AI Application Security Engineer

📋 Job Overview

Rebuild how the world works, to make institutions work better for the people they serve.

🏢 About Brain Co.

Brain Co. builds AI-native operating systems for large, regulated institutions. Each system is built for a specific industry, powered by agents that push real workflows forward. Underneath it all is Atlas, our proprietary platform that keeps customers in control, secure by design, and never locked into one model.

🎯 The Role

This is a hands-on builder role. You will write code, ship security tooling, and work directly with product and ML engineers to build security in from the start rather than bolt it on after. You are expected to work AI-natively: using AI to write threat models, automate security review, scale code analysis, and build internal tooling. This is not a nice-to-have — it is how the role is designed to operate and how one person can have outsized impact across a fast-moving engineering organization.

✅ Key Responsibilities

• Own secure development practices across our products: AuthN/AuthZ patterns, secrets management, input handling, and secure-by-default standards that engineers can follow without security becoming a bottleneck.
• Integrate security into the development lifecycle — code review, CI/CD pipelines, and pre-deployment checks — catching risk before it reaches production.
• Conduct threat modeling across product features and release cycles, translating risk into concrete controls that ship alongside each product.
• Build and maintain security tooling and automated checks that scale your reach across the codebase — using AI to move faster and cover more ground than manual review alone could.
• Define secure patterns for how agents integrate with third-party systems and APIs: how credentials are stored and scoped, how responses are validated before being acted on, and how each product limits what agents can do with what they get back.
• Work directly with product and ML engineers during feature development to define secure agent design patterns: tool scoping, permission boundaries, output validation, and safe handling of user context across multi-step workflows.
• Build reusable secure-by-default patterns for agent development — design guidelines, review checklists, and code-level guardrails — so that security standards scale as new agent capabilities are built.
• Produce security artifacts for agent features and product deployments: threat models, architecture reviews, and documentation that supports delivery into regulated customer environments.
• Build safeguards against unauthorized data exposure across our products: access controls, output filtering, and audit logging that make data handling attributable and reviewable.

📌 Required Qualifications

• Are a builder first — you write code and ship security tooling, and see embedding security into the engineering workflow as the job, not a side effect of it.
• Understand the security surface of agentic AI across the product layer — how agents should be designed, scoped, and reviewed for risk — and can work shoulder-to-shoulder with engineers to build those standards in.
• Work AI-natively — you already use AI to write better code, move faster, and do more with less, and you bring that same instinct to security work.
• Think in attack surfaces and trust boundaries and can move cleanly from threat model to concrete shipped control.
• Are comfortable working alongside delivery teams shipping into regulated industries, understanding their constraints and translating them into product-level security requirements.

⭐ Desirable Experience

• Familiarity with compliance frameworks relevant to government and healthcare: FedRAMP, HIPAA, SOC 2, ISO 27001.
• Proficiency in Python, Go, or TypeScript for security tooling and automation.
• Experience with SAST/DAST tooling or integrating automated security checks into developer workflows at scale.

🎁 Benefits

• Competitive salary plus equity
• Daily lunches
• Commuter benefits
• 401(k)
• Medical, Dental, and Vision
• Unlimited PTO