3 days ago
Base Salary
$85k - $130k/yr
Responsibilities
- Embed security into the SDLC through threat modeling, design reviews, security requirements, and security-focused code reviews.
- Plan and conduct security assessments and penetration tests of web applications, APIs, and cloud-hosted services.
- Assess AI and LLM-enabled features, including agents, RAG pipelines, tool and MCP integrations, prompt injection risks, guardrails, permissions, and data access controls.
- Integrate and tune SAST, DAST, software composition analysis, and secrets-scanning tools in CI/CD pipelines.
- Build security automation, secure-by-default patterns, and vulnerability-prevention guardrails.
- Use AI-assisted tooling for code review, triage, and remediation while validating results with human judgment.
- Reproduce, triage, prioritize, document, and remediate application security vulnerabilities with development teams.
- Communicate security risks to development teams and leadership and provide secure coding guidance and training.
- Design and document application security controls and standards.
- Run and support the vulnerability disclosure program.
Requirements
- 3-5 years of experience in application security, penetration testing, or software engineering with a security focus.
- Hands-on experience testing web applications, APIs, and cloud-hosted services with proxying and penetration-testing tools such as Burp Suite.
- Strong knowledge of common security flaws and mitigations, including the OWASP Top 10.
- Experience performing architecture-level security design reviews.
- Experience securing AI and LLM-enabled applications, including understanding prompt injection, data leakage, excessive agency, and insecure output handling.
- Practical experience with a threat-modeling method such as STRIDE, PASTA, or attack trees.
- Experience with SAST, DAST, SCA tools and CI/CD integration.
- Proficiency in Python, Go, or JavaScript for security tooling and automation, with the ability to read and review code.
- Understanding of TCP/IP, HTTP/S, authentication and authorization, OAuth/OIDC, and cryptography fundamentals.
- Ability to collaborate with software development teams and Product Managers and communicate complex topics clearly.
- Preferred experience with AI red teaming, agentic or RAG system security testing, MITRE ATLAS, or the NIST AI Risk Management Framework.
- Preferred experience with Docker, Kubernetes, GCP, AWS, infrastructure-as-code scanning, bug bounty or vulnerability disclosure programs, and HIPAA or healthcare data protection.
- Security certifications such as GWAPT, OSCP, CSSLP, CISSP, or ISC2 CC are beneficial.
Benefits
- Tempus offers a full range of benefits, which may include incentive compensation, restricted stock units, medical benefits, and other benefits depending on the position.
- The stated salary range is for the CHI location and may vary for other locations.
Categories
About Tempus
Tempus builds AI-enabled precision medicine tools and genomic tests used by physicians and health systems, with a core focus on oncology. It sells diagnostics, clinical decision-support software, and real‑world data services to providers and biopharma for drug discovery and trials. Founded in 2015 and headquartered in Chicago, Tempus is a public company listed on Nasdaq.