Application Security Engineer - AI/ML & LLM Security

Location: Princeton, NJ / New York City, NY Hybrid

Client: Altimetrik / S&P Global

Experience: 12+ Years Required

Work Authorization: USC / H-4 EAD OnlyWe are looking for a Senior Application Security Engineer with a strong software engineering background and hands-on experience in Python automation, AI/ML, LLMs, AI agents, and application security. The ideal candidate is not security-adjacent you have built and shipped production code, developed security tooling, automated security workflows, and understand how modern AI/LLM applications introduce new security risks.

Required Experience: 12+ years of overall professional experience in Software Engineering and Application Security, with substantial hands-on development experience. Strong hands-on Python development and automation experience for building security tools, workflows, scripts, and reusable frameworks. Strong experience with Application Security / Product Security / Software Security Engineering. Hands-on experience with Claude Code, including its extensibility capabilities such as: Skills SubagentsHooksSlash commandsMCP integrations Experience using Claude Code or comparable AI coding/agent platforms to develop reusable security workflows and automation. Strong understanding of AI/ML, LLMs, Generative AI, and AI agents. Working knowledge of agentic frameworks and architectures and emerging security risks associated with AI agents. Understanding of OWASP LLM Top 10, including prompt injection, insecure output handling, model-related risks, and sensitive information disclosure. Understanding of AI agent security, including tool permissions, excessive agency, agent-to-agent interactions, prompt injection, and authorization boundaries. Understanding of AI/LLM supply-chain security, including model, library, dependency, tool, and MCP-related risks. Strong experience with Secure SDLC, threat modeling, security architecture, vulnerability management, and application security testing. Strong Knowledge Of Common Vulnerability Classes, IncludingOWASP Top 10API Security Authentication & Authorization InjectionSSRFXSSAccess Control Dependency/Supply Chain Vulnerabilities Ability to determine what should be automated, what requires escalation, and what can be directly remediated.

Nice to Have: Experience securing production LLM, GenAI, or agentic applications. Experience building internal AI/LLM security tooling or security automation platforms. Experience with MCP security and AI agent tool integrations. Experience with AI/ML security frameworks and emerging AI security best practices. Contributions to open-source security tools or projects. Relevant certifications such as OSCP, GWAPT, CSSLP, or equivalent preferred but not required.