Senior AI & AppSec Security Engineer

Logoslabs; San Francisco (CA); Sur place; USD 140 000 - 230 000; Plein temps

Résumé du poste

GoodLeap is seeking an experienced security engineer to adversarially test AI and LLM-backed features, design and operate production security services, and drive risk reduction across web apps and APIs.

You will review product designs, perform threat modeling, conduct manual testing, and contribute to secure tooling, IAM, and incident response. Collaboration with product and engineering is essential to raise the AI security bar.

Qualifications

• Strong backend engineering in at least one modern language with a service others depend on.
• Ability to read code across multiple languages and validate findings.
• Deep understanding of identity and authorization failures, token exchange and OAuth pitfalls.
• Knowledge of API security: REST/GraphQL, OpenAPI, input validation, rate limiting, and service-to-service verification.
• Hands-on testing of web apps and APIs, including manual testing and retesting fixes.
• Familiarity with AWS and infrastructure-as-code concepts like IAM, secrets management, and container lifecycles.
• Experience with AI/LLM security and adversarial testing of LLM-backed applications.
• Ability to write and communicate findings clearly to engineers, product managers, and legal.

Responsabilités

• Adversarially test our AI and LLM-backed features and translate findings into pass/fail criteria.
• Build and operate production security services (APIs, tooling) using TypeScript, Node.js, .NET, or Python.
• Automate manual processes where possible and advocate for tool replacements when beneficial.
• Review PRD and designs to model threats and data flows before coding starts.
• Perform hands-on testing of web apps and APIs; support red team activities and bug bounty programs.
• Maintain and tune AppSec tooling, SAST/SCA, and access management processes to scale the program.
• Ensure secure infrastructure with IAM least-privilege, secrets mgmt, and IaC.

Connaissances

Backend engineering

Code reading across languages

Identity and authorization

API security

Threat modeling

Manual testing

AWS

Infrastructure as code

AI/LLM security

Clear written communication

Outils

AWS

OpenAPI

REST

GraphQL

SAST

SCA

Description du poste

GoodLeap is seeking an experienced security engineer to adversarially test AI and LLM-backed features, design and operate production security services, and drive risk reduction across web apps and APIs.

You will review product designs, perform threat modeling, conduct manual testing, and contribute to secure tooling, IAM, and incident response. Collaboration with product and engineering is essential to raise the AI security bar.