Application Security Engineer

About the role

Senior Application Security Engineer position based in Princeton, NJ and New York, NY (hybrid). Requires 8‑15+ years of software engineering and application security experience with a strong emphasis on hands‑on development (you have shipped code).

Responsibilities

• Build reusable security workflows and automation using Python and Claude Code (leveraging its skills, subagents, hooks, slash commands, and MCP integrations).
• Apply a working understanding of AI agents and agentic frameworks, addressing emerging security concerns such as OWASP LLM Top 10, agent tool permissions, prompt injection, and supply‑chain risk.
• Perform threat modeling, enforce secure SDLC practices, and assess common vulnerability classes (OWASP Top 10, API security, authentication/authorization).
• Exercise judgment to decide when to automate, escalate, or directly fix security issues.

Requirements

• 8‑15+ years of software engineering and application security experience, with substantial hands‑on development background.
• Strong Python proficiency for automation and tooling.
• Daily proficiency with Claude Code, including its extensibility (skills, subagents, hooks, slash commands, MCP integrations).
• Working understanding of AI agents and agentic frameworks and related security concerns (OWASP LLM Top 10, tool permissions, prompt injection, supply‑chain risk).
• Depth in secure SDLC, threat modeling, and common vulnerability classes (OWASP Top 10, API security, authn/authz).
• Ability to judge when to automate, escalate, or fix issues personally.

Nice‑to‑have

• Experience securing production LLM/agentic systems or building internal AI security tooling.
• Contributions to open‑source security tools.
• Relevant certifications (OSCP, GWAPT, CSSLP) – helpful but not required.