What are the responsibilities and job description for the Application Security Engineer position at ASQI?
Company Description
A Square Ideas - ASQI is an Application Security & AI Security company focused on building developer-first, audit-ready security programs. We help engineering teams ship fast without sacrificing security by combining opinionated guardrails, deep AppSec expertise, and secure AI architectures. Our work spans secure SDLC, threat modeling, AI agent security, and enterprise-grade governance for modern, cloud-native stacks.
Role Description – Application Security Engineer
We’re looking for Application Security Engineer who can blend AppSec, AI security, and engineering enablement into a unified program.
In this role, you will:
- Build process orchestration frameworks that harmonize AppSec reviews (threat modeling, risk assessments, design reviews) with engineering workflows and BU-level governance.
- Create reusable golden paths for secure build/deploy patterns (containers, serverless, microservices) and embed them into developer workflows through automation.
- Drive metrics and continuous improvement by developing dashboards for coverage, findings, remediation SLAs, and SDLC maturity across business units, partnering with engineering leaders.
- Architect secure AI systems with a strong focus on MCP servers, AI gateways, agent orchestration, identity integration, and enforcement of authentication/authorization boundaries.
- Develop enterprise AI governance controls, including agent lifecycle policies, audit logging, prompt-injection defenses, and data boundary enforcement across AI workflows.
- Design secure patterns for AI agent deployments, covering containerized MCP clusters, agent-to-agent communication, multi-tenant access controls, and secret/token isolation.
- Evaluate and harden integrations with LLMs and external AI services, ensuring robust security and responsible use.
- Conduct comprehensive architectural threat model reviews, identifying security risks, validating mitigation strategies, and aligning with security standards and best practices.
- Develop and maintain detailed Confluence documentation for security controls, policies, procedures, and architectural guidance to support cross-functional teams and consistent governance.
Work Model: Remote, India-based, with mandatory US Eastern Time (EST) working hours.
Qualifications
- 4-6 years of experience in Application Security, Security Architecture, or related roles (flexible for strong profiles).
- Strong hands-on experience with threat modeling, secure SDLC, and architecture reviews for cloud-native applications (containers, microservices, serverless).
- Solid understanding of AppSec practices and tooling (SAST, SCA, DAST, secrets management, CI/CD security).
- Experience designing or operating AI/LLM-based systems, AI agents, or AI platforms (gateways, orchestrators, or MCP-style architectures is a plus).
- Familiarity with identity, authentication, and authorization patterns (OIDC, OAuth2, RBAC/ABAC, service-to-service auth).
- Experience with governance and controls: audit logging, policy enforcement, data boundary enforcement, and security documentation.
- Comfort working closely with engineering leaders and product teams, translating security goals into pragmatic, developer-friendly solutions.
- Strong written communication skills for Confluence documentation, design proposals, and architectural guidance.
- Ability and willingness to work in EST hours while being based in India (remote).
If this sounds like you, apply here on LinkedIn.