Staff Security Engineer

AppViewX, Coimbatore

The role

AppViewX is building Agent Identity Security and shipping AI-enabled features into products that secure the machine and agent identities of the world’s largest enterprises. Internally, every business unit is moving to AI-augmented and increasingly agentic workflows. Our customers, auditors, and board expect us to be the most credible practitioner of AI security in our category, not just a vendor of it.

This role has two mandates that reinforce each other. First, secure AI and agentic AI: the models, agents, tools, MCP servers, data pipelines, and identities across both our products and our corporate environment. Second, use AI and agents to secure AppViewX: automate detection, triage, testing, and assurance so a lean team operates at a scale that would otherwise take several times the headcount. This is a Senior-level role: you are strong across every domain of security and privacy engineering, you operate with minimal direction in ambiguity, and you mature the technical and administrative controls of the whole organization as the technology changes beneath us.

All jobs

Staff Security Engineer

AppViewX, Coimbatore

The role

What you need

What You Bring/Qualifications

Full-stack security and privacy engineering. Act as the technical lead across AppSec and product security, cloud and infrastructure, identity and secrets, vulnerability and exposure management, detection and response, and privacy engineering (data minimization, DPIAs, retention, data subject requests, sub-processor and DPA controls under GDPR). Go deep where the risk is, and know when to pull in specialists.
Technical and administrative controls. Own the maturity path for both: engineering controls (guardrails, pipelines, configurations, monitoring) and administrative controls (policies, standards, procedures, exception handling, training, and ownership). Make them measurable, mapped to SOC 2, ISO 27001, NIST CSF 2.0, and PCI DSS, and operating continuously rather than at audit time.
Ambiguity and change. Take loosely defined problems in a fast-moving AI landscape, frame the risk, propose options with trade-offs (accept, mitigate, defer), make a recommendation, and drive it to done. Revisit decisions as models, agent frameworks, regulations, and attacker tradecraft evolve.
Technical leadership without hierarchy. Set engineering standards, review designs, coach AppSec, ProdSec, and Red Team engineers, and mentor junior engineers in India. Influence Product, Engineering, SRE, and IT leaders through credibility and clear business-impact reasoning.
Incident and surge readiness. Serve as a technical lead in high-severity incidents and vulnerability surges, including AI-related events, and turn post-incident learning into durable control improvements.

Required

Six or more years in security engineering, including senior or equivalent scope, and at least two years of hands-on, production-level work securing LLM and agentic AI systems (not just policy or assessment).
Strength across the breadth of security and privacy engineering: AppSec, cloud, identity, vulnerability management, detection and response, and privacy engineering, with deep expertise in at least two.
Track record of maturing both technical and administrative controls across an organization (policies, standards, guardrails, evidence), in a high-growth SaaS environment.
Proven ability to operate in ambiguity: you set direction without a playbook, make defensible risk-based calls, and keep delivering as the landscape shifts.
Demonstrated depth in the LLM and agent stack: prompt injection and jailbreak classes, tool-calling and function-calling risks, RAG and vector store security, memory and context handling, MCP and agent protocols, and multi-agent trust boundaries.
Expert-level AI penetration testing and adversarial testing: you have attacked real LLM applications and agentic systems end to end, found and chained exploitable issues (for example indirect prompt injection to tool abuse to data exfiltration), written clear reproducible reports, and driven remediation with engineering.
Mastery of the OWASP Top 10 for LLM Applications, with practical attack and defense experience across every category, plus OWASP agentic AI guidance and MITRE ATLAS.
Fluency with AI red-team tooling and methods, such as Garak, PyRIT, Promptfoo, or equivalents, and the ability to build custom attack harnesses and evaluation suites.
You have built and operated AI agents or LLM-powered tooling that perform security work, with evaluation and guardrails, and can speak to what failed in production and what you changed.
Strong Python for security tooling, automation, and adversarial testing; comfortable with APIs, CI/CD, and cloud-native environments.
Hands-on with at least one AI security platform or LLM evaluation and guardrail framework.
Working knowledge of NIST AI RMF and the ability to translate OWASP, MITRE ATLAS, and NIST guidance into engineering controls.
Sound judgment on identity and least privilege for non-human actors: OAuth, workload identity, secrets handling, and scoped, short-lived credentials.
Self-starter and go-getter: you find the problem, own it, and finish it, without waiting to be assigned.
Clear written and verbal communication; you can brief a CISO, challenge an engineering lead, and write a threat model another engineer can implement.

Securing AI and agentic AI

AI security threat modeling. Author and maintain threat models for AI-enabled product changes and internal agent deployments, covering prompt injection (direct and indirect), tool misuse, excessive agency, data exfiltration, memory and context poisoning, and cross-agent trust. Align to OWASP LLM Top 10, OWASP Agentic AI threats, and MITRE ATLAS.
Agent identity, permissioning, and tool-call controls. Define and implement least-privilege, short-lived, auditable identities and scoped credentials for agents; human-in-the-loop gates for high-impact actions; and sandboxing, egress control, and policy enforcement around tool calls and MCP servers. This is our core domain, and we should be the reference implementation.
Prompt and output safety in product. Build input and output guardrails, content and data-leak filters, and structured-output validation into AI-enabled product features, delivered as reusable components engineering can adopt by default.
AI penetration testing and adversarial testing. Lead hands-on penetration tests and adversarial campaigns against AppViewX AI features, internal agents, RAG pipelines, and MCP servers, covering every category of the OWASP Top 10 for LLM Applications and the OWASP agentic threat taxonomy: prompt injection, insecure output handling, training data and context poisoning, model denial of service, supply chain, sensitive information disclosure, insecure plugin and tool design, excessive agency, overreliance, and model theft. Use manual tradecraft plus automated attack agents and fuzzing, scope and run external AI pen test vendors, and turn every finding into a fixed control, regression test, and detection, not a slide deck.
Product and corporate scope. Cover both sides of the house: AI security for AppViewX products (including Agent Identity Security) and for the corporate environment (employee AI tools, agents, connectors, and the data they touch). Feed AI security findings into Jira and the SOC alert pipeline so product and corporate risk is managed in one view.
AI supply chain security. Partner with engineering on model, dataset, and dependency provenance: model and weights integrity, third-party model and agent-platform risk, MCP server and plugin vetting, and AI-BOM practices.
AI security in the SDLC. Embed evals, safety regression tests, and policy checks in CI/CD so secure AI patterns are the fastest path for engineers.

Staff Security Engineer

The role

Staff Security Engineer

The role

What you need

What You Bring/Qualifications

Required

Nice to have

Securing AI and agentic AI

Using AI and agents to secure AppViewX

Governance and customer trust

About AppViewX

Similar jobs at other companies

System Requirements Engineer, In-Cabin Perception

シニアコンピュータビジョン／機械学習エンジニア・Digital Twin Platform

Senior Technical Program Manager, Active Learning Loop

バックエンドエンジニア・Robot Platform Software

データエンジニア・City Data Platform Development（障害者雇用）

システム要求エンジニア・In-Cabin Perception

AppViewX