Senior Application Security Engineer - GenAI Security Evaluation

Gramian Consulting Group; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Gramian Consultancy is seeking experienced Application Security Engineers to support an AI security evaluation project. You will assess how static analysis tools identify vulnerabilities in Generative AI applications, building runnable examples of SID and EA vulnerabilities and fixed/near-miss versions.

Responsibilities include analyzing code paths, defining authorization contexts, developing deterministic tests, and documenting findings to improve tool reliability and evaluation of AI systems

Qualifications

• 5+ years of professional experience in application security or security-focused software engineering.
• Strong experience conducting secure code reviews and identifying application-level vulnerabilities.
• Practical knowledge of source-to-sink analysis, taint analysis, and SAST.
• Hands-on experience with CodeQL or Semgrep.
• Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.
• Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and MCP.
• Strong understanding of authorization models, including multi-tenant access control and OAuth/IAM.
• Production-level coding in Python and/or TypeScript.
• Ability to distinguish genuine SID/EA vulnerabilities from non-findings.
• Strong analytical skills and clear communication of security findings.

Responsibilities

• Build runnable agent and RAG repositories containing code-reachable SID and EA vulnerabilities.
• Develop realistic security scenarios involving tool calling, agent memory, MCP, and other components.
• Create vulnerable, fixed, and hard-negative code variants with minimal differences.
• Evaluate SAST tools and assess detection of real vulnerabilities vs false positives.
• Perform source-to-sink analysis and trace data flows, actions, and trust boundaries.
• Annotate findings with assets, root causes, controls, severity, and residual risk.
• Define authorization contexts covering actors, tenants, identities, data, actions, purposes, recipients.
• Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
• Recommend security controls and remediation approaches.
• Participate in calibration, peer reviews, and QA activities.

Skills

Secure code reviews

SAST

CodeQL

Semgrep

LLM agents

RAG apps

Python

TypeScript

OAuth

IAM

LangChain

MCP

Tools

CodeQL

Semgrep

OpenAI SDKs

LlamaIndex

LangChain

Job description

About Gramian

Gramian Consultancy is a boutique consultancy specializing in IT professional services and engineering talent solutions. With a strong background in software engineering and leadership, we help companies build high-performing teams by matching them with professionals who truly fit their needs.

About the Role

We are looking for experienced Application Security Engineers and Security-Focused Software Engineers to support a specialized AI security evaluation project.

In this role, you will assess how effectively static analysis tools identify security vulnerabilities in Generative AI applications, particularly LLM agents and Retrieval-Augmented Generation (RAG) systems. You will build small, runnable repositories containing realistic examples of Sensitive Information Disclosure (SID) and Excessive Agency (EA) vulnerabilities, alongside fixed and near-miss versions.

You will analyze code paths, identify security weaknesses, define authorization contexts, develop deterministic tests, and document findings. Your work will help improve the reliability of security tools and strengthen how AI systems are evaluated for application-level vulnerabilities.

LOCATION: Remote

EXPERIENCE: 5+ years in application/product security or security-focused software engineering

PROJECT: GenAI application security evaluation and AI training

TECHNICAL FOCUS: Python, TypeScript, SAST, CodeQL, Semgrep, LLM agents, RAG, and MCP

AI EXPERIENCE: Hands-on experience building LLM agents or RAG applications is required.

Key Responsibilities

• Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
• Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
• Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
• Evaluate static application security testing (SAST) tools and assess their ability to detect genuine vulnerabilities while avoiding false positives.
• Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
• Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
• Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
• Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
• Recommend appropriate security controls and remediation approaches.
• Participate in technical calibration, peer reviews, and quality assurance activities.

• 5+ years of professional experience in application security, product security, or security-focused software engineering.

• Strong experience conducting secure code reviews and identifying application-level vulnerabilities.

• Practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST).

• Hands-on experience with security analysis tools such as CodeQL or Semgrep.

• Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.

• Familiarity with frameworks and technologies such as LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).

• Strong understanding of authorization models, including:

  • Actors, identities, and trust boundaries.

  • Multi-tenant authorization and access control.

  • OAuth, IAM, and identity management.

  • Permitted data access and actions.

  • Purpose and recipient restrictions.

  • Document-level access control.

• Production-level coding experience in Python and/or TypeScript.

• Ability to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.

• Strong analytical skills and the ability to communicate technical security findings clearly.