Senior Application Security Engineer (AI)

Look at the latest headlines and you will see something Ki insures. Think space shuttles, world tours, wind farms, and even footballers’ legs. 

Ki’s mission is simple. Digitally disrupt and revolutionise a 335-year-old market. Working with Google and UCL, Ki has created a platform that uses algorithms, machine learning and large language models to give insurance brokers quotes in seconds, rather than days. 

Ki is proudly the biggest global algorithmic insurance carrier. It is the fastest growing syndicate in the Lloyd's of London market, and the first ever to make $100m in profit in 3 years. 

Ki’s teams have varied backgrounds and work together in an agile, cross-functional way to build the very best experience for its customers. Ki has big ambitions but needs more excellent minds to challenge the status-quo and help it reach new horizons.

As our Senior Application Security Engineer, you’ll empower our engineering and product teams to safely adopt AI and embed robust technical security controls directly into our services and workflows. By designing cloud-native security guardrails and automating processes, you’ll make the secure path the easiest path for our builders.

Your work will span our entire development lifecycle, protecting everything from agentic LLM integrations to the everyday tools we use. You’ll act as a trusted subject matter expert, collaborating closely across our product groups to foster a proactive, risk-conscious security culture. Through continuous mentorship and forward-thinking threat modelling, you’ll help us securely scale and drive a digital revolution in the global insurance market.

• →Provide practical implementation advice and guidance on securing AI-powered applications, aligning with frameworks like OWASP ASVS and the OWASP Top 10 for LLM Applications.
• →Lead threat modelling sessions for AI and agentic systems during the technical design phase using STRIDE and AI-specific frameworks.
• →Establish secure guardrails, allowlists, telemetry, and safe-by-default configurations for developer AI tooling.
• →Manage security testing workflows in the SDLC, utilizing scanners to check for standard and AI-specific risks such as prompt injection and data leakage.
• →Coordinate regular penetration tests, vulnerability triage, and cloud security posture management across GCP and Azure platforms.
• →Automate security tasks by contributing code to infrastructure and security tooling around our cloud platforms.
• →Foster secure practices by facilitating the Security Champions network, organizing security discussions, and delivering AI tooling safety training.
• →Share expertise, document processes, and mentor team members to build security capability across engineering.
• →Provide constructive feedback on Ki’s architecture and lead technical security discussions.

• Strong ability to write and review code (preferably in Python, TypeScript, Kotlin and Terraform), with a background in software development, SRE, DevOps, or practical security engineering.
• In-depth understanding of securing AI/LLM applications, agentic tooling, and developer AI tools, including prompt injection mitigation, model integration risks, guardrails, telemetry, and the use of frontier models via APIs or locally.
• Practical experience with agentic development using coding harnesses is essential.
• Solid knowledge of major public cloud providers (preferably Google Cloud Platform, with Azure or AWS as beneficial) and network infrastructure.
• Solid understanding of the Kubernetes ecosystem, Docker, and container security.
• Experience implementing and managing security testing programs (SCA, SAST, DAST) within pipelines like GitHub Actions, alongside release packaging and artifact management.
• Capability to develop secure, automated infrastructure using Terraform.
• You enjoy learning about both the offensive and defensive aspects of security.
• Ability to work collaboratively within enterprise-wide agile development environments.
• Outstanding communication skills (both written and verbal), with the ability to explain complex vulnerabilities to technical teams and business stakeholders, share knowledge, and mentor colleagues.

1. Initial recruiter screening call
2. Interview with hiring manager
3. Technical Interview (this may vary depending on the role)
4. Values Interview