Principal Application & AI Security Engineer

DNV•Houston, TX

3d•Hybrid

About The Position

DNV Energy Systems' Platform Services is seeking a Principal Application & AI Security Engineer. Platform Services runs the software products and digital platforms our customers depend on, including systems with significant operational importance in enterprise and energy environments. As we evolve toward agentic AI architectures, security must move from after-the-fact review into architecture, development workflows, and runtime operations - engineered into the platform and the delivery pipeline, with evidence that controls are implemented and operating effectively. This is a builder's role for a senior technical leader who can read and improve code, design reusable controls, model complex threats, conduct authorized security testing, and work directly with engineering teams to ship durable fixes. The goal is not simply to identify vulnerabilities. It is to eliminate recurring vulnerability classes, reduce exposure, and make the secure path the easiest path.

Requirements

Ability to read and improve code.
Ability to design reusable controls.
Ability to model complex threats.
Ability to conduct authorized security testing.
Ability to work directly with engineering teams to ship durable fixes.
Experience with identity, authorization, tenant isolation, data access, tool use, and runtime guardrails.
Experience with dependency integrity, SCA, SAST, DAST, build provenance, artifact security, secrets protection, container and infrastructure-as-code assurance, and software or AI bills of materials.
Experience with policy as code, authorization enforcement, data-access guardrails, secure defaults, and reusable reference implementations.
Experience designing AI-assisted security-testing environments, automated attack scenarios, and security-regression suites.
Experience implementing risk-based quality gates with documented exception paths, accountable ownership, and service-level expectations.
Experience reviewing source code, APIs, and application designs for weaknesses in authentication, authorization, session management, input handling, data-access scope, and multi-tenant isolation.
Experience conducting authorized application, API, and AI security testing.
Experience establishing vulnerability triage and remediation practices.
Experience establishing agent identities and least-privilege permissions.
Experience governing model, tool, skill, connector, plug-in, memory, and data access.
Experience validating untrusted inputs and tool outputs, and designing defenses against prompt injection, goal manipulation, tool misuse, privilege escalation, sensitive-data exposure, memory poisoning, unsafe delegation, and cascading failures.
Experience assessing multi-agent workflows.
Experience leading threat modeling and architecture reviews.
Experience developing and demonstrating reusable secure patterns for microservices, APIs, event-driven systems, containers, Kubernetes, cloud services, and agentic AI applications.
Experience contributing to platform roadmaps and engineering practice.
Experience providing evidence from implementation, testing, and incidents.
Experience partnering across distributed engineering hubs.
Experience translating findings into prioritized, actionable engineering work.
Experience mentoring senior engineers and technical leaders in secure design, development, threat modeling, and remediation.
Experience serving as the application and AI security technical lead during incidents.
Experience representing application and AI security in technical, executive, customer, audit, and assurance discussions.

Responsibilities

Design and implement secure patterns across applications, APIs, cloud platforms, and AI-agent systems, with particular emphasis on identity, authorization, tenant isolation, data access, tool use, and runtime guardrails.
Build and tune risk-based controls so material issues are caught and acted on inside delivery workflows, rather than at manual checkpoints.
Find root causes, fix weaknesses at the architecture or platform-pattern level, and make the same class of issue structurally difficult to reintroduce.
Design and implement scalable controls for software and AI supply chains, including dependency integrity, SCA, SAST, DAST, build provenance, artifact security, secrets protection, container and infrastructure-as-code assurance, and software or AI bills of materials where appropriate.
Implement platform-level controls: policy as code, authorization enforcement, data-access guardrails, secure defaults, and reusable reference implementations.
Design AI-assisted security-testing environments, automated attack scenarios, and security-regression suites that prevent resolved issues from silently returning.
Implement risk-based quality gates with documented exception paths, accountable ownership, and service-level expectations, so material issues block release.
Review source code, APIs, and application designs for weaknesses in authentication, authorization, session management, input handling, data-access scope, and multi-tenant isolation, including row- and field-level boundaries.
Conduct authorized application, API, and AI security testing, including targeted manual testing of business logic and trust boundaries that automated tools cannot adequately validate.
Work alongside engineers to remediate root causes, validate fixes, create regression tests, and put preventive controls or secure patterns in place.
Establish vulnerability triage and remediation practices, including exploitability and exposure analysis, accountable ownership, target dates, exception handling, retesting, closure evidence, and escalation of overdue material risk.
Establish agent identities and least-privilege permissions, with clear separation of read, write, execute, approval, and administrative capabilities.
Govern model, tool, skill, connector, plug-in, memory, and data access, including tenant isolation and boundaries between trusted and untrusted context.
Validate untrusted inputs and tool outputs, and design defenses against direct and indirect prompt injection, goal manipulation, tool misuse, privilege escalation, sensitive-data exposure, memory poisoning, unsafe delegation, and cascading failures.
Assess multi-agent workflows to implement approval requirements for consequential or irreversible actions, runtime policy enforcement, rate and resource limits, and tamper-resistant auditability.
Lead high-risk threat modeling and architecture reviews for complex, multi-tenant, cloud-native, event-driven, and AI-enabled systems.
Develop and demonstrate reusable secure patterns for microservices, APIs, event-driven systems, containers, Kubernetes, cloud services, and agentic AI applications.
Contribute to platform roadmaps and engineering practice so controls are implemented at the most effective layer and reused across products.
Provide evidence from implementation, testing, and incidents to help Information Security team continuously improve enterprise standards and assurance expectations.
Partner across distributed engineering hubs, including North America and Chennai, to drive adoption of secure patterns and automation at scale.
Translate findings into prioritized, actionable engineering work reflecting technical severity, exploitability, customer impact, and delivery context.
Mentor senior engineers and technical leaders in secure design, development, threat modeling, and remediation.
Serve as the application and AI security technical lead during relevant incidents – coordinating with designated incident lead and Information Security team to support investigation, containment, eradication, recovery, remediation validation, and lessons learned.
Represent application and AI security in significant technical, executive, customer, audit, and assurance discussions when needed.