About Gramian

Gramian Consultancy is a boutique consultancy specializing in IT professional services and engineering talent solutions. With a strong background in software engineering and leadership, we help companies build high-performing teams by matching them with professionals who truly fit their needs.

About the Role

We are looking for experienced Application Security Engineers and Security-Focused Software Engineers to support a specialized AI security evaluation project.

In this role, you will assess how effectively static analysis tools identify security vulnerabilities in Generative AI applications, particularly LLM agents and Retrieval-Augmented Generation (RAG) systems. You will build small, runnable repositories containing realistic examples of Sensitive Information Disclosure (SID) and Excessive Agency (EA) vulnerabilities, alongside fixed and near-miss versions.

You will analyze code paths, identify security weaknesses, define authorization contexts, develop deterministic tests, and document findings. Your work will help improve the reliability of security tools and strengthen how AI systems are evaluated for application-level vulnerabilities.

LOCATION: Remote

EXPERIENCE: 5+ years in application/product security or security-focused software engineering

PROJECT: GenAI application security evaluation and AI training

TECHNICAL FOCUS: Python, TypeScript, SAST, CodeQL, Semgrep, LLM agents, RAG, and MCP

AI EXPERIENCE: Hands-on experience building LLM agents or RAG applications is required.

Key Responsibilities

• Build runnable agent and RAG repositories containing code-reachable Sensitive Information Disclosure and Excessive Agency vulnerabilities.
• Develop realistic security scenarios involving tool calling, agent memory, Model Context Protocol (MCP), and other LLM application components.
• Create vulnerable, fixed, and hard-negative code variants with minimal security-relevant differences.
• Evaluate static application security testing (SAST) tools and assess their ability to detect genuine vulnerabilities while avoiding false positives.
• Perform source-to-sink analysis and trace relevant data flows, action paths, and trust boundaries.
• Annotate security findings, including affected assets, root causes, controls, severity, and residual risk.
• Define authorization contexts covering actors, tenants, identities, permitted data, actions, purposes, and recipients.
• Develop deterministic tests to validate vulnerable, fixed, and negative security behaviors.
• Recommend appropriate security controls and remediation approaches.
• Participate in technical calibration, peer reviews, and quality assurance activities.

Requirements

• 5+ years of professional experience in application security, product security, or security-focused software engineering.

• Strong experience conducting secure code reviews and identifying application-level vulnerabilities.

• Practical knowledge of source-to-sink analysis, taint analysis, and static application security testing (SAST).

• Hands-on experience with security analysis tools such as CodeQL or Semgrep.

• Experience building or securing LLM agents and/or Retrieval-Augmented Generation (RAG) applications.

• Familiarity with frameworks and technologies such as LangChain, LlamaIndex, OpenAI or Anthropic SDKs, and Model Context Protocol (MCP).

• Strong understanding of authorization models, including:

• Actors, identities, and trust boundaries.

• Multi-tenant authorization and access control.

• OAuth, IAM, and identity management.

• Permitted data access and actions.

• Purpose and recipient restrictions.

• Document-level access control.

• Production-level coding experience in Python and/or TypeScript.

• Ability to distinguish genuine Sensitive Information Disclosure and Excessive Agency vulnerabilities from non-findings and false positives.

• Strong analytical skills and the ability to communicate technical security findings clearly.