Senior Product Security Engineer – AI & Application Security

We are looking for a hands-on Senior Product Security Engineer to secure enterprise applications and AI-powered products across multiple engineering teams and repositories.

In this role, you will identify and validate real-world vulnerabilities through manual security testing, source-code analysis, threat modeling, and AI red teaming. You will work directly with engineering teams to prioritize risks, drive remediation, and verify fixes across fast-moving development environments.

You will also help strengthen the security of AI-powered applications and agents by identifying emerging risks such as prompt injection, sensitive-data leakage, insecure tool execution, and authorization bypasses.

This is an opportunity for a security engineer who enjoys solving complex technical problems, going beyond automated scanners, and building practical security controls that scale across products.

Title : Senior Product Security Engineer – AI & Application Security

Location :Remote Work

Employment Type: Full-time

Key Responsibilities:

• Perform hands-on security assessments across enterprise applications, APIs, AI-powered products, and multiple code repositories.
• Discover, exploit, validate, and document vulnerabilities through manual testing, source-code review, and security tools.
• Assess web applications and APIs for authentication and authorization weaknesses, business logic flaws, injection vulnerabilities, and other OWASP Top 10 risks.
• Test AI/LLM applications and agents for direct and indirect prompt injection, sensitive-data exposure, insecure tool execution, excessive permissions, and access-control bypasses.
• Conduct threat modeling, architecture reviews, and attack-path analysis to identify security gaps before they reach production.
• Assess cloud environments, IAM policies, containers, Kubernetes workloads, and CI/CD pipelines for security weaknesses.
• Prioritize vulnerabilities based on exploitability, business impact, exposure, and potential consequences—not just scanner severity scores.
• Partner with engineering teams to explain findings, recommend practical fixes, resolve remediation blockers, and verify fixes through retesting.
• Integrate security controls into the software development lifecycle using SAST, DAST, SCA, secrets detection, and automated security gates.
• Develop repeatable security testing approaches, automation, and remediation practices that scale across products and engineering teams.
• Communicate technical findings, business risks, and remediation priorities clearly to technical and non-technical stakeholders.Required Qualifications:
• 4–7 years of relevant experience in Application Security, Product Security, Application Security Engineering, or Offensive Security.
• Strong hands-on experience in web application and API security testing, including manually discovering, exploiting, and validating vulnerabilities.
• Solid understanding of the OWASP Top 10, authentication and authorization flaws, IDOR/BOLA, business logic vulnerabilities, and common web/API attack paths.
• Practical experience using Burp Suite Professional or OWASP ZAP for security testing.
• Experience with source-code security reviews, root-cause analysis, threat modeling, and remediation validation.
• Hands-on exposure to AI/LLM application security testing, including prompt injection, data leakage, or insecure AI agent/tool execution.
• Familiarity with cloud security, IAM, containers, Kubernetes, and CI/CD security practices.
• Experience working with application security tools such as SAST, DAST, SCA, and secrets detection.
• Ability to assess security risks independently, distinguish exploitable vulnerabilities from low-impact findings, and recommend actionable remediation.
• Demonstrated ownership of security findings from discovery and validation through remediation, retesting, and closure.
• Strong analytical, problem-solving, collaboration, and communication skills.Nice to Have:
• Experience securing RAG-based applications, agentic AI systems, MCP integrations, or AI tool-calling workflows.
• Experience with AI red teaming, adversarial testing, or AI-specific threat modeling.
• Experience with security automation or developing scripts and tools to improve vulnerability discovery and validation.
• Experience with GCP/GKE; AWS or Azure security experience is also valuable.
• Familiarity with Docker, Kubernetes security testing, and cloud-native application architectures.
• Certifications such as OSCP, OSWE, GIAC, CREST, or equivalent practical experience.What Success Looks Like
• Real-world vulnerabilities are identified and validated before they become production incidents.
• Critical security risks are prioritized according to actual exploitability and business impact.
• Engineering teams receive clear, actionable remediation guidance, and findings are tracked through verified closure.
• Security controls and testing practices scale across multiple applications and repositories without unnecessarily slowing delivery.
• AI-powered products and agents are assessed for security risks that traditional scanners may miss.

About Techolution:

Techolution is the world’s leading FEA – Full Enterprise Automation specialist. We are trusted by boards and executive leaders who need AI with real business outcomes. Despite Gen AI, LLMs, and billions in investment, most enterprise AI programs aren't delivering results.

Techolution fixes that with BPA 4.0. We take the power of big Tech’s Generic AI and multiply it with our Expert AI stack — resulting in business process automations that follow the same nuances as domain experts do on the job at an unprecedented speed.

Our platform has delivered over $900M in AI ROI for our clients in less than a year, all while increasing their AI Adoption by 10x.

Our 3 power moves for ROI from AI:

1. Value Finder - We Identify high-impact AI and automation opportunities in enterprises and build solutions that deliver measurable value in as little as 30 days.

2. 100K Challenge: Work on fast-paced AI initiatives where teams build solutions designed to generate 2× ROI within 100 days.

3. GE LEAP: Contribute to enterprise AI transformation through our partnership with Google, helping scale Gemini-driven solutions across organizations.

Visit us @www.techolution.com : To know more about our revolutionary core practices and getting to know in detail about how we enrich the human experience with technology.