Note: The job is a remote job and is open to candidates in USA. Hampton North is a company focused on securing a B2B2C SaaS platform through innovative application security measures. The Senior Application Security Engineer will lead efforts in securing AI-integrated applications, hardening CI/CD pipelines, and ensuring responsible AI adoption while utilizing AI-powered tools to enhance security throughout the software development lifecycle.
Responsibilities
- Use AI-powered security and development tools every day (Claude Code, Claude Security, or comparable assistants) to accelerate vulnerability discovery, code review, threat modeling, and remediation across the SDLC
- Design and operate agentic security automation that orchestrates multi-step checks across the CI/CD pipeline, including AI-assisted auto-fix workflows and AI-native security gates
- Lead security architecture reviews and embed secure-by-design principles from initial design through deployment and ongoing operation
- Assess and mitigate AI-specific attack surfaces in LLM-integrated features, including direct and indirect prompt injection, context leakage, insecure tool use, and model denial-of-service
- Continuously refine threat modeling across application components, third-party integrations, cloud-native architecture, and AI/LLM-powered features
- Develop, enforce, and evolve secure coding standards through SAST, DAST, and SCA scanning, AI-assisted code review, periodic manual audits, and targeted developer training
- Own and evolve Application Security Posture Management, integrating static, dynamic, SCA, and runtime signals into risk-scoring that weighs exploitability, data sensitivity, and business impact
- Manage vulnerability triage and prioritization against exploitability, business impact, and compliance, aligning remediation timelines to risk tolerance
- Run the bug bounty program end to end: scope, triage and validate researcher submissions, assess severity, and engage the research community
- Mentor engineers and developers on secure coding, remediation, and effective use of AI-augmented security workflows
- Present findings, risk assessments, and program metrics to senior leadership, clients, auditors, and regulators
Skills
- Seven or more years in application security, software security engineering, or a closely related domain within production SaaS environments
- Regular hands-on use of AI-powered security and development tools (Claude Code, Claude Security, or comparable coding and security assistants) as part of your daily workflow, beyond evaluation or advisory use
- Experience building or operating agentic AI security workflows: multi-step autonomous automation, parallel subagent reviews, agent-to-agent handoffs, policy-driven automation
- Experience assessing AI-specific attack surfaces in LLM-integrated applications: prompt injection (direct and indirect), context leakage, insecure tool use, model denial-of-service
- Deep AWS security and Kubernetes security expertise, with cloud-native application security best practices
- Hands-on DevSecOps pipeline design and security testing across SAST, DAST, SCA, and penetration testing
- Ability to review and assess security risk in one or more of Java, C#, JavaScript/TypeScript, Python, Swift, Kotlin
- Secure authentication and authorization depth: OAuth 2.0, OIDC, SAML, JWT, WebAuthn, Zero Trust
- Security automation and scripting in Python and Bash
- Working command of OWASP Top 10, OWASP Top 10 for LLM Applications, SANS 25, CVSS, EPSS, and MITRE ATT&CK
- Secure context window management in AI products: context isolation boundaries, prevention of sensitive data leakage, data classification for model inputs
- Encryption standards, cryptographic best practice, and secrets management
- Ability to present risk clearly to technical and non-technical audiences, including senior leadership and external stakeholders
- Comfort working independently in a remote setting with high accountability
- CSSLP, OSCP, GWEB, or GWAPT
- Bachelor's in Computer Science, Cybersecurity, Information Assurance, Software Engineering, or a related field, or an equivalent combination of education and experience
- Experience evaluating AI provider security posture: API security reviews, data residency assessments, vendor risk questionnaires, contractual security requirements
- AI model access controls and secrets hygiene in AI pipelines: least-privilege for LLM tool integrations, securing model inference endpoints
- SIEM, WAF, and security monitoring tools
- AWS controls depth: IAM, security groups, KMS, Lambda security, cloud monitoring
Benefits
- Bonus(some flex DOE)
- Fully remote, US based
- Minimal travel, roughly two team gatherings per year
Company Overview