safeguards.
• Perform threat modeling for critical services and AI agents, identifying attack surfaces, threat scenarios, attack paths, mitigations, and residual risks.
• Conduct hands‑on security testing of third‑party AI agents, including:
• Data access and permissions
• Excessive agency
• External integrations
• Document security findings, risk assessments, supporting evidence, and practical remediation recommendations.
• Partner with Engineering and Security teams through remediation and validation.
• Develop repeatable security assessment processes, including review checklists, threat models, test cases, reporting templates, and automation workflows.

Minimum Qualifications

• 3+ years of professional experience in Security Engineering, Application Security, Product Security, Offensive Security, Systems Architecture, or a related technical security field.
• Experience reviewing complex technical designs and identifying security risks across applications, APIs, cloud services, microservices, or distributed systems.
• Strong knowledge of:
• Threat Modeling
• Vulnerability Classification
• Least Privilege
• Data Protection
• Hands‑on experience with security testing, vulnerability investigation, penetration testing, adversarial testing, or security‑control validation.
• Strong communication skills with the ability to explain technical security findings to Engineering, Security, Privacy, and third‑party stakeholders.

Preferred / Good to Have

• Experience assessing AI/LLM agents and AI security risks.
• Hands‑on knowledge of prompt injection, unsafe tool use, excessive agency, and AI security testing.
• Experience with privacy and security design reviews.
• Cloud security experience across AWS, Azure, or GCP.
• Experience with security automation using Python, Go, Bash, or similar languages.
• Hands‑on penetration testing and vulnerability assessment across applications, APIs, cloud infrastructure, and networks.
• Experience identifying and validating real‑world attack paths and providing actionable remediation guidance.

Note: Candidates must be able to work on W2.

Local candidates in Seattle, WA or Sunnyvale, CA are strongly preferred.