Application Security Engineer - Agents platform

Overview

Embedded as the first Application Security Engineer on the ElevenAgents team, building security tooling and reusable primitives so engineers ship securely by default. This is a builder role, with about 70% of time spent building tools and internal systems.

What you'll do

• Build security primitives that are easy for engineers to adopt, starting from what you find when you audit the Agents codebase
• Review new product work for security and feed what you learn back into shared tooling
• Lead the major security improvements to the Agents platform, working closely with Core Security
• Make sure the Agents platform uses authn and authz controls correctly, and build the guardrails that keep it from compromising on security best practices
• Set the security bar for the Agents platform and make meeting it the easy path for product engineers
• Work with engineers daily to help them ship fast and safely

What you'll need

• 5+ years in application security engineering at scale, covering secure design, vulnerability management and security tooling
• Strong software engineering skills: you have built and shipped products end to end, in production-quality code
• Fluency in Python, the main language; Golang or another language is fine if you can pick up Python quickly
• Hands-on experience with authentication and authorization
• Experience with large-scale, customer-facing backend systems and enterprise-grade security
• Clear communication and a real enjoyment of working with developers
• A track record of owning delivery end to end

Nice to have

• Experience securing cross-service communication
• Security for AI and LLM applications
• Cloud-native experience (AWS or GCP, Kubernetes, Terraform, IAM, networking, Linux internals)
• Experience in regulated environments (SOC 2, ISO 27001, PCI, HIPAA)

Details

• Remote, can be executed globally
• Preference for candidates based in GMT to GMT+3 or the UK
• Option to work from offices in Dublin, London or Warsaw
• Not required: compliance certifications, incident response experience, a traditional security background, or prior domain knowledge