Principal Agentic Security Engineer

At InvestCloud, we are building an intelligent security response capability that determines what to fix first based on the actual risk to our clients and business, not a scanner's native severity.

Traditional vulnerability management produces disconnected findings and long backlogs.  It often misses whether vulnerable code is deployed, reachable by an attacker, connected to a critical service, capable of lateral movement, or already being exploited.  We are solving that problem by combining threat intelligence, runtime and deployment evidence, configuration management data, attack path analysis, business criticality, and validation results.

The platform will ingest findings from infrastructure, cloud, application, software supply chain, secrets, containers, infrastructure as code, and adversarial testing.  It will reconcile them to a canonical asset and service model, deduplicate them into unique exposures, and rank the remediation actions that remove the most risk.

The product is being built in Python on AWS with source-controlled connectors, deterministic policy code, an AI reasoning layer, human approval gates, complete audit evidence, and closed-loop validation.  Large language models (LLMs) can correlate evidence, recommend remediation, and explain decisions.  They do not calculate the authoritative priority score.

This is not another scanner or dashboard.  It is a security decision and remediation platform that must answer one question reliably: what is the single next action that will remove the most material risk, why is it first, who owns it, and how will we verify the risk is gone?  Every engineer on this team will build production software, operate what they build, and own the product after the initial consultant implementation.

As our Agentic Security Engineer, you will serve as the principal software architect for the harness and own the AI reasoning layer that turns prioritized exposures into evidence-grounded remediation options, residual risk analysis, and clear explanations.

You will ensure the product operates as a reliable system, not an AI demonstration.  The deterministic policy engine owns the authoritative score.  The LLM layer retrieves evidence, correlates likely root causes, evaluates mitigation choices, produces structured recommendations, and knows when to abstain or require a human.  You will also set engineering standards across Python services, APIs, data contracts, the evaluation framework, observability, and the operator experience.

• →Product Technical Architecture: Own the end-to-end software architecture for the Python and AWS product, including service boundaries, FastAPI and client APIs, the React or TypeScript operator interface, data contracts, Aurora PostgreSQL integration, security controls, performance, resilience, testability, and technical debt. Review and approve material design changes.
• →AI Reasoning & Tool Orchestration: Build reliable, stateful workflows that retrieve evidence, call deterministic tools, correlate findings, identify root causes, compare remediation options, and return schema-validated recommendations with citations and confidence.
• →Grounding, Retrieval & Provenance: Ground every output in current CMDB, threat intelligence, scanner evidence, code and deployment context, policy, and remediation history. Preserve source, observation time, freshness, model version, prompts, tool calls, and output evidence without inventing facts.
• →Evaluation, Safety & Confidence: Create representative test sets and automated evaluations for accuracy, completeness, unsafe actions, hallucination, prompt injection, data leakage, model drift, and confidence calibration. Implement fallback, abstention, and deterministic validation when evidence is weak.
• →Human Oversight & Controlled Autonomy: Implement approval workflows, policy gate integration, exceptions, kill switches, audit capture, and separation of duties. Support an initial recommendation mode, then controlled automation only after actions are proven safe, reversible, and approved.
• →Technical Leadership & Product Ownership: Set coding, testing, observability, documentation, and secure development standards for the team. Mentor engineers, challenge vendor assumptions, maintain provider independence, manage cost and latency, and lead the full handover from the consultant.

• 12+ years in software, AI, or security engineering, with principal-level evidence of architecture, delivery, and technical leadership. You must have shipped production AI or LLM systems and possess enough security depth to evaluate remediation safely.
• Expert production Python and backend engineering, including FastAPI, Pydantic or JSON Schema, asynchronous workflows, APIs, SQL or PostgreSQL, distributed systems, automated testing, CI/CD, and AWS.
• Production LLM and agentic workflow experience using Bedrock, Claude, OpenAI, LangGraph, or equivalent. You have built durable tools using systems with explicit state, retries, timeouts, validation, and failure recovery, not demos.
• Evaluation and AI security depth, including gold data sets, offline and online metrics, hallucination controls, prompt injection defenses, data isolation, model routing, observability, confidence calibration, and safe abstention.
• Retrieval and knowledge engineering across structured and unstructured data. You understand when relational queries, search, rules, or vector retrieval are appropriate and can preserve provenance and freshness.
• Security engineering depth across application, cloud, infrastructure, vulnerability intelligence, attack paths, remediation, and compensating controls. You can identify when an AI proposal is incomplete, unsafe, or simply wrong.
• A high ownership builder who maintains current expertise through self-directed work, uses AI to multiply output without lowering rigor, communicates complex designs concisely, mentors others, and collaborates without ego.

Python · FastAPI · Pydantic / JSON Schema · LangGraph or equivalent · AWS Bedrock · Claude / OpenAI · PostgreSQL / Aurora · RAG and search · REST / GraphQL · React / TypeScript familiarity · GitLab CI · pytest · OpenTelemetry / Datadog · Jira / JSM · AWS