Agoda - Staff AI Security Analyst

• Vulnerability management: Own daily triage of scanner, bug bounty, and pentest findings, using AI to cut duplicates and false positives. Prioritize based on exploitability and business impact, and drive fixes to verified closure within SLA. • Vulnerability management: • Zero-day response: Assess exposure to zero-day and newly disclosed vulnerabilities within hours, using AI, dependency inventories, and code search. Coordinate urgent patching or mitigation with engineering teams and track every affected service to closure. • Zero-day response: • Penetration testing: Lead manual and AI-assisted pentests of web, API, and mobile apps, verifying every AI finding by hand. Test AI agents and integrations for prompt injection, jailbreaks, tool abuse, and data leakage, and review third-party AI components and MCP servers. • Penetration testing: • Automated security testing: Design and suggest adversarial and automated security checks into CI/CD. Track how attackers use AI, such as automated exploit generation and faster vulnerability discovery, and adjust testing priorities to match. • Automated security testing: • AI tooling for AppSec: Build and own production AI agents that automate AppSec work, grounded in internal standards and past findings. Red-team them against prompt injection, and measure triage accuracy, time saved, and false-finding rates. • AI tooling for AppSec: • Leadership and mentorship: Contribute towards the AI AppSec roadmap and define what AI may do on its own, what needs human approval, and what data it can access. Track how attackers use AI, and mentor junior analysts to raise the team's AI fluency. • Leadership and mentorship: • Application and offensive security: 6 to 10 years of experience in application security, product security, or offensive security, with strong web and API penetration testing skills and hands on vulnerability management at scale. • Application and offensive security: • Vulnerability triage and prioritization: Proven ability to validate and reproduce bug bounty and external researcher reports, recommend appropriate rewards, and prioritize remediation using CVSS, EPSS, KEV, and business context. • Vulnerability triage and prioritization: • Supply chain and incident response: Deep understanding of dependency and software supply chain risks, including SCA and SBOM practices, with experience responding to zero day and high-profile vulnerabilities across large engineering organizations. • Supply chain and incident response: • AI security and technical leadership: Hands on experience building LLM tools or agents using Python, LLM APIs, RAG, or evaluation methods, and testing AI applications and agents. Demonstrated ability to mentor others and lead technical work across teams. • AI security and technical leadership: