Senior AI Agentic App Sec Engineer
Cardinal Health, Inc.
A complete application in a minute
Tailored resume and cover letter, ready to send.
Benefits offered by this job
Job summary
Cardinal Health, Inc. is seeking an Application Security Engineer, AI and Agentic Security, a senior IC responsible for designing, prototyping, evaluating, and operationalizing AI capabilities within Application Security.
You will partner with security, engineering, cloud, and governance teams to move concepts from experimentation to governed enterprise capabilities. The role balances innovation with disciplined engineering, security controls, measurable outcomes, and long-term operational
Qualifications
- Bachelor's degree or equivalent practical experience in a related field.
- Substantial experience in software engineering, security engineering, or DevSecOps.
- Proficient in Python development.
- Familiarity with Application Security concepts and secure software development practices.
- Experience delivering technical work with multiple stakeholders.
- Hands-on with generative AI, LLM integration, or AI-enabled tooling.
- Experience with Java, JavaScript/TypeScript, C#, or Go.
- Experience with cloud services, containers, Kubernetes, and IaC.
- Knowledge of security guidance like OWASP and NIST frameworks.
- Relevant security or cloud credentials are beneficial.
Responsibilities
- Design, build, and test AI-enabled capabilities using generative AI, LLMs, agents, and multi-step workflows.
- Develop Python-based services, automation, integrations, and evaluation tools for security use cases.
- Evaluate AI-enabled security products for vulnerability discovery and secure code guidance.
- Create controlled AI workflows with auditable evidence and human oversight.
- Establish guardrails for identity, least privilege, data access, secrets handling, logging, and governance.
- Develop test plans and benchmarks for accuracy, security, latency, and cost.
- Perform security testing of AI workflows including prompt injection and data leakage.
- Integrate capabilities with source control, CI/CD, developer tools, and vulnerability workflows.
- Define reference architectures and runbooks for approved capabilities.
- Collaborate with governance and architecture to align with enterprise standards.
- Support pilots, capture feedback, and decide on scaling or retirement.
- Stay updated on AI developments relevant to security engineering.
- Move from experimentation to enterprise operationalization with maintainability and cost controls.
- Communicate findings and trade-offs to leadership and cross-functional partners.
Skills
Education
Tools
Job description
US-Nationwide-FIELD
Full time
20190821
The Information Security organization is advancing Application Security to help the enterprise deliver products and services securely as software development practices rapidly evolve. The Application Security Engineering and Innovation team builds, integrates, operates, and matures modern security capabilities across the software development lifecycle, with a particular focus on automation, developer experience, software supply chain security, and AI-enabled security engineering.
The Application Security Engineer, AI and Agentic Security is a senior individual contributor responsible for designing, prototyping, evaluating, and operationalizing generative and agentic AI capabilities within Application Security. The role combines hands-on software engineering, Application Security expertise, and practical experience with AI-enabled development patterns. It will help establish safe, scalable approaches for AI-assisted vulnerability identification, code analysis, remediation, validation, and security workflow automation.
This engineer will partner with Application Security, software engineering, cloud and platform teams, Security Architecture, AI Governance, and other information security functions to move promising concepts from experimentation into governed, supportable enterprise capabilities. The role is expected to balance innovation with disciplined engineering, security controls, measurable outcomes, and long-term operational sustainability.
- Design, build, and test prototypes and production-ready capabilities using generative AI, large language models, AI agents, and multi-step agentic workflows.
- Develop Python-based services, automation, integrations, evaluation harnesses, and supporting tools for Application Security use cases.
- Evaluate AI-enabled security products and frameworks for vulnerability discovery, exploitability analysis, secure code guidance, remediation, validation, and developer workflow integration.
- Create controlled workflows in which AI capabilities can analyze code, use approved tools, recommend or generate changes, execute tests, and produce auditable evidence while maintaining appropriate human oversight.
- Establish technical guardrails for agent identity, least privilege, data access, tool use, repository access, secrets handling, logging, traceability, change control, and safe failure or termination.
- Develop test plans and benchmarks to assess accuracy, security, reliability, repeatability, cost, latency, false positives, remediation quality, and operational value.
- Perform security testing of AI and agentic workflows, including prompt injection, unsafe tool use, excessive agency, data leakage, insecure output handling, dependency and supply chain risks, and authorization failures.
- Integrate capabilities with source control, CI/CD pipelines, developer tools, issue management, security testing platforms, and vulnerability management workflows.
- Define reference architectures, reusable patterns, technical requirements, runbooks, and operational support models for approved capabilities.
- Partner with governance and architecture teams to ensure solutions align with enterprise AI, security, privacy, data protection, and technology standards.
- Support pilots with application teams, capture feedback, measure outcomes, and recommend whether capabilities should be scaled, redesigned, purchased, built, or retired.
- Maintain awareness of developments in generative AI, agentic systems, secure AI engineering, Application Security, and software delivery practices.
- Strong hands-on Python development experience, including API integration, automation, testing, data handling, and production-quality engineering practices.
