Information Security Engineer IV

What you'll do

• Perform threat modeling, secure design reviews, and code reviews to identify security risks early in the development lifecycle.
• Conduct vulnerability assessments and penetration testing on applications and AI-enabled solutions.
• Integrate and manage application security tools like SAST, SCA, and DAST within CI/CD pipelines.
• Identify and document security requirements and controls based on data sensitivity and system exposure.
• Advise engineering teams on secure coding standards, OWASP guidance, and internal security policies.
• Evaluate AI-specific risks including prompt injection, data leakage, and insecure model integrations.
• Research and pilot new security capabilities and automated AppSec workflows.
• Document findings and remediation recommendations for application teams and security leadership.

What we're looking for

• Bachelor's degree in computer science, Information Security, IT, Engineering, or a related field, or equivalent practical experience.
• 3+ years of experience in information security, application security, product security, software engineering, DevSecOps, or a related technical field.
• Working knowledge of Secure SDLC practices including threat modeling, secure design review, code review, and vulnerability assessment.
• Familiarity with common application security frameworks such as OWASP Top 10, API security, and secure coding practices.
• Experience with application security tools including SAST, DAST, SCA, secrets scanning, or container scanning.
• Basic understanding of CI/CD pipelines and developer tools like Git, Bitbucket, Jenkins, Azure DevOps, or Artifactory.
• Exposure to AI/ML security concepts such as generative AI, RAG, prompt injection, and secure MLOps.
• Security certifications such as Security+, CSSLP, CISSP, or GIAC are preferred but not required.