2 days ago
Responsibilities
- Lead security reviews and threat models for AI features, autonomous agents, MCP servers, and third-party integrations.
- Define and track adoption of security standards for agent identity, delegated authorization, tenant and user data access, tool output, supply chains, and human approval.
- Design, build, ship, and evaluate security-team agents for finding validation, triage, review assistance, and remediation with bounded permissions and approval gates.
- Provide guidance and tooling for developers and security champions to build and use agents safely.
- Embed AI security requirements and review gates into the software development lifecycle and CI/CD processes.
- Lead multi-team security programs by setting goals, milestones, metrics, intake processes, priorities, and retrospectives.
- Represent application security in architecture forums, advise leadership on risk tradeoffs, and coordinate with Legal, Privacy, and GRC on AI governance.
- Train software engineers on secure design, authentication, authorization, multi-tenancy, AI features, and threat modeling.
- Mentor security engineers and support onboarding, training, and career development.
- Participate in on-call rotations, incident response, and resolution of escalated security issues.
Requirements
- Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
- 8+ years of security experience, including 5+ years of hands-on application security experience.
- Experience securing multi-tenant SaaS platforms, including tenant isolation.
- Cloud and infrastructure security experience with AWS, Azure, or GCP.
- Hands-on experience building AI agents or agentic workflows, including handling permissions, failures, and validation.
- Experience evaluating agentic-system risks such as prompt injection, tool and context poisoning, excessive agency, delegated authorization, data leakage, and supply-chain risk.
- Ability to design evaluations for agentic workflows covering success, false positives and negatives, adversarial cases, and regressions.
- Proven experience leading threat modeling and design reviews for complex applications and APIs.
- Deep understanding of web and API security, authentication, authorization, OAuth 2.0, OpenID Connect, session management, and access control.
- Strong software engineering skills in Python, TypeScript, PHP, or another language, including testing and maintaining shared tools.
- Experience leading cross-team initiatives, influencing without authority, explaining technical risk, and mentoring engineers.
- Preferred qualifications include experience securing MCP servers, AI coding assistants, developer-agent tooling, AI security checks in CI/CD, AI governance and compliance frameworks, relevant security certifications, and security champions programs.
Benefits
- Remote position available in the listed state.
- Health, life, and disability insurance.
- Four weeks of vacation, 12 company holidays, parental leave, and volunteer time off.
- 401(k) plan with up to a 6% company match.
- $2,000 Paid-Paid Vacation bonus.
- Employee assistance program through Headspace.
- Employment is contingent on passing background and credit checks.
Tech Stack
Categories
About BambooHR
BambooHR provides cloud-based HR software for small and mid-sized businesses, including a core HRIS with applicant tracking, time tracking, payroll integrations, and employee self-service. Delivered as a SaaS subscription, it centralizes people data and supports workflows from hiring to performance. Founded in 2008 and headquartered in Draper, Utah, the privately held company reports serving over 34,000 customers worldwide and lists clients such as Quora and MasterClass.