Senior Application Security Engineer – GenAI Security Evaluation

Gramian Consulting

. Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.

Posted 11/8/2026contractRemote • Bangladesh, Brazil, Colombia, Egypt, Ghana, IndiaSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in application security and secure code reviews, with a strong focus on identifying vulnerabilities and implementing effective security controls. Proficient in source-to-sink analysis and security analysis tools, with a solid understanding of authorization models and multi-tenant access control.

Highest-signal resume keywords

Application SecuritySecure Code ReviewsSource-To-Sink AnalysisStatic Application Security Testing (SAST)Python Programming

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Vulnerability IdentificationSecurity Controls RecommendationDeterministic TestingTaint AnalysisCodeQLSemgrepModel Context Protocol (MCP)Authorization ModelsAccess ControlMulti-Tenant Authorization

Soft Skills

Analytical SkillsTechnical Communication

Tools & Technologies

LangChainLlamaIndexOpenAI SDKAnthropic SDKRAG Applications

Industry Keywords

Sensitive Information DisclosureExcessive Agency VulnerabilitiesPeer ReviewsQuality AssuranceSecurity Analysis

Tech Stack

Tools & technologies

PythonTypeScript

About the role

Key responsibilities & impact

Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
Evaluate SAST tools and assess their ability to detect genuine vulnerabilities while avoiding false positives.
Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
Recommend appropriate security controls and remediation approaches.
Participate in technical calibration, peer reviews, and quality assurance activities.

Requirements

What you’ll need

5+ years of professional experience in application security, product security, or security-focused software engineering.
Strong experience conducting secure code reviews and identifying application-level vulnerabilities.
Practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST).
Hands-on experience with security analysis tools such as CodeQL or Semgrep.
Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.
Familiarity with LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).
Strong understanding of authorization models, actors, identities, trust boundaries, multi-tenant authorization, access control, OAuth, IAM, identity management, permitted data access and actions, purpose and recipient restrictions, and document-level access control.
Production-level coding experience in Python and/or TypeScript.
Ability to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.
Strong analytical skills and ability to communicate technical security findings clearly.