Senior Application Security Engineer – GenAI Security Evaluation

Gramian Consulting

. Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.

Posted 11/8/2026contractRemote • Indonesia, Nigeria, Turkey, United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in application security, focusing on secure code reviews, vulnerability identification, and the development of security scenarios. Proficient in utilizing security analysis tools and implementing robust authorization models to ensure data protection and compliance.

Highest-signal resume keywords

Application SecurityStatic Application Security Testing (SAST)Source-To-Sink AnalysisSecurity Analysis Tools (CodeQL, Semgrep)Production-Level Coding (Python, TypeScript)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Secure Code ReviewsVulnerability IdentificationTaint AnalysisDeterministic TestingAuthorization ModelsData Flow AnalysisSecurity Controls RecommendationAgent Memory DevelopmentModel Context Protocol (MCP)RAG Applications

Soft Skills

Analytical SkillsTechnical Communication

Tools & Technologies

CodeQLSemgrepLangChainLlamaIndexOpenAI SDKAnthropic SDK

Industry Keywords

Sensitive Information DisclosureExcessive Agency VulnerabilitiesMulti-Tenant AuthorizationAccess ControlIdentity Management

Tech Stack

Tools & technologies

PythonTypeScript

About the role

Key responsibilities & impact

Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
Evaluate static application security testing (SAST) tools and assess their ability to detect genuine vulnerabilities while avoiding false positives.
Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
Recommend appropriate security controls and remediation approaches.
Participate in technical calibration, peer reviews, and quality assurance activities.

Requirements

What you’ll need

5+ years of professional experience in application security, product security, or security-focused software engineering.
Strong experience conducting secure code reviews and identifying application-level vulnerabilities.
Practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST).
Hands-on experience with security analysis tools such as CodeQL or Semgrep.
Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.
Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).
Strong understanding of authorization models, including actors, identities, trust boundaries, multi-tenant authorization, access control, OAuth, IAM, identity management, permitted data access and actions, purpose and recipient restrictions, and document-level access control.
Production-level coding experience in Python and/or TypeScript.
Ability to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.
Strong analytical skills and ability to communicate technical security findings clearly.