Senior Automation Engineer

Prolifics; New York (NY); On-site; USD 120,000 - 150,000; Full time

Job summary

Prolifics in New York, NY, seeks an Automation Engineer specialized in AI-driven code security and remediation. You'll build and operate a system that scans GitHub and Artifactory repositories for vulnerabilities and EOL libraries, then autonomously remediate findings with agentic workflows.

The role requires expert Python, experience with GitHub Actions and Artifactory, and the ability to scale across multi-repo/codebases.

Qualifications

• Builds and operates a system that scans repos for vulnerabilities and EOL libraries.
• Uses AI-driven automation to remediate findings and generate patch PRs.
• Scales scanning across multi-repo, multi-language codebases.
• Integrates scan-and-fix pipelines into GitHub Actions/Jenkins.

Responsibilities

• Develop agentic workflows that interpret findings and summarize fixes.
• Coordinate with CI/CD to test and validate remediations.
• Provide leadership updates on exposure counts, MTTR and patch rate trends.

Skills

Python

GitHub Actions

Artifactory/Xray

Snyk/CodeQL

AI remediation

CI/CD pipelines

Docker testing

Airflow scheduling

Dashboards

Tools

JFrog Artifactory

Trivy

Semgrep

CodeQL

Dependabot

Job description

Location: NYC, NY (3 days onsite is must )

Duration: 12 Months

Role: Automation Engineer — AI-Driven Code Security & Remediation Framework

Role Summary

Builds and operates a system that scans GitHub/Artifactory repos for vulnerabilities and EOL libraries, then uses AI-driven automation to remediate findings — cutting manual triage and patch time firm-wide.

Core Technical Skills

• Programming: Strong Python (scanners, orchestration, API integration); basic Bash for CI/CD glue
• Source & Artifact Systems: GitHub (Actions, Advanced Security, PR workflows) and JFrog Artifactory/Xray; ability to scale across multi-repo, multi-language codebases
• Scanning Tools: Hands-on with Snyk, Xray, CodeQL / Dependabot, Trivy, or Semgrep; understanding of CVE/CVSS scoring and EOL-detection sources (e.g., endoflife.date)
• AI-Driven Remediation: Building agentic workflows (LLM-based) that interpret findings, generate patch PRs, run tests, and summarize fixes; prompt engineering for code-editing agents
• CI/CD & Orchestration: Integrating scan-and-fix pipelines into GitHub Actions/Jenkins; Docker for isolated fix-testing; scheduling via Airflow/cron
• Reporting: Structuring findings (JSON/SQL) into dashboards for tracking coverage and trends

Supporting Skills

• Security fundamentals (injection, auth flaws, supply-chain/SBOM risk)
• Risk-based prioritization beyond raw CVSS scores
• Semantic versioning awareness for safe auto-upgrades

Communication Skills

• Translating vulnerability data into concise, risk-framed leadership updates (exposure counts, MTTR, fix-rate trends)
• Writing clear status emails on scan coverage and outstanding critical items
• Building the business case (time saved, risk reduced) for non-technical stakeholders
• Tracking emerging agentic/AI remediation tools and evaluating fit before firm-wide adoption

Skill Levels

• Expert Level resource: 8 to 10 or more total experience out of which at least three years of experience in the relevant AI driven automation for code scanning and remediation matching the above skills
• Advanced level: Total 6 – 8 years of total experience out of which at least three years of experience in the relevant AI driven automation for code scanning and remediation matching the above skills