3 days ago
Singapore, SingaporeStaff+
Responsibilities
- Design, build, operate, and own AI-powered security engineering systems in production.
- Build AI-assisted threat modeling and automate AppSec intake, risk scoring, ticketing, remediation tracking, and reporting.
- Harden AI developer platforms and agent platforms, including MCP/plugin governance and policy controls.
- Lead security design reviews and threat modeling for AI systems, LLM-integrated products, RAG pipelines, MCP/tool integrations, and agentic platforms.
- Implement AI agent security controls covering identity, delegated credentials, least-privilege tool access, sandboxing, human approval, and audit logging.
- Develop defenses against prompt injection, tool-based data exfiltration, insecure output handling, and model and supply-chain risks.
- Measure and improve AI security tooling using precision, coverage, and false-positive metrics by tuning models, prompts, and pipelines.
- Partner with product, platform, data, AI engineering, and AppSec teams to deliver scalable security fixes and standards.
- Monitor AI security research and industry frameworks and share findings with Agoda’s engineering community.
Requirements
- At least 3 years of software development lifecycle experience using Python, Go, TypeScript/Node.js, Kotlin, or similar, with experience building and operating production-quality systems.
- At least 6 years of relevant experience across security engineering, application security, threat modeling, secure coding, identity and access management, software development, or cloud security.
- Strong knowledge of secure distributed-system and microservice design, OWASP Top 10 vulnerabilities, code-level remediation, OAuth 2.0/OIDC, service-to-service authentication, and least privilege.
- At least 2 years of experience with public or private cloud environments.
- At least 1 year of hands-on experience building LLM-enabled applications, agents, tool calling/MCP, RAG, or evaluation pipelines.
- Understanding of prompt injection, excessive agency, sensitive data leakage, insecure output handling, OWASP Top 10 for LLM Applications, or MITRE ATLAS.
- Analytical and offensive security mindset with the ability to identify and understand how vulnerabilities are discovered and exploited.
- Preferred experience securing agentic, code-execution, or LLM-integrated systems in production, including sandboxing, isolation, and guardrails.
- Preferred experience building developer-facing security tooling or security automation integrated into CI/CD.
- Preferred experience with LLM evaluation, AI red-teaming, AI security research, open-source tools, community frameworks, NIST AI RMF, or ISO/IEC 42001.
- Ability to work autonomously in ambiguous problem spaces and communicate technical and nontechnical concepts effectively.
Benefits
- The role is based in Singapore.
- Monthly base salary is SGD 10,900-16,300.
Tech Stack
Categories
About Agoda
Agoda is a global online travel platform for booking hotels, homes, flights, and activities, serving travelers and accommodation partners worldwide. Its web and mobile marketplace matches demand and supply and monetizes through commissions and related partner services. Founded in 2005 and headquartered in Singapore, Agoda operates as a subsidiary of Booking Holdings, with extensive operations across Asia-Pacific markets.