AI Security Engineer / Product Security Engineer

At Techolution, we build enterprise AI-powered solutions that automate complex business processes and deliver measurable business outcomes. As our AI capabilities expand, securing applications, APIs, cloud environments, and intelligent AI-agent workflows is critical to protecting our products, customers, and enterprise data.

We are looking for a hands-on Product Security Engineer who thinks like an attacker, independently discovers and validates vulnerabilities beyond automated scan results, and works directly with engineering teams to secure our products. The ideal candidate can investigate real-world attack paths across web applications, APIs, cloud-native environments, and AI-powered systems, take ownership of findings from discovery through verified remediation, and help embed security into the software development lifecycle.

Title : Product Security Engineer

Location :Remote Work

Employment Type: Full-time

Exp Range : 2+ Years

Key Responsibilities:

• Application & API Security: Conduct hands-on penetration testing of web applications and APIs. Identify, exploit, and validate vulnerabilities involving authentication, authorization, access control, injection, business logic, and OWASP Top 10 risks. Go beyond automated scanner findings to independently discover and demonstrate exploitable attack paths.
• AI & Agent Security: Perform hands-on security assessments of LLM-powered applications, RAG pipelines, and AI-agent and multi-agent workflows. Investigate indirect prompt injection, sensitive data exfiltration, RAG poisoning, authorization and trust-boundary bypasses, excessive agent permissions, privilege escalation, and unsafe tool execution. Demonstrate practical attack scenarios and assess their impact on enterprise data, systems, and business workflows.
• Exploit Validation & Root-Cause Analysis: Use Burp Suite or OWASP ZAP, HTTP traffic analysis, manual testing, and source-code review to investigate vulnerabilities. Reproduce attack paths, validate actual impact, identify root causes, and recommend actionable technical fixes rather than relying solely on scan reports.
• Cloud & Infrastructure Security: Identify and validate security weaknesses involving cloud IAM, application configurations, containers, Kubernetes/GKE, repositories, secrets management, and CI/CD pipelines. Investigate how infrastructure and application weaknesses could be chained into broader attacks.
• Vulnerability Ownership & Remediation: Own security findings from discovery through verified closure. Prioritize vulnerabilities based on exploitability, exposure, severity, and business impact. Work directly with engineering teams to implement fixes, retest remediation, and ensure that vulnerabilities are properly resolved.
• Security Automation & Prevention: Develop and improve repeatable security testing workflows. Automate relevant vulnerability checks and integrate preventive security controls into development and CI/CD pipelines. Help detect recurring engineering mistakes and prevent vulnerabilities before code reaches production.
• Secure SDLC & Engineering Collaboration: Partner with developers, architects, and platform teams to incorporate security into application design, code development, testing, and deployment. Promote secure coding practices, effective security gates, and practical controls that reduce recurring vulnerabilities.
• Security Reporting & Risk Reduction: Maintain visibility into discovered, validated, open, and remediated vulnerabilities. Provide weekly security reports covering attack paths, severity, business impact, remediation status, recurring weaknesses, and measurable progress in reducing product security risk.
• Continuous Security Improvement: Proactively assess evolving threats to enterprise applications and AI-powered systems, identify gaps in existing security controls, and recommend improvements to the organization's security testing and prevention capabilities. Contribute to building scalable security practices as the product and security function grow.

Qualifications:

• Application & API Security: Proven hands-on experience in Application Security or Product Security, with strong knowledge of web application security, API security, OWASP Top 10, authentication, authorization, access control, injection, and business logic vulnerabilities.
• Manual Penetration Testing: Ability to independently identify, exploit, validate, and document real-world vulnerabilities using Burp Suite, OWASP ZAP, HTTP traffic analysis, and other relevant security testing techniques. Must be comfortable investigating attack paths beyond automated scanner output.
• AI & GenAI Security: Practical understanding of security risks in LLM-powered applications, RAG pipelines, and AI-agent workflows, including direct and indirect prompt injection, sensitive data leakage, RAG poisoning, authorization bypasses, trust-boundary violations, excessive permissions, and unsafe tool execution.
• Exploit Reasoning & Technical Validation: Ability to explain an attacker's approach, reproduce vulnerabilities, demonstrate technical impact, distinguish theoretical weaknesses from exploitable issues, and identify the underlying cause of a security finding.
• Source-Code Review & Remediation: Ability to review application code, trace vulnerabilities to their root causes, and recommend practical fixes that engineering teams can implement and validate.
• Cloud-Native & DevSecOps Security: Working knowledge of cloud security, IAM, containers, Kubernetes/GKE, GitHub repositories, secrets management, and CI/CD pipelines, including identifying security weaknesses across application infrastructure and software delivery workflows.
• Vulnerability Management & Ownership: Experience prioritizing security findings based on exploitability, exposure, severity, and business impact; collaborating with developers on remediation; retesting fixes; and driving vulnerabilities to verified closure.
• Security Automation & Secure SDLC: Familiarity with SAST, DAST, and SCA tools, security gates, and integrating practical security controls into development and deployment pipelines. Ability to identify opportunities to automate recurring security checks and prevent regressions.
• Enterprise Product Security: Ability to assess multiple applications, repositories, or products independently, work across engineering teams, and investigate security issues in a fast-paced product development environment.
• Technical Communication & Reporting: Ability to clearly communicate exploitation paths, technical findings, business risks, remediation recommendations, and security progress to engineers and leadership.