Application Engineer

• Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
• Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
• Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
• Evaluate SAST tools and assess their ability to detect genuine vulnerabilities while avoiding false positives.
• Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
• Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
• Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
• Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
• Recommend appropriate security controls and remediation approaches.
• Participate in technical calibration, peer reviews, and quality assurance activities.

Explore Senior Application Security Engineer – GenAI Security Evaluation at Gramian Consulting. Review requirements and application details.