Senior Application Security Engineer

AlphaSense is investing in the next generation of our Application Security capability, a continuous, AI-augmented, layered defense program built for a SaaS engineering organization where AI agents and human developers ship code side by side at high velocity. As a Senior AI Application Security Engineer, you will be a senior individual contributor at the center of that program. You will own the code and pull-request enforcement layer that every change flows through, whether authored by a human or an AI coding agent. This is a hands-on, build-it role reporting to the Director of Application Security within Product Security.

Responsibilities

Operate and continuously tune the SAST, SCA, secrets-detection, and SBOM pipeline; Design, ship, and harden deterministic security gates that make AI-authored PRs auditably equivalent to human-authored ones; Review human-authored and agent-authored PRs, catching semantic violations static analysis misses, and co-submit AI-generated patch proposals; Drive findings to closure at the class level; Own how we secure AI-assisted development: Claude Code, Cursor, Copilot, MCP servers, agent-authored PRs, sub-agents handling rebases and CI fixes; Author and roll out our AI-Assisted Development Security policy: prompt injection defense, MCP scope and credential governance, agent credential inheritance, secret leakage to agent logs, agent-action audit attribution; Partner with harness engineering on agent scope declarations, agent identity registration, and verification hooks; Threat model new AI features, agent gateway, MCP connector architecture, AI workflows, and ship controls; Scale the threat modeling framework and make it standard for new features and architectural changes; Partner with product security to build a security training program; Embed testable security acceptance criteria, agent scope declarations, and verification hooks into the PRD template; Integrate tightly with layered security teams to ensure Layer 1 signal is consumable by Layers 2-5 and GRC; Drive MTTR on critical findings under 24 hours, finding precision above 95%, and recurring named classes trending to zero; Support DAST deployment, API pen test program, and customer-facing security posture dashboard; Coordinate penetration testing, bug bounty intake, and partner threat-intel feeds; Act as primary technical responder for application-layer incidents, agentic behavior anomalies, or third-party integration compromises

Requirements

6+ years engineering experience, with 4+ in a dedicated AI Application Security / Product Security role at a SaaS or cloud-native company, not a consulting/audit background; Development background, hands-on and recent, writing code and reading PRs fluently in at least two of Python, TypeScript/JavaScript, Java/Kotlin, or Go, and comfortable in Terraform, Helm, and Kubernetes manifests; Hands-on experience with agentic AI and MCP development, including building, integrating, or operating agentic tooling such as MCP servers, Claude Code, Cursor, Copilot, autonomous coding agents, agent gateways, or guardrails for prompt injection, jailbreak resistance, or output sanitization; Production operation of a SAST / SCA pipeline at scale using Snyk, Semgrep, GitHub Advanced Security, Checkmarx, Veracode, or equivalent, including rule authoring, false-positive tuning, and CI/CD integration; Demonstrated ownership of a threat modeling or developer security training program as founder or substantial contributor; Layered security thinking with defense-in-depth across code, contract, behavior, simulation, and data; Strong written communication to author policy, guidance, runbooks, and PR comments that engineers read and act on

Nice to have

Open-source contributions to a SAST / SCA tool, security linter, MCP server or framework, agent harness, or threat modeling tool; Experience shipping a deterministic compliance gate accepted by an external auditor as equivalent to human review; API security and DAST experience (Burp Suite, ZAP, Akto) and modern container / Kubernetes security (admission controllers, runtime protection, supply chain attestation); AWS security depth (IAM, KMS, GuardDuty, Security Hub, Organizations) and exposure to AI/ML production environments; Security partner on a customer-facing posture dashboard or DDQ response process, ideally in a regulated industry; Public writing or speaking on developer security, AI/agent security, or AppSec automation; Pre-IPO experience or familiarity with SOC 2 Type II, ISO 27001:2022, ISO 42001, SOX, GDPR; Certifications: OSWE, OSCP, CSSLP, AWS Security Specialty, or CISSP

Benefits

Foundational hire, not a backfill; Genuinely novel scope at the intersection of agentic development, continuous compliance, and AI-native security at production scale; Build, ship, own with real surfaces queued and waiting for an owner; Senior IC role on a senior IC team with clear path to Staff / Tech Lead; Remote-first, high autonomy, competitive compensation, performance bonus, equity, and benefits; You may also be offered a performance-based bonus, equity, and a generous benefits program