Lead Security Engineer - Penetration Testing & AI Security
HighLevel
IndiaremotePosted 1 month ago
Skill Required
Penetration-TestingSecurity-EngineeringApplication-SecurityAI-SecurityCloud-SecurityLead-Security-EngineerAI-Security-LeadLead-Cybersecurity-EngineerSecurity-Engineering-LeadLead-Information-Security-EngineerLead-Penetration-TesterAI-Security-EngineerLead-Application-Security-EngineerSenior-Security-Testing-EngineerAI EngineerSecurity EngineerPenetration TestingsecurityTestNGAIMachine LearningCloud SecurityOWASPMicroservicesCybersecurityCD pipelinesEngineeringKubernetesautomationObservabilitybuildingDockerdesignCI/CDOAuthCloudAPIsIAMRAGJWTandFulltime
Key highlights
- 8+ years of cybersecurity experience required.
- 1‑3 years of AI Security experience required.
- Lead Security Engineer – Application Security & AI Security role.
- Global remote‑first work environment.
- Platform processes over 4 billion API hits daily.
- Opportunity to lead AI security assessments and adversarial testing.
Role overview
HighLevel is seeking a Lead Security Engineer focused on Application Security and AI Security. The role involves leading security reviews, threat modeling, secure SDLC improvements, vulnerability management, and adversarial testing of AI/LLM systems across a large‑scale, AI‑powered SaaS platform.
Responsibilities
- Lead Application Security initiatives across web, mobile, API, microservices, and cloud-native products.
- Conduct architecture reviews, threat modeling, secure design and code reviews, and hands‑on security assessments.
- Identify weaknesses in authentication, authorization, tenant isolation, business logic, data protection, and API security.
- Define practical security standards, requirements, guardrails, and reusable secure engineering patterns.
- Improve security testing across CI/CD pipelines using SAST, DAST, SCA, secret scanning, container scanning, and Infrastructure as Code scanning.
- Drive risk‑based vulnerability triage and remediation in partnership with engineering teams.
- Develop security automation and promote secure coding through developer guidance, documentation, and training.
- Lead security reviews of LLM applications, AI agents, RAG architectures, machine learning services, and third‑party AI integrations.
- Assess AI architectures, including model APIs, data pipelines, vector stores, prompts, fine‑tuning workflows, plugins, and agent tool chains.
- Conduct adversarial testing for prompt injection, jailbreaking, sensitive‑data disclosure, system‑prompt leakage, output manipulation, insecure tool use, excessive agency, and model abuse.
- Evaluate applicable risks involving data poisoning, model inversion, training‑data extraction, adversarial evasion, and model exfiltration.
- Test security controls such as guardrails, input/output filtering, access controls, human approvals, logging, monitoring, and abuse detection.
- Develop repeatable AI security testing methodologies, playbooks, automation, and test cases using tools such as Garak, PyRIT, or similar frameworks.
- Assess security and supply‑chain risks associated with third‑party models, AI platforms, and AI‑enabled SaaS products.
- Produce clear security reports containing evidence, risk ratings, business impact, and actionable remediation guidance.
- Communicate security risks effectively to developers, architects, product leaders, and executive stakeholders.
- Partner with external consultants, researchers, and bug bounty programs for specialized assessments where required.
- Mentor engineers and help establish a security‑conscious engineering culture.
- Stay current with developments in Application Security, AI Security, and adversarial testing.
Requirements
- 8+ years of cybersecurity experience, with deep hands‑on expertise in Application Security, product security, penetration testing, or security engineering.
- Experience conducting threat modeling, architecture reviews, secure code reviews, penetration testing, and vulnerability validation.
- 1-3 years of AI Security experience, with AI/ML security, adversarial testing of AI systems, or applied AI research with a security focus.
- Strong knowledge of web, mobile, API, and cloud‑native security, including OWASP guidance and business‑logic risks.
- Strong understanding of authentication and authorization technologies, including OAuth 2.0, OIDC, JWT, SAML, and modern access‑control models.
- Hands‑on DevSecOps experience with CI/CD security automation, SAST, DAST, SCA, secret scanning, containers, and Infrastructure as Code.
- Practical knowledge of Docker, Kubernetes, microservices, and cloud security.
- Demonstrated experience assessing or securing LLM applications, RAG systems, AI agents, machine learning models, or AI‑enabled products.
- Understanding of AI threats such as prompt injection, jailbreaking, data leakage, insecure tool use, excessive agency, model misuse, and AI supply‑chain risks.
- Familiarity with OWASP guidance for LLM applications, MITRE ATLAS, NIST AI RMF, and related AI security practices.
- Programming or scripting proficiency in Python, Go, JavaScript, Bash, or a similar language.
- Strong written and verbal communication skills, with the ability to influence technical and non‑technical stakeholders.
Nice to have
- Experience building or scaling Application Security practices within a SaaS or product‑led technology organization.
- Hands‑on experience red teaming LLM applications, RAG systems, AI agents, or AI‑enabled products.
- Experience developing security automation, internal testing tools, or reusable security guardrails.
- Contributions to security research, open‑source projects, bug bounty programs, or responsible vulnerability disclosure.
- Relevant certifications such as OSCP, OSWE, GWAPT, GIAC, CISSP, or an AI Security credential.
Benefits
- Global, remote‑first work environment with team members across 15+ countries.
- People‑first culture that emphasizes creativity, collaboration, and impact.
- Opportunity to work on a high‑scale platform processing billions of API hits and messages daily.
- Access to a growing community of over 1 million businesses and a vibrant ecosystem.
- Equal Opportunity Employer with inclusive hiring practices.
Additional details
- HighLevel is an AI powered, all‑in‑one white‑label sales & marketing platform supporting over 1 million businesses worldwide.
- As of mid 2025, the platform processes over 4 billion API hits and handles more than 2.5 billion message events every day.
- The platform manages over 470 terabytes of data distributed across five databases, operates with a network of over 250 microservices, and supports over 1 million hostnames.
- HighLevel has over 1,500 team members across 15+ countries and operates in a remote‑first environment.
- As of mid 2025, the platform powers over 1.5 billion messages, generates over 200 million leads, and facilitates over 20 million conversations each month.
- Learn more about the company on its YouTube Channel or Blog Posts.
- Equal Employment Opportunity Information: demographic data collection is voluntary and will not affect application status.
- Originally posted on Himalayas.