Staff AI Security Analyst

About the role

Agoda's Security Department covers security, compliance, GRC and security operations, and the AppSec Analyst team is now adding AI to how it defends applications. As Staff AI Security Analyst, you will augment day-to-day application security work with AI, covering vulnerability management and triage, zero-day response and penetration testing of applications, AI agents and AI integrations. You will build and own production-grade AI tooling and automation, and mentor others to raise the team's AI fluency.

Key responsibilities

• Triage daily scanner, bug bounty and pentest findings with AI, prioritise by exploitability and business impact and drive fixes to verified closure within SLA.
• Assess exposure to zero-day and newly disclosed vulnerabilities within hours, coordinate urgent patching or mitigation with engineering teams and track every affected service to closure.
• Lead manual and AI-assisted pentests of web, API and mobile apps, and test AI agents and integrations for prompt injection, jailbreaks, tool abuse and data leakage, and review third-party AI components and MCP servers.
• Design and suggest adversarial and automated security checks into CI/CD, and track how attackers use AI to adjust testing priorities.
• Build and own production AI agents that automate AppSec work, red-team them against prompt injection and measure triage accuracy, time saved and false-finding rates.
• Contribute to the AI AppSec roadmap, define what AI can do autonomously, what needs human approval and what data it can access, and mentor junior analysts.

Required profile

• 6 to 10 years of experience in application security, product security or offensive security, with strong web and API penetration testing and vulnerability management at scale.
• Proven ability to validate and reproduce bug bounty and external researcher reports, recommend rewards and prioritise remediation using CVSS, EPSS, KEV and business context.
• Deep understanding of dependency and supply chain risks, including SCA and SBOM, and experience responding to zero-day and high-profile vulnerabilities.
• Hands-on experience building LLM tools or agents with Python, LLM APIs, RAG or evaluation methods, and testing AI applications and agents.
• Demonstrated ability to mentor others and lead technical work across teams.

Required skills

• Application and offensive security, with web and API penetration testing.
• Vulnerability triage and prioritisation using CVSS, EPSS and KEV.
• Supply chain security: SCA and SBOM.
• Incident response to zero-day and high-profile vulnerabilities.
• Preferred: bug bounty programme experience (e.g. HackerOne), model fine-tuning, MCP servers, agent frameworks, AI red-teaming tools, CI/CD security automation, cloud-native security, and certifications such as OSCP, OSWE or GWAPT.