Senior Security Engineer, Application

Overview

Firmus Technologies is seeking a Senior Security Engineer, Application for the Engineering and Technology team. The role focuses on owning application security for the Firmus AI Cloud and internal software, covering public APIs, services, tenant separation, and shipped AI assistants and agents.

Requirements

Applicants must hold a Bachelor degree in computer science or a related technical field and possess at least 7 years of experience in application security, product security, or software engineering with a security focus. Candidates need experience securing a public cloud or multi-tenant platform with a public API, deep knowledge of the OWASP Top 10 and OWASP API Security Top 10, and experience threat modelling multi-tenant APIs in production using methods such as STRIDE for REST and gRPC.

Additional qualifications include experience improving software security posture through standards, tooling, and review, owning production CI/CD security gates including SAST, DAST, SCA, secrets detection, and SBOM, and writing production-quality code in Python, Go, or TypeScript. Candidates must have replaced manual security work with automation, possess hands-on experience with LLM-backed or agentic features regarding prompt injection, tool misuse, agent identity, cross-tenant data leakage, and OWASP LLM guidance.

Familiarity is required with OAuth, OIDC, JWT, RBAC or ABAC, application-layer cryptography, token handling, and secrets, as well as working under SOC 2 Type 2 or ISO 27001 standards. Applicants must be willing to join incident response for application and API security, travel overseas occasionally, and communicate clearly in English. Bonus points are awarded for experience securing AI agents, sandboxed code execution environments, or systems where AI-generated output triggers automated actions, running a vulnerability disclosure programme, or holding application-security depth certifications such as CSSLP or OSWE.