Senior Application Security Engineer - GenAI Security Evaluation

Gramian Consulting Group

8h•Remote

About The Position

Gramian Consultancy is seeking experienced Application Security Engineers and Security-Focused Software Engineers for a specialized AI security evaluation project. The role evaluates how effectively static analysis tools identify security vulnerabilities in Generative AI applications, particularly LLM agents and Retrieval-Augmented Generation (RAG) systems. The engineer will build small, runnable repositories with realistic examples of Sensitive Information Disclosure (SID) and Excessive Agency (EA) vulnerabilities, along with fixed and near-miss versions. The work includes analyzing code paths, identifying security weaknesses, defining authorization contexts, developing deterministic tests, and documenting findings. The project aims to improve the reliability of security tools and strengthen evaluation of application-level vulnerabilities in AI systems. The position is remote and focuses on Python, TypeScript, SAST, CodeQL, Semgrep, LLM agents, RAG, and MCP. Hands-on experience building LLM agents or RAG applications is required.

Requirements

At least 5 years of professional experience in application security, product security, or security-focused software engineering.
Strong experience conducting secure code reviews and identifying application-level vulnerabilities.
Practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST).
Hands-on experience with security analysis tools such as CodeQL or Semgrep.
Hands-on experience building LLM agents or RAG applications.
Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).
Strong understanding of authorization models, including actors, identities, trust boundaries, multi-tenant authorization and access control, OAuth, IAM, identity management, permitted data access and actions, purpose and recipient restrictions, and document-level access control.
Production-level coding experience in Python and/or TypeScript.
Ability to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.
Strong analytical skills and ability to communicate technical security findings clearly.

Responsibilities

Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
Evaluate static application security testing (SAST) tools and assess their ability to detect genuine vulnerabilities while avoiding false positives.
Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
Recommend appropriate security controls and remediation approaches.
Participate in technical calibration, peer reviews, and quality assurance activities.