Senior AI-Driven AppSec Engineer (Remote)

Cardinal Health, Inc.; Springfield (IL); Remote; USD 125,000 - 179,000; Full time

Benefits offered by this job

Medical coverage

Dental coverage

Vision coverage

Paid time off

HSA • Health Savings Account

401k savings plan

Wages access before payday

FSAs

Disability insurance

Work-Life resources

Paid parental leave

Wellness programs

Job summary

Cardinal Health, Inc. is seeking an experienced Application Security Engineer, AI and Agentic Security, to design and operationalize AI-enabled security within the software lifecycle. You will prototype and productionize AI capabilities, align with governance, and collaborate across security, engineering, and cloud teams.

The role emphasizes hands-on coding, security controls, measurable outcomes, and scalable enterprise solutions, with a focus on auditing and maintainability.

Qualifications

• Strong hands-on Python development experience, including API integration, automation, testing, data handling, and production-quality engineering practices.
• Experience building or integrating solutions using large language models, model APIs, retrieval-augmented generation, tool calling, structured outputs, workflow orchestration, or agent frameworks.
• Experience designing and evaluating agentic workflows that use tools, maintain state, make bounded decisions, and operate with human approval where appropriate.
• Knowledge of secure software development, common application vulnerabilities, threat modeling, secure design, authentication and authorization, secrets management, and software supply chain risk.
• Experience with Application Security capabilities such as SAST, SCA, secrets detection, DAST, API security, container security, IaC security, and vulnerability remediation workflows.
• Experience with Git-based development, pull requests, CI/CD, automated testing, containers, Kubernetes, and cloud-native development patterns.

Responsibilities

• Design, build, and test prototypes and production-ready capabilities using generative AI, large language models, AI agents, and multi-step agentic workflows.
• Develop Python-based services, automation, integrations, evaluation harnesses, and supporting tools for Application Security use cases.
• Evaluate AI-enabled security products and frameworks for vulnerability discovery, exploitability analysis, secure code guidance, remediation, validation, and developer workflow integration.
• Create controlled workflows in which AI capabilities can analyze code, use approved tools, recommend or generate changes, execute tests, and produce auditable evidence while maintaining appropriate human oversight.
• Establish technical guardrails for agent identity, least privilege, data access, tool use, repository access, secrets handling, logging, traceability, change control, and safe failure or termination.
• Develop test plans and benchmarks to assess accuracy, security, reliability, repeatability, cost, latency, false positives, remediation quality, and operational value.
• Perform security testing of AI and agentic workflows, including prompt injection, unsafe tool use, excessive agency, data leakage, insecure output handling, dependency and supply chain risks, and authorization failures.
• Integrate capabilities with source control, CI/CD pipelines, developer tools, issue management, security testing platforms, and vulnerability management workflows.
• Define reference architectures, reusable patterns, technical requirements, runbooks, and operational support models for approved capabilities.
• Partner with governance and architecture teams to ensure solutions align with enterprise AI, security, privacy, data protection, and technology standards.
• Support pilots with application teams, capture feedback, measure outcomes, and recommend whether capabilities should be scaled, redesigned, purchased, built, or retired.
• Maintain awareness of developments in generative AI, agentic systems, secure AI engineering, Application Security, and software delivery practices.
• Experience with one or more languages or platforms such as Java, JavaScript/TypeScript, .NET/C#, or Go.
• Experience with cloud services, containers, Kubernetes, infrastructure as code, and enterprise developer platforms.
• Ability to evaluate AI output quality using repeatable test cases, metrics, red-team scenarios, and evidence-based comparison rather than demonstration results alone.
• Understanding of AI security risks and controls, including prompt injection, data leakage, excessive agency, insecure tool use, model and dependency supply chain risk, and auditability.
• Strong problem-solving, technical writing, presentation, and cross-functional collaboration skills.
• Ability to move between experimental engineering and enterprise operationalization without losing sight of maintainability, governance, cost, and support requirements

Skills

Python development

Generative AI

LLM integration

Agentic systems

DevSecOps

Education

Bachelor's degree in CS/SE/Cybersecurity or related field

Tools

Git

CI/CD

Kubernetes

Containers

IaC

Job description

Cardinal Health, Inc. is seeking an experienced Application Security Engineer, AI and Agentic Security, to design and operationalize AI-enabled security within the software lifecycle. You will prototype and productionize AI capabilities, align with governance, and collaborate across security, engineering, and cloud teams.

The role emphasizes hands-on coding, security controls, measurable outcomes, and scalable enterprise solutions, with a focus on auditing and maintainability.