Staff AI Security Engineer

About the role

Agoda is hiring a Staff AI Security Engineer to join its AppSec Engineering team. The team builds AI-powered security engineering capabilities that protect a fast-paced DevSecOps environment where code ships continuously, and makes sure the AI systems and agents Agoda builds are secure by design. The role focuses on security engineering and threat modeling, shipping and owning production systems.

Key responsibilities

• Design, build and operate AI-powered security systems such as LLM-driven secure code review, finding triage and de-duplication, and automated fix suggestions, owning them end-to-end in production.
• Build AI-assisted threat modeling: draft threat models from design docs and architecture, flag high-risk changes and route reviews needing human review.
• Harden AI developer platforms (e.g. Cursor, Codex, Claude) and agent platforms, including MCP/plugin governance and policy controls.
• Lead security design reviews and threat modeling for AI systems and agents, including LLM-integrated products, RAG pipelines, MCP/tool integrations and internal agentic platforms.
• Define and implement security controls and guardrails for AI agents: identity and delegated credentials, least-privilege tool access, sandboxing, human-in-the-loop approval and audit logging.
• Develop defenses against AI-specific threats such as prompt injection, data exfiltration, insecure output handling and model/supply chain risks, turning them into secure-by-default patterns.
• Build agentic security tooling that automates AppSec workflows from intake and risk scoring to ticketing and remediation tracking.
• Measure and improve tooling quality (precision, coverage, false-positive rate) by tuning models, prompts and pipelines.
• Act as an embedded security owner with product, platform, data and AI teams, and partner with AppSec analysts to turn findings into automated fixes.
• Share insights on AI security research and frameworks with the engineering community.

Required profile

• At least 6 years of experience in security engineering, application security, threat modeling, secure coding, IAM, software development or cloud security.
• Strong knowledge of secure design for distributed systems and microservices, OWASP Top 10, OAuth 2.0/OIDC, service-to-service authentication and least privilege.
• Analytical, offensive security mindset, autonomy in ambiguous problems and clear communication with diverse audiences.

Required skills

• At least 3 years of SDLC experience in Python, Go, TypeScript/Node.js, Kotlin or similar, with production-quality systems.
• At least 2 years with public or private cloud environments.
• At least 1 year building LLM-enabled applications, agents, tool calling/MCP, RAG or evaluation pipelines, with familiarity with OWASP Top 10 for LLM Applications or MITRE ATLAS.
• Nice to have: experience securing agentic or LLM-integrated systems, developer-facing security tooling in CI/CD, LLM red-teaming, and frameworks such as NIST AI RMF or ISO/IEC 42001.

The role is based in Singapore, with a monthly base salary of SGD 10,900-16,300.