BC
AI Application Security Engineer
Contract type
Ongoing
Work mode
Remote
Experience
Senior · 5+ years
Job description
Security Engineer, Application & AI at Brain Co., owning application-layer and AI/agent security for AI-native operating systems built for regulated institutions. A hands-on builder role writing code and shipping security tooling alongside product and ML engineers.
At a glance
- Work mode
- Remote
What you'll do
- Own secure development practices across products: AuthN/AuthZ patterns, secrets management, input handling, and secure-by-default standards
- Integrate security into the development lifecycle — code review, CI/CD pipelines, and pre-deployment checks
- Conduct threat modeling across product features and release cycles, translating risk into concrete controls
- Build and maintain security tooling and automated checks, using AI to scale reach across the codebase
- Own the application-layer security model for agentic products — agent scoping, authorization, and trust boundaries with external systems
- Define secure patterns for agent integration with third-party systems and APIs: credential storage and scoping, response validation, and limiting agent actions
- Work with product and ML engineers during feature development on secure agent design patterns: tool scoping, permission boundaries, output validation, and safe handling of user context
- Build reusable secure-by-default patterns for agent development — design guidelines, review checklists, and code-level guardrails
- Produce security artifacts for agent features and product deployments: threat models, architecture reviews, and documentation for regulated customer environments
- Define and enforce application-layer data protection standards for sensitive customer data (PHI, PII, government records) flowing through AI pipelines
- Build safeguards against unauthorized data exposure: access controls, output filtering, and audit logging
- Design secure data handling patterns for AI features on regulated data, working with platform and ML teams
What we're looking for
- 5+ years of experience in application security or product security, with hands-on experience on production systems at scale
- Builder first — writes code and ships security tooling, embedding security into the engineering workflow
- Deep fluency in application security fundamentals: OWASP Top 10, AuthN/AuthZ, secure SDLC, secrets management, secure integration patterns, and cryptography basics
- Understanding of the security surface of agentic AI across the product layer and ability to work with engineers to build standards
- Experience protecting sensitive data at the application layer: access controls, audit logging, and preventing data exposure through third-party integrations and AI-generated outputs
- Works AI-natively, using AI to write better code and move faster
- Thinks in attack surfaces and trust boundaries and can move from threat model to concrete shipped control
- Comfortable working alongside delivery teams shipping into regulated industries
- Thrives in high-agency environments and wants to own and grow the application security function
Nice to have
- Experience with agent security, LLM application security, or building authorization and guardrail systems for agentic pipelines
- Familiarity with compliance frameworks relevant to government and healthcare: FedRAMP, HIPAA, SOC 2, ISO 27001
- Proficiency in Python, Go, or TypeScript for security tooling and automation
- Experience with SAST/DAST tooling or integrating automated security checks into developer workflows at scale
Benefits
- Competitive salary plus equity
- Daily lunches
- Commuter benefits
- 401(k)
- Medical, Dental, and Vision
- Unlimited PTO
Apply
About Brain Co.
Brain Co. builds AI-native operating systems for large, regulated institutions. Each system is built for a specific industry, powered by agents that push real workflows forward. Underneath it all is Atlas, our proprietary platform that keeps customers in control, secure by design, and never locked into one model.
Mission
Rebuild how the world works, to make institutions work better for the people they serve.
Key facts
- Entering its next phase of production deployments on a national scale
- Elite team built from Palantir, Google, Meta, and Nvidia
- Growing footprint across government, insurance, health, and financial services
- Every project ships to production and is expected to create measurable customer value and impact
- Works alongside senior engineers from Tesla, DeepMind, Databricks, and other top engineering organizations