Senior Application Security Engineer (AI)

Location: Hybrid model in Tel Aviv-Yafo, Israel; offices at 34 HaMasger Street in Tel Aviv.

Company

hirify.global develops healthcare AI solutions that analyze medical images and support clinicians in more than 2,000 medical centers worldwide.

What you will do

• Lead threat modeling and security reviews across services, web, desktop, mobile, and hospital applications, focusing on customer and hospital data isolation and medical-file handling.
• Review Python and JavaScript/TypeScript code, test applications and APIs, translate findings into practical requirements, and verify remediation, including bypass testing.
• Improve SAST, DAST, SCA, and secrets controls; build security automation, CI integrations, and validation tests with DevOps and engineering teams.
• Define security requirements and verify controls for clinical inference, training pipelines, and model artifacts with AI and Data Engineering.
• Assess coding assistants, AI agents, and MCP integrations for sensitive-data exposure, excessive permissions, prompt injection, and untrusted inputs.
• Prioritize remediation, track agreed work, measure recurring defects and adoption, support SecOps investigations, and provide technical evidence to Quality and Regulatory partners.

Requirements

• 5+ years of relevant experience in Application Security, Product Security, or a combination with software engineering.
• Experience building or substantially improving an AppSec program, including selecting priorities, implementing tooling, gaining developer adoption without formal authority, and measuring results.
• Confident security review of Python and JavaScript/TypeScript, especially authorization and tenant isolation, plus hands-on web and API testing.
• Experience threat modeling systems not originally designed by you and translating findings into implementable engineering changes.
• Ability to write security automation, CI integrations, and validation tests.
• Working knowledge of security risks in LLM applications, AI agents, and MCP integrations, including prompt injection, sensitive-data exposure, and tool permissions.
• Clear communication in English and sound judgment when explaining security trade-offs and guiding engineering teams.
• AppSec experience involving Electron, mobile, or Windows-hosted applications; C#/.NET, PowerShell, or Go.
• Additional experience with ML training pipelines, model artifacts, inference systems, healthcare integrations, patient-data protection, or regulated product development is relevant; expertise in every listed platform is not required.

Culture & Benefits

• Hybrid work model with offices and employee parking in Tel Aviv.
• Daily chef-prepared breakfasts and lunches, stocked kitchen, and meal card.
• Employee-only gym plus Pilates, yoga, and functional workout classes.
• Collaborative, transparent, and inclusive working culture.
• Attractive compensation package and benefits.