Application Security Engineer (AI Governance & Cloud Security)

Reveal•Chicago, IL

31d•$136,000 - $160,000•Hybrid

About The Position

Reveal is hiring an Application Security Engineer to secure software development, production AI adoption, and cloud environments. The role owns Onyx Security as the control plane for AI agents and models and Wiz across cloud accounts and repositories. It provides hands-on security guidance to engineering teams through threat modeling, code review, remediation, and security policies and reporting for leadership and auditors. The position follows a hybrid model of four days in the office and one day working from home for candidates residing in Illinois. Candidates outside Illinois may be considered for a remote arrangement. The role reports to the Director, IT, Info Security and Compliance. For Illinois-based roles, the budgeted annual salary range is $136,000 to $160,000; compensation may vary based on qualifications, skills, competencies, and experience. Reveal is an equal opportunity employer committed to an inclusive workplace. The company considers candidates with existing visas but does not sponsor new visa applications.

Requirements

At least 4 years of experience in application security, product security, or security engineering.
Solid grasp of the OWASP Top 10, OWASP Top 10 for LLM Applications, and agentic AI risks, including Model Context Protocol (MCP) security.
Ability to read and review code in at least one of Python, JavaScript/TypeScript, Java, or C#.
Experience securing AWS, Azure, or GCP workloads, containers, and Kubernetes.
Familiarity with CI/CD tooling such as GitHub Actions, GitLab CI, or Azure DevOps, and with infrastructure as code.
Clear written communication for engineers, leadership, and auditors.

Nice To Haves

Experience building an AI governance program, including AI inventory, model risk reviews, and an acceptable-use policy.
Hands-on experience with Wiz, including policy tuning, Issue triage, and integrations such as Jira, Slack, and SIEM.
Hands-on experience with Onyx Security or a comparable AI security and governance platform, including AI discovery, guardrails, and agent permissions.
Knowledge of NIST AI RMF, ISO/IEC 42001, and the EU AI Act.
Experience supporting SOC 2, ISO 27001, or FedRAMP audits.
Background in legal tech, eDiscovery, or other environments handling sensitive client data.
Scripting for automation using Python, Bash, or Ruby, and experience with the Wiz API.
Certifications such as OSWE, GWAPT, CSSLP, CCSP, AWS Security Specialty, or Wiz certifications.

Responsibilities

Run threat modeling and secure design reviews for new features, services, and integrations.
Perform manual code reviews and triage findings from SAST, DAST, SCA, and secrets scanning.
Embed security checks into CI/CD pipelines without slowing delivery.
Lead remediation with engineering teams and track findings to closure against SLAs.
Support penetration tests, bug reports, and customer security questionnaires.
Own the Onyx Security platform as the control plane for AI agents and models across SaaS, cloud, endpoints, and code.
Use Onyx AI Observability to discover sanctioned and shadow AI and review prompts, responses, and agent actions.
Write and enforce natural-language governance policies and real-time guardrails in Onyx.
Manage agent permissions and secure MCP server connections to prevent over-privileged access.
Detect and respond to prompt injection, data exfiltration, and AI misuse, and tune Onyx Guardian Agent remediation.
Maintain the AI acceptable-use policy, AI inventory, and risk assessments with GRC, mapped to NIST AI RMF and ISO/IEC 42001.
Evaluate AI tools, agents, and vendors before adoption, and report AI adoption and risk metrics to leadership.
Own Wiz configuration, integrations, policies, and alert routing across cloud accounts.
Triage Wiz Issues and toxic combinations, and drive fixes for misconfigurations, vulnerabilities, and exposed secrets.
Use Wiz Code and IaC scanning to catch risk in repositories and Terraform before deployment.
Use Wiz AI Security Posture Management (AI-SPM) to inventory AI services and models running in the cloud.
Build reports and dashboards on cloud risk trends for Security leadership and audits.
Perform other duties and responsibilities as assigned to support team, department, and organizational goals.