Application Security Engineer

Join Tempus in Chicago to help secure software end-to-end across the SDLC, including application, API, cloud, and AI/LLM-enabled systems.

Responsibilities

• Embed security into the SDLC through threat modeling, design reviews, security requirements, and security-focused code reviews with product and engineering teams.
• Plan and execute application security assessments and penetration tests for web applications, APIs, and cloud-hosted services; document results with risk ratings and remediation guidance.
• Threat model and assess AI and LLM-enabled features, including agents, RAG pipelines, and tool/MCP integrations.
• Perform adversarial testing such as prompt injection and validate guardrails, permissions, and data access controls for AI/LLM systems.
• Select, integrate, and tune SAST, DAST, software composition analysis (SCA), and secrets scanning within CI/CD pipelines.
• Build automation, secure-by-default patterns, and guardrails that reduce classes of vulnerabilities.
• Use AI-assisted tooling to scale code review, triage, and remediation, while applying human judgment for validation.
• Reproduce, triage, and prioritize application security vulnerabilities and coordinate through remediation with developers.
• Explain the nature, severity, and business risk of findings to development teams and leadership.
• Design, implement, and document application security controls, standards, and secure coding guidance.
• Run and support the vulnerability disclosure program.
• Coach developers on secure design and coding via consulting, training, and day-to-day collaboration.

Requirements

• 3-5 years of experience in application security, penetration testing, or software engineering with a security focus.
• Hands-on experience testing web applications, APIs, and cloud-hosted services; strong use of proxying and penetration testing tools such as Burp Suite; strong knowledge of common security issues and mitigations (e.g., OWASP Top 10).
• Experience conducting security design reviews at the architecture level.
• Working experience securing AI and LLM-enabled applications, including failure modes such as prompt injection, data leakage, excessive agency, and insecure output handling (e.g., OWASP Top 10 for LLM Applications).
• Practical experience with at least one threat modeling approach (e.g., STRIDE, PASTA, attack trees).
• Experience with SAST, DAST, and SCA tools, including integrating them into CI/CD.
• Proficiency in Python, Go, or JavaScript for security tooling and automation; ability to read and review code.
• Solid understanding of network and web protocols (TCP/IP, HTTP/S), authentication and authorization (e.g., OAuth/OIDC), and cryptography fundamentals.
• Able to collaborate effectively with software development teams and Product Managers.
• Excellent written and verbal communication; ability to explain complex security topics clearly and concisely.

Technologies

• Burp Suite
• OWASP Top 10
• Python
• Go
• JavaScript
• TCP/IP
• HTTP/S
• OAuth/OIDC
• SAST
• DAST
• SCA (software composition analysis)
• secrets scanning
• CI/CD
• STRIDE
• PASTA
• OWASP Top 10 for LLM Applications
• MCP
• RAG pipelines

Bonus Points

• Hands-on AI red teaming or security testing of agentic or RAG systems; familiarity with MITRE ATLAS or the NIST AI Risk Management Framework.
• Experience with Docker, Kubernetes, GCP, or AWS, and infrastructure-as-code scanning.
• Bug bounty or vulnerability disclosure program experience.
• Experience with HIPAA and healthcare data protection.
• Interest in biotech, genomics, and precision medicine.
• Certifications such as GWAPT, OSCP, CSSLP, CISSP, or ISC2 CC (Certified in Cybersecurity).

Location and Compensation

• Location: Chicago, IL (onsite)
• Salary: USD 85,000 - 130,000 per year