[All remote jobs](https://jobicy.com/jobs.md)[![Brain Co. logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/b2bdd014-221.png)](https://jobicy.com/company/brain-co.md)[Brain Co.](https://jobicy.com/company/brain-co.md) # AI Application Security Engineer AI Summary Brain Co. is seeking a hands-on application and AI security engineer to establish secure-by-default practices for agentic products used in regulated industries. The role owns application-layer security across secure SDLC controls, threat modeling, authentication and authorization, secrets management, third-party integrations, and sensitive-data protection. The engineer will build code-level guardrails and automated security tooling, partnering closely with product, ML, and platform teams. Success requires strong application security expertise as well as practical understanding of LLM and agent authorization, tool scoping, output validation, and auditability. This is a high-agency role with broad ownership in a fast-moving production engineering environment.[Apply for this job](#job-application)[View company](https://jobicy.com/company/brain-co.md)ShareRemote from[UK](https://jobicy.com/job-region/uk.md), [USA](https://jobicy.com/job-region/usa.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished4 Nov 2026Apply before4 Dec 2026Listing views15Application actions1Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. ### Our Mission Rebuild how the world works, to make institutions work better for the people they serve. ### About Brain Co. Brain Co. builds AI-native operating systems for large, regulated institutions. Each system is built for a specific industry, powered by agents that push real workflows forward. Underneath it all is Atlas, our proprietary platform that keeps customers in control, secure by design, and never locked into one model. ### Why Now Brain Co. is entering its next phase of production deployments on a national scale with an elite team built from Palantir, Google, Meta, and Nvidia, and a growing footprint across government, insurance, health, and financial services. Joining now means shaping both the company and a new category of applied AI. Every project here ships to production and is expected to create measurable customer value and impact. You’ll work alongside exceptional peers on some of the hardest problems in applied AI. It’s the kind of work you’ll still be proud of in ten years from now. ### About the Role As our Security Engineer, Application & AI, you will own the security of our products and application layer — secure development practices, agent security, third-party integration security, and data protection for AI products operating in some of the world’s most regulated and sensitive environments. This is a hands-on builder role. You will write code, ship security tooling, and work directly with product and ML engineers to build security in from the start rather than bolt it on after. You are expected to work AI-natively: using AI to write threat models, automate security review, scale code analysis, and build internal tooling. This is not a nice-to-have — it is how the role is designed to operate and how one person can have outsized impact across a fast-moving engineering organization. Brain Co.’s products are built on agentic infrastructure — AI that takes actions, calls tools, and operates inside complex institutional workflows. The degree varies by product, but the underlying security surface is consistent: how agents are authorized, what they can touch, and how that is controlled at the application layer. This role is specifically designed to address that surface, working alongside the Infrastructure Security Engineer who owns the platform layer underneath. ### What You’ll Work On Application Security * Own secure development practices across our products: AuthN/AuthZ patterns, secrets management, input handling, and secure-by-default standards that engineers can follow without security becoming a bottleneck. * Integrate security into the development lifecycle — code review, CI/CD pipelines, and pre-deployment checks — catching risk before it reaches production. * Conduct threat modeling across product features and release cycles, translating risk into concrete controls that ship alongside each product. * Build and maintain security tooling and automated checks that scale your reach across the codebase — using AI to move faster and cover more ground than manual review alone could. Agent & Integration Security * Own the application-layer security model for Brain Co.’s agentic products — how agents are scoped, what they are authorized to do on behalf of users, and where trust boundaries sit between the agent and the external systems it touches. * Define secure patterns for how agents integrate with third-party systems and APIs: how credentials are stored and scoped, how responses are validated before being acted on, and how each product limits what agents can do with what they get back. * Work directly with product and ML engineers during feature development to define secure agent design patterns: tool scoping, permission boundaries, output validation, and safe handling of user context across multi-step workflows. * Build reusable secure-by-default patterns for agent development — design guidelines, review checklists, and code-level guardrails — so that security standards scale as new agent capabilities are built. * Produce security artifacts for agent features and product deployments: threat models, architecture reviews, and documentation that supports delivery into regulated customer environments. Data