Principal Application & AI Security Engineer
Det Norske Veritas (DNV)2 months ago
Houston, TX, USAStaff+
Base Salary
$175k - $225k/yr
Responsibilities
- Design and implement secure patterns for applications, APIs, cloud platforms, AI-agent systems, and software and AI supply chains.
- Build automated security controls covering dependency integrity, SCA, SAST, DAST, build provenance, artifact security, secrets protection, containers, infrastructure as code, and software or AI bills of materials.
- Implement policy-as-code, authorization enforcement, data-access guardrails, secure defaults, reusable reference implementations, risk-based quality gates, and documented exception paths.
- Review source code, APIs, and application designs for authentication, authorization, session management, input handling, data-access, and multi-tenant isolation weaknesses.
- Conduct authorized application, API, and AI security testing, including manual business-logic and trust-boundary testing.
- Work with engineers to remediate root causes, validate fixes, create regression tests, and prevent recurring vulnerability classes.
- Establish vulnerability triage and remediation practices with exploitability analysis, accountable ownership, retesting, closure evidence, and escalation.
- Secure AI agents through least-privilege identities, governed tool and data access, prompt-injection defenses, runtime policies, approval requirements, resource limits, and tamper-resistant auditability.
- Lead high-risk threat modeling and architecture reviews for complex, multi-tenant, cloud-native, event-driven, and AI-enabled systems.
- Develop reusable secure patterns for microservices, APIs, event-driven systems, containers, Kubernetes, cloud services, and agentic AI applications.
- Mentor senior engineers and technical leaders and represent application and AI security in technical, executive, customer, audit, and assurance discussions.
- Serve as the application and AI security technical lead during relevant incidents and support investigation, containment, recovery, remediation validation, and lessons learned.
Requirements
- 8+ years of experience in application security or secure software engineering with responsibility for production software and security controls.
- A degree in computer science, cybersecurity, engineering, or a related field is welcome but not required; equivalent practical experience is fully recognized.
- Deep application and API security expertise in authentication, authorization, session management, data protection, input validation, and multi-tenant isolation.
- Ability to review, write, test, and improve production-quality code in one or more languages used in cloud applications, automation, and security engineering.
- Experience leading source-code reviews, application and API security testing, threat modeling, and architecture reviews for complex systems.
- Experience integrating and tuning security tooling in CI/CD and converting findings into risk-based automated controls.
- Production experience with a major cloud provider such as Azure or AWS, plus understanding of cloud identity, platform services, and the shared-responsibility model.
- Ability to set technical direction, create reusable capabilities across products, and influence senior stakeholders without formal authority.
- Ability to communicate material security risk clearly to engineers, product leaders, executives, customers, and assurance stakeholders.
- Strong written and verbal English communication skills.
- Practical AI-agent security experience and experience applying AI to security testing, code analysis, vulnerability triage, or security automation are preferred.
- Experience securing distributed, event-driven, multi-tenant, or critical enterprise systems is preferred.
- Container, Kubernetes, infrastructure-as-code, software-supply-chain security, incident response, vulnerability investigation, exploit validation, and remediation verification experience are preferred.
- Hands-on depth with Veracode, Burp Suite Professional, or equivalents and familiarity with OWASP application, API, and agentic AI security guidance are preferred.
- OSCP, GIAC GWAPT, GWEB, GCSA, AZ-500, AWS Certified Security - Specialty, CISSP, or CCSP credentials are a plus.
- Pre-employment drug and background screening is required.
Benefits
- Generous paid time off including vacation, sick days, company holidays, and personal days.
- Multiple medical and dental plans, vision benefits, FSA, dependent care and commuter benefits, and a company-seeded HSA.
- Employer-paid therapist-led virtual care through Talkspace.
- 401(k) with company match, company-provided life insurance, and short- and long-term disability benefits.
- Education reimbursement, career advancement opportunities, charitable matched giving, volunteer rewards, and paid volunteer time off.
- Hybrid schedule based in Houston, TX or Oakland, CA, typically working three days per week from a DNV office or client location/site.
- Benefits vary based on position, tenure, location, and employee election.
Tech Stack
Categories
About Det Norske Veritas (DNV)
DNV provides risk management, assurance, and technical advisory services plus specialized engineering software to maritime, energy, and industrial customers. Its offerings include ship classification, certification and audits, technology qualification and testing, and data platforms for asset integrity and safety. Founded in 1864 and headquartered in Høvik, Oslo, DNV is privately held and operates in more than 100 countries.