- Experience building or integrating solutions using large language models, model APIs, retrieval-augmented generation, tool calling, structured outputs, workflow orchestration, or agent frameworks.
- Experience designing and evaluating agentic workflows that use tools, maintain state, make bounded decisions, and operate with human approval where appropriate.
- Strong understanding of secure software development, common application vulnerabilities, threat modeling, secure design, authentication and authorization, secrets management, and software supply chain risk.
- Experience with Application Security capabilities such as SAST, SCA, secrets detection, DAST, API security, container security, IaC security, and vulnerability remediation workflows.
- Experience with Git-based development, pull requests, CI/CD, automated testing, containers, Kubernetes, and cloud-native development patterns.
- Ability to evaluate AI output quality using repeatable test cases, metrics, red-team scenarios, and evidence-based comparison rather than demonstration results alone.
- Understanding of AI security risks and controls, including prompt injection, data leakage, excessive agency, insecure tool use, model and dependency supply chain risk, and auditability.
- Strong problem-solving, technical writing, presentation, and cross-functional collaboration skills.
- Ability to move between experimental engineering and enterprise operationalization without losing sight of maintainability, governance, cost, and support requirements
- Bachelor's degree in computer science, software engineering, cybersecurity, information systems, or a related field, or equivalent practical experience.
- Substantial experience in software engineering, security engineering, Application Security, DevSecOps, or a closely related technical discipline.
- Demonstrated proficiency developing solutions in Python.
- Demonstrated understanding of Application Security concepts and secure software development practices.
- Experience delivering complex technical work with limited definition and coordinating across multiple stakeholder groups.
- Hands-on experience with generative AI application development, LLM integration, agentic systems, or AI-enabled developer tooling.
- Experience with one or more additional languages or platforms such as Java, JavaScript/TypeScript, .NET/C#, or Go.
- Experience with cloud services, containers, Kubernetes, infrastructure as code, and enterprise developer platforms.
- Experience with AI evaluation, adversarial testing, red teaming, observability, or governance controls for AI-enabled systems.
- Knowledge of industry guidance such as the OWASP Top 10, OWASP guidance for LLM or agentic applications, NIST Secure Software Development Framework, and NIST AI Risk Management Framework.
- Relevant security, cloud, or software credentials are beneficial but not required; examples may include CISSP, CSSLP, CCSP, GWEB, or cloud-provider certifications.
Applies advanced knowledge of software engineering, Application Security, and AI-enabled development to solve complex and ambiguous problems.
Leads or materially contributes to complex projects with broad scope, significant technical impact, and long-term operational implications.
Recommends new practices, architectures, controls, metrics, and engineering approaches for emerging capabilities.
Independently determines methods for completing new or undefined work while receiving guidance on overall objectives.
Experience in providing solutions and technical patterns that help establish precedents for organization wide adoption .
Experience in transiting emerging technology into practical, secure, and supportable capabilities that can be adopted by engineering teams.
Efficiently communicate technical findings, risks, trade-offs, and recommendations to engineering, security, governance, in various leadership forums.
Acts as a mentor and technical resource for less experienced colleagues and cross-functional partners.
Success is demonstrated by converting emerging AI capabilities into secure, measurable, and operationally sustainable Application Security outcomes. The strongest candidate will be equally comfortable writing and testing code, challenging the safety and effectiveness of an AI workflow, explaining trade-offs to leadership, and partnering with platform and application teams to move a capability into responsible enterprise use
$125,300 - $178,900
Yes
- Medical, dental and vision coverage
- Paid time off plan
- Health savings account (HSA)
- 401k savings plan
- Access to wages before pay day with myFlexPay
- Flexible spending accounts (FSAs)
- Short- and long-term disability coverage
- Work-Life resources
- Paid parental leave
- Healthy lifestyle programs
12/23/2026
Cardinal Health offers a wide variety of benefits and programs to support health and well-being.
Cardinal Health supports an inclusive workplace that values diversity of thought, experience and background. We celebrate the power of our differences to create better solutions for our customers by ensuring employees can be their authentic selves each day. Cardinal Health is an Equal Opportunity employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, ancestry, age, physical or mental disability, sex, sexual orientation, gender identity/expression, pregnancy, veteran status, marital status, creed, status with regard to public assistance, genetic status or any other status protected by federal, state or local law.
To read and review this privacy notice click here (https://www.cardinalhealth.com/content/dam/corp/email/documents/corp/cardinal-health-online-application-privacy-policy.pdf)
Headquartered in Dublin, Ohio, Cardinal Health, Inc. (NYSE: CAH) is a distributor of pharmaceuticals, a global manufacturer and distributor of medical and laboratory products, and a provider of performance and data solutions for healthcare facilities.
We are a crucial link between the clinical and operational sides of healthcare, delivering end-to-end solutions and data-driving insights that advance healthcare and improve lives every day. With deep partnerships, diverse perspectives and innovative digital solutions, we build connections across the continuum of care.
With more than 50 years of experience, we seize the opportunity to address healthcare's most complicated challenges — now, and in the future.
View Cardinal Health on YouTube (http://youtube.com/user/CardinalHealth)
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