Protection * Define and enforce data protection standards at the application layer — ensuring sensitive customer data (PHI, PII, government records) is handled correctly as it flows through AI pipelines and surfaces in agent outputs. * Build safeguards against unauthorized data exposure across our products: access controls, output filtering, and audit logging that make data handling attributable and reviewable. * Design secure data handling patterns for AI features operating on regulated data, working with platform and ML teams to ensure the application layer upholds its share of the data protection contract. ### You Might Be a Great Fit If You… * Have 5+ years of experience in application security or product security, with hands-on experience on production systems at scale. * Are a builder first — you write code and ship security tooling, and see embedding security into the engineering workflow as the job, not a side effect of it. * Have deep fluency in application security fundamentals: OWASP Top 10, AuthN/AuthZ, secure SDLC, secrets management, secure integration patterns, and cryptography basics. * Understand the security surface of agentic AI across the product layer — how agents should be designed, scoped, and reviewed for risk — and can work shoulder-to-shoulder with engineers to build those standards in. * Have experience protecting sensitive data at the application layer: access controls, audit logging, and preventing data exposure through third-party integrations and AI-generated outputs. * Work AI-natively — you already use AI to write better code, move faster, and do more with less, and you bring that same instinct to security work. * Think in attack surfaces and trust boundaries and can move cleanly from threat model to concrete shipped control. * Are comfortable working alongside delivery teams shipping into regulated industries, understanding their constraints and translating them into product-level security requirements. * Thrive in high-agency environments and want to own and grow the application security function as the company scales. ### Bonus Points For * Experience with agent security, LLM application security, or building authorization and guardrail systems for agentic pipelines. * Familiarity with compliance frameworks relevant to government and healthcare: FedRAMP, HIPAA, SOC 2, ISO 27001. * Proficiency in Python, Go, or TypeScript for security tooling and automation. * Experience with SAST/DAST tooling or integrating automated security checks into developer workflows at scale. ### Why Join Us * Define what application and AI security looks like at a company building frontier AI for governments, hospitals, and critical industries — from the ground up. * Work directly alongside product and ML teams shipping agentic AI into some of the world’s most demanding institutional environments. * Build the security function AI-natively — using the same technology you’re helping secure to scale your own work and impact. * Work alongside senior engineers from Tesla, DeepMind, Databricks, and other top engineering organizations. * Ship fast, learn constantly, and see your work protect production systems used by millions of people. * Earn competitive compensation and meaningful equity in a high-growth company. ### Benefits * Competitive salary plus equity * Daily lunches * Commuter benefits * 401(k) * Medical, Dental, and Vision * Unlimited PTO Show more [Apply now >](https://jobicy.com/jobs/158889-ai-application-security-engineer.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis role combines senior application-security ownership with the emerging security challenges of agentic AI and highly regulated deployments. It requires translating threat models into scalable engineering controls while collaborating deeply across product, ML, and infrastructure functions. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$230,000US market range (per year)$180k–$290k0$319k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No numeric employer salary is disclosed. The yearly cadence is inferred from the full-time senior engineering role and standard US compensation conventions; the displayed USD figures are AI-estimated market compensation for an experienced application and AI security engineer. ## Core skills Skills and capabilities most closely associated with this opportunity. [Application Security](https://jobicy.com/jobs?search_keywords=Application%20Security.md)[AI Security](https://jobicy.com/jobs?search_keywords=AI%20Security.md)[LLM Security](https://jobicy.com/jobs?search_keywords=LLM%20Security.md)[Threat Modeling](https://jobicy.com/jobs?search_keywords=Threat%20Modeling.md)[Secure SDLC](https://jobicy.com/jobs?search_keywords=Secure%20SDLC.md)[Authentication and Authorization](https://jobicy.com/jobs?search_keywords=Authentication%20and%20Authorization.md)[Secrets Management](https://jobicy.com/jobs?search_keywords=Secrets%20Management.md)[Data Protection](https://jobicy.com/jobs?search_keywords=Data%20Protection.md)[OWASP Top 10](https://jobicy.com/jobs?search_keywords=OWASP%20Top%2010.md)[Security Automation](https://jobicy.com/jobs?search_keywords=Security%20Automation.md)[CI/CD Security](https://jobicy.com/jobs?search_keywords=CICD%20Security.md)[API Security](https://jobicy.com/jobs?search_keywords=API%20Security.md)[SAST/DAST](https://jobicy.com/jobs?search_keywords=SASTDAST.