01Responsibilities
Embedded Security Assessment
Partner closely with application development teams, participating in sprint planning, design reviews, and code reviews to identify and mitigate security risks early in the delivery lifecycle.
Assess application security posture across all phases of delivery including architecture, source code, dependencies, APIs, authentication and authorisation mechanisms, data handling practices, and runtime behaviour.
Conduct threat modelling for recent features, architectural changes, AI/agentic system integrations, and multi-tenant platform components, communicating identified risks in terms meaningful to both engineering and business stakeholders.
Evaluate CI/CD pipeline security including configurations, secrets management, artifact integrity, dependency supply-chain risks, and access controls.
Review cloud infrastructure (AWS) configurations to identify security gaps across identity and access management, network design, data protection, workload hardening, logging, and monitoring.
Assess multi-tenant boundary controls to identify cross-tenant data access paths, context confusion, and shared-resource leakage risks.
Assess AI and agentic system components including prompt injection risks, tool-call trust boundaries, agent privilege scope, MCP/orchestration layer exposures, and model output handling. Apply OWASP Top 10 for LLMs and emerging adversarial AI guidance.
Evaluate secrets management posture across repositories, CI/CD pipelines, environment configurations, serverless functions, and m .
