Senior Application Security Engineer, AI & Product Security

Senior Application Security Engineer, AI & Product SecuritySeattle, WashingtonEngineering – Security /Full Time /Hybridapply for this jobABOUT ARTERA Our Mission: Make healthcare #1 in customer service.   What We Deliver: Artera is an agentic company strengthening how healthcare providers communicate and care for patients. As an agentic partner, we bring over a decade of healthcare experience to address urgent workflows from day one and build custom solutions as healthcare providers’ needs evolve. Trusted by 1,000+ specialties, FQHCs, health systems, and federal agencies, Artera strengthens and protects and enhances patient relationships across every interaction - from intake and scheduling to referral management, post-visit care, and more. Hear from our CEO, Guillaume de Zwirek, about why we are standing at the edge of the biggest technological shift in healthcare’s history! Our award-winning culture: Our award-winning culture: Since founding in 2015, Artera has consistently been recognized for its innovative technology, business growth, and named a top place to work. Examples of these accolades include: Inc. 5000 Fastest Growing Private Companies (2020, 2021, 2022, 2023, 2024); Deloitte Technology Fast 500 (2021, 2022, 2023, 2024, 2025); Built In Best Companies to Work For (2021, 2022, 2023, 2024, 2025, 2026). Artera has also been recognized by Forbes as one of “America’s Best Startup Employers,” Newsweek as one of the “World’s Best Digital Health Companies,” and named one of the top “44 Startups to Bet your Career on in 2024” by Business Insider.   Applicants must be currently authorized and have the ability to provide proof of full-time, long-term authorization to work in the United States. We are unable to provide visa sponsorship or support visa transfers now or in the future.Responsibilities AI Threat Modeling: Threat-model agentic and LLM-powered features end-to-end: data ingress/egress, agent identity, tool-use boundaries, and the unique risks that come with frontier AI work Paved Road Tooling: Build the secure SDLC paved road — secure SDLC guardrails, prompt/agent identity patterns, secrets management, PHI/PII redaction patterns Security Gates: Embed SAST, DAST, SCA, and infrastructure scanning into CI/CD so security gates are part of the pipeline, not an afterthought AI Monitoring Strategy: Identify and pilot an AI monitoring tool to fill the gap our current tooling (Zscaler) doesn't cover Policy -> Practice: Translate existing security policy into safe tool-use patterns for the Artera Primitives team, Systems Engineers, and other AI Builder squads Cross Functional Partnership: Partner cross-functionally with DevOps, Systems Engineering, and the AI builder teams — meeting AI Builders and engineers in the middle and finding the secure path forward, not the "no" path Security Ownership: Own AWS identity and access management patterns, secrets management, and security tooling decisions in our AWS environment. Collaborate with System Engineers / DevOps on implementation. Security Framework Application: Apply frameworks like MITRE ATT&CK, MITRE ATLAS, OWASP Top 10, and OWASP LLM Top 10 to architectural decisions. Requirements AppSec Tenure: 6–10 years in Application Security, with a hands-on engineering orientation LLM & Agent Security: Demonstrable experience with LLM and agent security — OWASP LLM Top 10, MITRE ATLAS, prompt/output filtering, agent identity, and tool-use risk Threat Modeling Expertise: You’ve built end-to-end threat models for production platforms and translated them into corrective controls Pipeline Scanning Tools: SAST, DAST, and infrastructure scanning tools in production CI/CD environments Shift-Left Security Experience: Taking policy, codifying it as infrastructure-as-code (Terraform), and gating CI/CD pipelines on security findings Cloud Depth: Significant AWS experience (GCP or Azure background acceptable; AWS is learnable, but cloud depth is required) Regulated Environment Experience:...