Senior AI Agentic App Sec Engineer

Department Overview

The Information Security organization is advancing Application Security to help the enterprise deliver products and services securely as software development practices rapidly evolve. The Application Security Engineering and Innovation team builds, integrates, operates, and matures modern security capabilities across the software development lifecycle, with a particular focus on automation, developer experience, software supply chain security, and AI-enabled security engineering.

Job Overview

The Application Security Engineer, AI and Agentic Security is a senior individual contributor responsible for designing, prototyping, evaluating, and operationalizing generative and agentic AI capabilities within Application Security. The role combines hands-on software engineering, Application Security expertise, and practical experience with AI-enabled development patterns. It will help establish safe, scalable approaches for AI-assisted vulnerability identification, code analysis, remediation, validation, and security workflow automation.

This engineer will partner with Application Security, software engineering, cloud and platform teams, Security Architecture, AI Governance, and other information security functions to move promising concepts from experimentation into governed, supportable enterprise capabilities. The role is expected to balance innovation with disciplined engineering, security controls, measurable outcomes, and long-term operational sustainability.

Responsibilities

• Design, build, and test prototypes and production-ready capabilities using generative AI, large language models, AI agents, and multi-step agentic workflows.
• Develop Python-based services, automation, integrations, evaluation harnesses, and supporting tools for Application Security use cases.
• Evaluate AI-enabled security products and frameworks for vulnerability discovery, exploitability analysis, secure code guidance, remediation, validation, and developer workflow integration.
• Create controlled workflows in which AI capabilities can analyze code, use approved tools, recommend or generate changes, execute tests, and produce auditable evidence while maintaining appropriate human oversight.
• Establish technical guardrails for agent identity, least privilege, data access, tool use, repository access, secrets handling, logging, traceability, change control, and safe failure or termination.
• Develop test plans and benchmarks to assess accuracy, security, reliability, repeatability, cost, latency, false positives, remediation quality, and operational value.
• Perform security testing of AI and agentic workflows, including prompt injection, unsafe tool use, excessive agency, data leakage, insecure output handling, dependency and supply chain risks, and authorization failures.
• Integrate capabilities with source control, CI/CD pipelines, developer tools, issue management, security testing platforms, and vulnerability management workflows.
• Define reference architectures, reusable patterns, technical requirements, runbooks, and operational support models for approved capabilities.
• Partner with governance and architecture teams to ensure solutions align with enterprise AI, security, privacy, data protection, and technology standards.
• Support pilots with application teams, capture feedback, measure outcomes, and recommend whether capabilities should be scaled, redesigned, purchased, built, or retired.
• Maintain awareness of developments in generative AI, agentic systems, secure AI engineering, Application Security, and software delivery practices.