Security Technologist II, Design Review

What you'll do

• Conduct security and privacy design reviews for services, applications, APIs, and AI integrations.
• Perform threat modeling to identify attack surfaces and potential paths for critical services and AI agents.
• Execute hands-on adversarial testing on third-party AI agents to evaluate risks like prompt injection and data exposure.
• Evaluate sensitive-data handling practices across systems to ensure compliance with privacy requirements.
• Document actionable findings with clear risk assessments and practical remediation guidance for engineering teams.
• Build AI-powered automation and security tooling to scale assessment processes and reduce repetitive tasks.
• Develop reusable assessment materials, including checklists and test cases, to standardize team workflows.

What we're looking for

• 3+ years of experience in security engineering, application security, product security, offensive security, or related technical roles.
• Bachelor's degree in Computer Science, Information Security, Engineering, or a related technical field, or equivalent practical experience.
• Experience reviewing technical designs and identifying risks in applications, APIs, cloud services, or distributed systems.
• Experience performing threat modeling, analyzing attack paths, and recommending mitigations based on risk and impact.
• Understanding of security and privacy principles including authentication, authorization, least privilege, and sensitive data protection.
• Hands-on experience with security testing, vulnerability investigation, or validating the effectiveness of security controls.
• Experience writing code or automation in Python, Go, Bash, or similar, and familiarity with AI-assisted development workflows.
• Ability to communicate technical findings clearly to both technical and non-technical audiences.
• Experience conducting assessments of third-party AI agents, LLM applications, or systems interacting with external tools (preferred).
• Experience performing privacy design reviews and evaluating data flows for sensitive information (preferred).
• Experience assessing AI-specific risks like prompt injection or unintended data disclosure (preferred).
• Experience building internal security tooling or using AI to automate design analysis and threat modeling (preferred).
• Experience assessing security across interconnected cloud services, enterprise SaaS platforms, and third-party integrations (preferred).
• Experience coordinating multiple assessments and driving findings through remediation with engineering teams and vendors (preferred).