Senior AI Agentic App Sec Engineer

Cardinal Health, Inc.; Field (NM); On-site; USD 170,000 - 230,000; Full time

Job summary

Cardinal Health, Inc. is seeking an Application Security Engineer, AI and Agentic Security, to design, prototype, and operationalize generative AI capabilities within Application Security.

The role blends hands-on software engineering with security expertise to enable scalable, auditable AI-assisted vulnerability identification and secure code guidance. You will collaborate across security, software engineering, cloud, and governance teams to translate experiments into enterprise-ready

Qualifications

• Strong hands-on Python development experience, including API integration, automation, testing, data handling, and production-quality engineering practices.
• Experience building or integrating solutions using large language models, model APIs, retrieval-augmented generation, tool calling, structured outputs, workflow orchestration, or agent frameworks.
• Experience designing and evaluating agentic workflows that use tools, maintain state, make bounded decisions, and operate with human approval where appropriate.
• Strong understanding of secure software development, common application vulnerabilities, threat modeling, secure design, authentication and authorization, secrets management, and software supply chain risk.
• Experience with Application Security capabilities such as SAST, SCA, secrets detection, DAST, API security, container security, IaC security, and vulnerability remediation workflows.
• Experience with Git-based development, pull requests, CI/CD, automated testing, containers, Kubernetes, and cloud-native development patterns.

Responsibilities

• Design, prototype, evaluate, and operationalize AI-enabled security capabilities within Application Security.
• Develop Python-based services, automation, integrations, evaluation harnesses, and supporting tools.
• Evaluate AI-enabled security products and frameworks for vulnerability discovery, exploitability analysis, secure code guidance, remediation, validation, and developer workflow integration.
• Create controlled workflows where AI analyzes code, uses tools, recommends changes, executes tests, and provides auditable evidence with human oversight.
• Establish guardrails for identity, least privilege, data access, tool use, secrets handling, logging, change control, and safe termination.
• Develop test plans and benchmarks to assess accuracy, security, reliability, latency, and operational value.
• Perform security testing of AI workflows, including prompt injection, unsafe tool use, data leakage, and authorization failures.
• Integrate capabilities with source control, CI/CD pipelines, developer tools, and vulnerability management workflows.
• Define reference architectures, runbooks, and support models for approved capabilities.
• Partner with governance to ensure alignment with enterprise AI, security, privacy, and technology standards.

Skills

Python development

AI-enabled security engineering

Security testing

Threat modeling

Secure software development

Git-based development

Tools

Git

CI/CD

Containers

Kubernetes

Cloud-native development

Model APIs

Job description

Department Overview

The Information Security organization is advancing Application Security to help the enterprise deliver products and services securely as software development practices rapidly evolve. The Application Security Engineering and Innovation team builds, integrates, operates, and matures modern security capabilities across the software development lifecycle, with a particular focus on automation, developer experience, software supply chain security, and AI-enabled security engineering.

Job Overview

The Application Security Engineer, AI and Agentic Security is a senior individual contributor responsible for designing, prototyping, evaluating, and operationalizing generative and agentic AI capabilities within Application Security. The role combines hands-on software engineering, Application Security expertise, and practical experience with AI-enabled development patterns. It will help establish safe, scalable approaches for AI-assisted vulnerability identification, code analysis, remediation, validation, and security workflow automation. This engineer will partner with Application Security, software engineering, cloud and platform teams, Security Architecture, AI Governance, and other information security functions to move promising concepts from experimentation into governed, supportable enterprise capabilities. The role is expected to balance innovation with disciplined engineering, security controls, measurable outcomes, and long-term operational sustainability.

Responsibilities

• Design, build, and test prototypes and production-ready capabilities using generative AI, large language models, AI agents, and multi-step agentic workflows.
• Develop Python-based services, automation, integrations, evaluation harnesses, and supporting tools for Application Security use cases.
• Evaluate AI-enabled security products and frameworks for vulnerability discovery, exploitability analysis, secure code guidance, remediation, validation, and developer workflow integration.
• Create controlled workflows in which AI capabilities can analyze code, use approved tools, recommend or generate changes, execute tests, and produce auditable evidence while maintaining appropriate human oversight.
• Establish technical guardrails for agent identity, least privilege, data access, tool use, repository access, secrets handling, logging, traceability, change control, and safe failure or termination.
• Develop test plans and benchmarks to assess accuracy, security, reliability, repeatability, cost, latency, false positives, remediation quality, and operational value.
• Perform security testing of AI and agentic workflows, including prompt injection, unsafe tool use, excessive agency, data leakage, insecure output handling, dependency and supply chain risks, and authorization failures.
• Integrate capabilities with source control, CI/CD pipelines, developer tools, issue management, security testing platforms, and vulnerability management workflows.
• Define reference architectures, reusable patterns, technical requirements, runbooks, and operational support models for approved capabilities.
• Partner with governance and architecture teams to ensure solutions align with enterprise AI, security, privacy, data protection, and technology standards.
• Support pilots with application teams, capture feedback, measure outcomes, and recommend whether capabilities should be scaled, redesigned, purchased, built, or retired.
• Maintain awareness of developments in generative AI, agentic systems, secure AI engineering, Application Security, and software delivery practices.
• Strong hands-on Python development experience, including API integration, automation, testing, data handling, and production-quality engineering practices.
• Experience building or integrating solutions using large language models, model APIs, retrieval-augmented generation, tool calling, structured outputs, workflow orchestration, or agent frameworks.
• Experience designing and evaluating agentic workflows that use tools, maintain state, make bounded decisions, and operate with human approval where appropriate.
• Strong understanding of secure software development, common application vulnerabilities, threat modeling, secure design, authentication and authorization, secrets management, and software supply chain risk.
• Experience with Application Security capabilities such as SAST, SCA, secrets detection, DAST, API security, container security, IaC security, and vulnerability remediation workflows.
• Experience with Git-based development, pull requests, CI/CD, automated testing, containers, Kubernetes, and cloud-native development patterns.
• Ability to evaluate AI output quality using repeatable test cases, metrics, red-team scenarios, and evidence-based comparison rather than demonstration results alone.
• Understanding of AI security risks and controls, including prompt injection, data leakage, excessive agency, insecure tool use, model and dependency supply c