Job Description
JD
\n
Job Description: Security Engineer, Design Review, Threat Modeling & AI Agent Security
\n
\n
Key Information
\n
\n
• Positions: 5 Security Engineers
\n
• Duration: 6 months (extension possible)
\n
• Commitment: ~40 hours/week
\n
• Location: Seattle preferred, Sunnyvale secondary
\n
• Experience: 3+ years
\n
\n
Skills Required
\n
\n
• Strong experience in security and privacy design reviews for services, applications, APIs, cloud environments, and AI integrations.
\n
• Proven expertise in threat modeling, including attack-surface analysis, trust-boundary identification, threat scenarios, attack paths, mitigations, and residual-risk assessment.
\n
• Hands-on security and adversarial testing experience across applications, APIs, and third-party AI/LLM agents.
\n
• Knowledge of AI agent security risks, including prompt injection, unsafe tool use, excessive agency, permission-scope weaknesses, guardrail bypass, and sensitive-data exposure.
\n
• Understanding of cloud security, API security, authentication, authorization, and least-privilege design principles.
\n
• Familiarity with STRIDE, attack trees, and MITRE ATT&CK mapping.
\n
• Ability to document risk-rated, evidence-backed findings and clearly communicate with engineering, privacy, security, and vendor stakeholders.
\n
• Exposure to Python or Go scripting and security automation is preferred.
\n
• OSCP, CISSP, or other relevant security certification is preferred.
\n
\n
Roles & Responsibilities
\n
\n
• Conduct security and privacy design reviews of services, applications, APIs, and AI integrations, covering architecture, data flows, trust boundaries, identity, and access controls.
\n
• Develop threat models for critical services and AI agents, documenting attack surfaces, abuse cases, attack paths, recommended mitigations, and residual risks.
\n
• Perform hands-on adversarial testing of third-party AI agents, including prompt-injection testing, unsafe tool-use scenarios, permission validation, excessive-agency testing, and sensitive-data exposure assessment.
\n
• Produce clear, risk-rated, and evidence-backed findings with practical remediation guidance.
\n
• Partner with engineering teams throughout remediation, validation, and retesting to support timely closure of identified risks.
\n
• Create and maintain reusable security-review checklists, threat-model templates, adversarial test cases, and reporting standards.
\n
• Work within the client-defined review queue, priorities, turnaround expectations, and engineering security processes.
\n
• Provide weekly reporting on review throughput, risk themes, remediation progress.