Application Security Engineer

• Abnormal AI is looking for an Application Security Engineer II to secure the AI-powered systems at the core of our AWS-based platform (LLM-integrated features, agentic workflows, MCP connectors, and the model supply chain) against threats like prompt injection at production scale
• . This is an individual contributor role that blends deep application security expertise with strong engineering fundamentals
• You’ll focus on integrating security into every phase of our software development lifecycle, conducting comprehensive security reviews, and partnering with engineering teams to build defensible architectures
• You will own the security architecture and development of secure coding practices while ensuring security is a foundational partner to our engineering stakeholders
• You’ll coach developers across the engineering organization on application security principles, act as a technical liaison across teams, and contribute directly to keeping our applications and customers secure. This role reports to the Director of Security Engineering
• Lead threat modeling and security architecture reviews with engineering teams by translating security risks into concrete development actions, with particular focus on AI-powered features (LLM integrations, agentic workflows, MCP connectors)
• Architect, build, and maintain security tooling and integrations that make secure development the default in our CI/CD pipelines
• Design and deploy automated security testing to identify vulnerabilities early in the development process
• Serve as a hands-on technical contributor during security incidents by analyzing application-level behavior and enhancing response processes
• Coach developers on secure coding, security architecture, and threat modeling for AI-native systems
• Define and track key security posture metrics, building dashboards or reports to visualize security coverage and vulnerability trends

Benefits

• Healthcare
• Flexible PTO
• 401k
• One Medical
• Flexible Spending Account
• Mental Health Resources
• Home Office Stipend
• Monthly Internet & Phone Stipend
• Health and Wellness Stipend- Strong programming skills in Python, Go, Java, or JavaScript/TypeScript. You write and read production code, not just review it
• Expertise in web application security including OWASP Top 10, authentication/authorization, cryptography, and secure API design, including securing modern architectures (microservices, containers, cloud-native)
• 5+ years of experience in application security engineering roles, ideally securing AWS or comparable cloud-native environments with modern development practices
• Experience securing AI/ML-powered systems, or a clear ability to ramp fast on prompt injection, model supply chain, and agentic-workflow risks
• Hands-on experience threat modeling and running security architecture reviews
• Proven ability to influence and collaborate cross-functionally with engineering, DevOps, and product teams, with strong written communication
• Experience working in fast-paced or startup environments, comfortable defining scope in a growing security program
• Hands-on experience with commercial security tools (Veracode, Checkmarx, SonarQube, Wiz, Semgrep, Burp Suite)
• Exposure to compliance frameworks (SOC 2, ISO 27001) and how development decisions affect auditability
• Prior experience building security telemetry pipelines or vulnerability management frameworks
• Familiarity with bug bounty programs and vulnerability disclosure processes- If your application is successful and Abnormal AI makes a conditional offer of employment, we will carry out pre-employment checks which must be successfully completed to progress to a final offer. All processes and pre-employment checks are in line with prevailing legislation and Abnormal AI’s policies relevant to our security and privacy standards
• We review every submission and typically respond within two weeks