Application Security Engineer (AI)

Location: Chicago, United States

Salary: $85,000–$130,000 per year

Company

hirify.global develops a precision medicine platform that uses real-world clinical evidence and AI to support treatment decisions and healthcare research.

What you will do

• Embed security into the SDLC through threat modeling, design reviews, security requirements, and secure code reviews.
• Conduct application security assessments and penetration tests for web applications, APIs, and cloud-hosted services.
• Assess AI- and LLM-enabled features, including agents, RAG pipelines, tool and MCP integrations, prompt injection risks, guardrails, permissions, and data access controls.
• Integrate and tune SAST, DAST, software composition analysis, and secrets scanning in CI/CD pipelines.
• Build security automation, secure-by-default patterns, application security controls, standards, and coding guidance.
• Triage vulnerabilities, support remediation and vulnerability disclosure, and coach developers on secure design and coding.

Requirements

• 3–5 years of experience in application security, penetration testing, or software engineering with a security focus.
• Hands-on experience testing web applications, APIs, and cloud-hosted services with penetration testing tools such as Burp Suite and knowledge of OWASP Top 10 vulnerabilities.
• Experience with architecture-level security reviews, threat modeling methods such as STRIDE or PASTA, and SAST, DAST, and SCA integration into CI/CD pipelines.
• Practical experience securing AI- and LLM-enabled applications, including prompt injection, data leakage, excessive agency, and insecure output handling.
• Proficiency in Python, Go, or JavaScript, with the ability to read and review code.
• Understanding of TCP/IP, HTTP/S, OAuth/OIDC, authentication, authorization, cryptography, and effective collaboration with engineering and product teams.

Nice to have

• AI red teaming or security testing experience with agentic or RAG systems, plus familiarity with MITRE ATLAS or the NIST AI Risk Management Framework.
• Experience with Docker, Kubernetes, GCP, AWS, infrastructure-as-code scanning, bug bounty programs, or vulnerability disclosure.
• Experience with HIPAA and healthcare data protection or an interest in biotech, genomics, and precision medicine.
• Certifications such as GWAPT, OSCP, CSSLP, CISSP, or ISC2 CC.

Culture & Benefits

• Full-time employment with a benefits package that may include incentive compensation, restricted stock units, medical benefits, and other benefits.
• Work involves securing sensitive clinical and genomic data and AI-powered healthcare capabilities.
• Collaboration with software development teams, product managers, and leadership is central to the role.