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[Audit Logging](https://jobicy.com/jobs?search_keywords=Audit%20Logging.md) Sample interview questionsHow would you threat-model an AI agent that can call third-party APIs on a user's behalf?I would identify the assets, actors, tool permissions, trust boundaries, and data flows first. I would then enumerate risks such as prompt injection, confused-deputy behavior, excessive permissions, unsafe tool outputs, credential leakage, and unauthorized data disclosure. The resulting design would use least-privilege scoped credentials, explicit authorization checks per action, validated tool responses, audit logs, and policy-based guardrails. Describe how you would embed security into a fast-moving engineering team's development lifecycle. I would make secure patterns easy to adopt through reusable libraries, templates, review checklists, CI checks, and clear ownership. High-signal automated checks would run early in pull requests and deployment pipelines, while threat modeling would focus on meaningful feature and architecture changes. I would measure adoption and recurring findings, then improve controls rather than relying on manual reviews alone. What controls would you use to protect PHI and PII in an AI-enabled application? I would apply data minimization, strong authentication and authorization, encryption, scoped service identities, retention controls, and comprehensive audit logging. For AI workflows, I would add input and output filtering, context isolation, controlled retrieval access, redaction where appropriate, and validation to prevent sensitive content from being exposed through agent actions or generated responses. How do you distinguish application-layer AI security from infrastructure security? Infrastructure security protects the underlying platform, networks, compute, identity foundations, and runtime environment. Application-layer AI security focuses on product behavior: user and agent permissions, tool invocation, integration trust boundaries, sensitive-data flow, output handling, and feature-specific abuse cases. The two areas must share clear interfaces and jointly address end-to-end risks. Give an example of using AI to improve security work without creating unacceptable risk. I would use AI to accelerate first drafts of threat models, triage code findings, identify likely insecure patterns, and generate test cases for security controls. Outputs would remain subject to human review, protected-data handling rules, and validation against source code and architecture. AI should increase coverage and speed, not become an unverified decision-maker for security-critical changes. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Liftoff logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c47aea9f-221.png) Liftoff Nov 3 New ### [Application Security Engineer, Generative AI](https://jobicy.com/jobs/158817-application-security-engineer-generative-ai.md) Liftoff is a leading AI-powered performance marketing platform for the mobile app economy. Our end-to-end technology stack helps app marketers acquire and retain high-value users, while enabling publishers to maximize… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Nov 3 New ### [Security Analyst (Governance and Trust)](https://jobicy.com/jobs/158783-security-analyst-governance-and-trust.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Lightspeed Commerce logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/09/3d38005a-221.png) Lightspeed Commerce Nov 3 New ### [Senior Engineer, Application Security](https://jobicy.com/jobs/158761-senior-engineer-application-security.md) Hi there! Thanks for stopping by 👋 Are you actively looking for a new opportunity? Or just checking the market? Well… you might just be in the right place! As… * ![Tenable logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/01879e02-221.jpg) Tenable Nov 3 New ### [Senior Enterprise Security Engineer](https://jobicy.com/jobs/158725-senior-enterprise-security-engineer.md) Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Nov 3 New ### [GRC Analyst (EMEA)](https://jobicy.com/jobs/158638-grc-analyst-emea.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![GitLab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/12/WRILS-201207055737-109952.jpg) GitLab Nov 3 New ### [Staff Software Engineer, Security Factory: Static Analysis](https://jobicy.com/jobs/158635-staff-software-engineer-security-factory-static-analysis.md) GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 3 New ### [Global Investigator (EMEA)](https://jobicy.com/jobs/158617-global-investigator-emea.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![GitLab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/12/WRILS-201207055737-109952.jpg) GitLab Nov 2 New ### [Staff Product Security Architect](https://jobicy.com/jobs/158551-staff-product-security-architect.md) GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50… * ![Monzo logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/5b4c0ec3-221.jpg) Monzo Nov 2 New ### [Information Security Manager](https://jobicy.com/jobs/158542-information-security-manager.md) 🚀 We’re on a mission to make money work for everyone. We’re waving goodbye to the complicated and confusing ways of traditional banking. After starting as a prepaid card, our… * ![Harness logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/3b1ed4078f521827fd4fd3f1ead4e484.jpg) Harness Nov 2 ### [Staff Security Analyst – GRC](https://jobicy.com/jobs/158473-staff-security-analyst-grc.md) Harness is the AI Software Delivery Platform company, led by technologist and entrepreneur Jyoti Bansal (founder of AppDynamics, acquired by Cisco for $3.7B). Harness has raised approximately $570M in funding… [Browse all jobs](https://jobicy.com/jobs.md)