Application Security Specialist (AI and Agent Security)

Introduction

• 36 hours per week
• Start date: ASAP
• End date: 08 November 2027
• Extension is possible
• ZZP is not allowed
• Hybrid model of work: employees are expected to be in office 3 days a week

Job description

Seeking an Application Security Specialist with AI and Agent Security expertise to strengthen Application Security capabilities and enable the secure adoption of AI technologies across the organization. The contractor will design and implement security controls, perform security assessments, provide security architecture guidance, and establish governance across software development, AI platforms, AI agents, and software supply chains.

With the following results (SMART)

• Deliver agreed Application Security maturity improvements by implementing security controls, standards, and secure-by-design practices within committed timelines.

• Improve vulnerability management effectiveness through AI-assisted analysis, risk-based prioritization, and timely remediation support.

• Establish and operationalize AI Security controls, guardrails, and assessment processes for AI applications, AI agents, and AI-enabled development platforms within agreed milestones.

• Implement Software and AI Supply Chain Security controls, including SBOM/AI-BOM requirements, dependency risk management, and third-party AI governance.

• Deliver security assessments, threat modelling, and architecture reviews for application, cloud, and AI initiatives within agreed service levels.

• Increase adoption of secure development practices through developer enablement, Security Champion engagement, and security awareness activities.

• Demonstrate measurable reduction of application, AI, and software supply chain risks through implementation of security controls and remediation guidance.

Requirements

Required

• 6+ years of experience in Application Security, Security Engineering, or DevSecOps.

• Hands-on experience with SAST, DAST, API Security, SCA, Container Security, Threat Modelling, and Vulnerability Management.

• Experience with secure software development, CI/CD security, and cloud-native platforms.

• Experience securing AI-enabled applications, GenAI solutions, AI Agents, RAG architectures, or similar technologies.

• Strong stakeholder management, communication, and advisory skills.

Relevant experience and expertise in AI-driven solutions and technologies. Especially in securing AI-enabled applications, GenAI solutions, and AI agents.

Preferred

• Experience in financial services or other regulated industries.

• Knowledge of NIST AI RMF, OWASP, OWASP SAMM, and NIST SSDF.

• Bachelor's or Master's degree in Computer Science, Cyber Security, Artificial Intelligence, or a related field.

• Relevant certifications such as CISSP, SecAI+, or equivalent.

Additional information

• Specialist role focused on Application Security, AI Security, and Security Architecture advisory.

• Ideal candidate combines a strong Application Security background with practical experience in securing AI-enabled systems, AI agents, and modern software development platforms.

• Proven ability to influence engineering teams and drive security improvements in complex technology environments is essential.

• Experience working with Engineering, Architecture, Cloud, DevSecOps, and Product teams is highly desirable.

• Strong communication, consulting, and stakeholder management capabilities are critical for success in this role.

• The role will work with stakeholders globally (EU, APAC, US).

Additional information:

Key responsibilities

- Work with developers, engineers, and stakeholders globally, primarily in Europe, with additional collaboration across Chicago (US) and Sydney (Australia).

- Provide application security advice and guidance to developers on identifying and remediating vulnerabilities and code defects.

- Improve application security maturity by ensuring teams use available security scanning tools and remediate vulnerabilities according to risk-based deadlines.

- Support developers in understanding security issues and becoming more self-sufficient.

- Conduct hands-on code reviews when required, particularly for less mature or legacy applications.

- Design and improve security controls, documentation, and guardrails for AI technologies.

- Help secure AI tools, platforms, and applications as the firm adopts AI, including AI agents.

- Collaborate with the internal AppSec team to integrate AI into security tools and use AI to strengthen the firm's security capabilities.

- Support technology onboarding and work with the teams responsible for maintaining and supporting those technologies.

- Assist with application modernization, containerization, and migrations from on-premises infrastructure to the cloud where needed.

- Application security maturity measurements Maturity improvements will be assessed through:

- Adoption and consistent use of available security scanning tools.

- Remediation of vulnerabilities and code defects within risk-based timelines (e.g., critical, medium, and other severity levels).

- Improved developer knowledge and independence in handling security issues.

- Progress in modernizing legacy applications and adopting secure, modern technologies.

- Implementation and maintenance of required security controls.

Candidate requirements

-Candidates should demonstrate relevant experience and expertise in AI-driven solutions and technologies. Especially in securing AI-enabled applications, GenAI solutions, and AI agents.

- Application security experience, with knowledge of AI security.

- Ideally, at least 1 year of practical AI-related experience, although this is not a strict requirement.

- Experience or understanding of securing AI technologies and environments.

- Ability to apply AI within security practices to improve protection.

- The more relevant AI experience, the better, but candidates with less experience may still be considered.

- Ability to work with developers, engineers, and global stakeholders.

Working hours

- Primarily European working hours.

- Occasional early calls around 7–8 a.m. for APAC/Sydney and late-afternoon calls around 5–6 p.m. for the US may be required.

- A global team call may take place in the late evening in Europe approximately once a month or every three weeks.

These schedule adjustments are occasional, not daily expectations.