Lead Application Security Engineer (AI)

Location: In-office in San Francisco or New York City, United States

Salary: $170,000–$305,000 base salary plus equity

Company

Decagon develops a conversational AI platform that enables enterprise brands to deliver customer experiences through voice, chat, email, SMS, and other channels.

What you will do

• Lead application security strategy and implementation for the conversational AI platform.
• Design and implement secure coding practices, threat modeling, vulnerability management, and application security controls.
• Integrate security throughout the software development lifecycle, including design, coding, pull requests, and deployment.
• Establish SAST, DAST, and IAST programs tailored to AI applications.
• Lead security code reviews and architecture assessments, focusing on AI model integrations and customer data handling.
• Build security automation, support vulnerability remediation, and coordinate application security incident response.

Requirements

• 5+ years of hands-on application security engineering experience.
• Expertise in secure software development, threat modeling, secure code review, and vulnerability assessment.
• Strong software engineering background with the ability to review code across multiple languages and frameworks used in AI/ML applications.
• Experience implementing application security testing tools and integrating security into CI/CD pipelines.
• Knowledge of the OWASP Top 10, common application vulnerabilities, and modern application security frameworks.
• Track record of working with engineering teams to remediate security findings while balancing security and business requirements.

Nice to have

• Experience securing AI/ML applications, including prompt injection, model extraction, and adversarial input protections.
• Experience with large-scale, multi-tenant SaaS applications handling sensitive customer data.
• Familiarity with Google Cloud application security services and container security best practices.
• Knowledge of SOC 2, ISO 27001, and GDPR compliance requirements from an application security perspective.
• Experience with Semgrep, CodeQL, Cursor Bug Bot, XBOW, or similar security tools.

Culture & Benefits

• In-office work environment focused on excellence and velocity.
• Medical, dental, vision, life insurance, and disability benefits for employees and families.
• Retirement plan, parental leave, and fertility and family-building benefits.
• Monthly wellness and lifestyle stipend, daily office lunches and snacks, and flexible vacation.
• Full-time employees receive benefits subject to applicable local policies and requirements.