Agoda - Staff AI Security Engineer

• Design, build, and operate AI-powered security engineering systems, such as LLM-driven secure code review, finding triage and de-duplication, and automated fix suggestions, and own them end-to-end in production. • Build AI-assisted threat modeling that scales our design reviews: drafting threat models from design docs and architecture, flagging high-risk changes, and routing the reviews that need a human in the room. • Harden the AI developer platforms our engineers use every day, such as Cursor, Codex and Claude, always-on agent platforms including MCP/plugin governance and policy controls. • Lead security design reviews and threat modeling for the AI systems and agents built at Agoda, including LLM-integrated products, RAG pipelines, MCP/tool integrations, and internal agentic platforms. • Define and implement security controls and guardrails for AI agents: agent identity and delegated credentials, least-privilege tool access, sandboxing, human-in-the-loop approval for risky actions, and audit logging. • Develop defenses against AI-specific threats such as prompt injection, data exfiltration through tools, insecure output handling, and model and supply chain risks, and turn them into secure-by-default patterns and standards for engineering teams. • Build agentic security tooling that automates AppSec workflows end-to-end, from intake and risk scoring to ticketing and remediation tracking, keeping outcomes measurable, auditable, and safe. • Measure and continuously improve the quality of our AI security tooling (precision, coverage, false-positive rate) by tuning models, prompts, and pipelines. • Partner with product, platform, data, and AI engineering teams as an embedded security owner, and work closely with AppSec analysts to turn their findings into scalable, automated fixes. • Stay ahead of AI security research and industry frameworks, and share what you learn across Agoda's engineering community. • Software engineering and production systems: Strong software engineering foundations, with at least 3 years of SDLC experience in Python, Go, TypeScript/Node.js, Kotlin, or similar, and a track record of building and operating production quality systems. • Software engineering and production systems: • Security expertise: At least 6 years of relevant experience across security engineering, application security, threat modeling, secure coding, identity and access management, software development, or cloud security. Strong knowledge of secure design for distributed systems and microservices, OWASP Top 10 vulnerabilities and code level remediation, OAuth 2.0/OIDC, service to service authentication, and least privilege. • Security expertise: • Cloud and AI security: At least 2 years of experience with public or private cloud environments, and 1 year of hands on experience building LLM enabled applications, agents, tool calling/MCP, RAG, or evaluation pipelines. Understand key AI and LLM risks, including prompt injection, excessive agency, sensitive data leakage, and insecure output handling, with familiarity with OWASP Top 10 for LLM Applications or MITRE ATLAS. • Cloud and AI security: • Security mindset: Applies an analytical, offensive security mindset to identify and understand how vulnerabilities are discovered and exploited. Uses AI thoughtfully as part of their work, exercises autonomy in ambiguous problem spaces, and communicates technical and nontechnical concepts effectively to diverse audiences. • Security mindset: