Software Engineer (GenAI Security & Quality)

About the Role

We are looking for a highly technical Software Engineer to strengthen the security, compliance, and quality assurance of our enterprise-grade Generative AI and agent orchestration platform.

The primary focus of this role is AI security assurance: implementing and operating Moonshot and Litmus testing, conducting adversarial and risk-based assessments of LLM and agentic applications, translating compliance requirements into practical controls, and advising internal stakeholders on secure data handling and solution architecture. Software test automation remains an important secondary responsibility to support reliable product delivery.

This role suits an engineer who can combine hands-on security testing with sound architectural judgement, communicate risk clearly, and work collaboratively with product, engineering, security, governance, and business teams.

Responsibilities

AI Security, Compliance & Architecture:

• AI Security Testing: Design and execute AI-specific security and safety assessments for LLM, RAG, and agentic applications, covering threats such as prompt injection, jailbreaks, sensitive-data disclosure, insecure output handling, excessive agency, tool misuse, and cross-tenant data exposure. Conventional application penetration testing is performed by third-party providers and is outside the primary scope of this role.
• Moonshot & Litmus Implementation: Implement and operationalise Moonshot and Litmus testing across relevant AI use cases. Configure baseline and application-specific test suites, curate adversarial scenarios, analyse results, and establish repeatable evidence for assurance reviews.
• AI Evaluation & Test Data Governance: Develop representative test datasets and securely generate synthetic data for functional, safety, and security evaluation. Ensure test data is appropriately classified, masked, anonymised, retained, and disposed of in accordance with applicable policies.
• Compliance, Assurance & Risk Advisory: Translate organisational policies, government security requirements, and AI governance expectations into testable controls and evidence. Advise internal stakeholders on secure use of enterprise and sensitive data in GenAI solutions, including data flows, access controls, tenant isolation, retrieval boundaries, logging, retention, model or service selection, and third-party integration risks. Support risk assessments, security reviews, audit responses, remediation plans, and go-live assurance activities.
• Secure Solution Architecture: Review proposed AI solution designs, identify security and privacy risks, recommend proportionate controls, and collaborate with engineering and architecture teams to embed security by design throughout the solution lifecycle.
• Security Findings, Remediation & Reporting: Document vulnerabilities and control gaps with clear risk, impact, evidence, and remediation guidance. Work with delivery teams to track and validate fixes, communicate residual risk to technical and non-technical stakeholders, and report assurance metrics, recurring findings, and risk trends.
• Security Automation & Release Assurance: Integrate automated AI security and evaluation tests into CI/CD pipelines and release processes. Define security regression checks, release gates, and acceptance criteria to identify material risks before production deployment.

Software Test Automation:

• Test Automation: Build and maintain automated functional, regression, API, and end-to-end tests using suitable frameworks such as Pytest, Playwright, Cypress, or Postman.
• Defect Investigation: Reproduce issues, trace application and cloud logs, isolate root causes, and provide actionable defect reports to engineering teams.
• Quality Enablement: Promote pragmatic testing practices, reusable test assets, and shared ownership of quality across product and engineering teams.

Requirements

• Experience: 3+ years of relevant experience in software engineering, cybersecurity, application security, AI assurance, SDET, or technical QA automation.
• AI Security Knowledge: Practical understanding of security and safety risks affecting LLM, RAG, and agentic applications, including prompt injection, data leakage, unsafe tool use, excessive permissions, insecure output handling, and model or application abuse.
• AI Testing Toolkits: Hands-on experience with Moonshot, Litmus, or comparable AI evaluation, red-teaming, benchmarking, or adversarial-testing tools; ability to design custom scenarios and interpret results.
• Security & Compliance: Ability to interpret security, privacy, and AI governance requirements and translate them into technical controls, test plans, risk assessments, and assurance evidence.
• Solution Architecture: Experience reviewing system designs and data flows, assessing trust boundaries and integration risks, and recommending secure, proportionate architectures for cloud-based applications.
• Stakeholder Consulting: Strong communication and facilitation skills, with the ability to explain technical risks, challenge assumptions constructively, and guide internal stakeholders towards secure implementation decisions.
• Coding & Automation: Proficiency in Python and working knowledge of TypeScript or JavaScript, with experience in automated API, functional, regression, or end-to-end testing.
• Cloud & Data: Familiarity with AWS services, containerised environments, SQL databases, access controls, logging, encryption, data classification, masking, retention, and secure handling of sensitive information.

Preferred Qualifications:

• Experience conducting AI red-team exercises, AI threat modelling, or AI security and application assurance reviews.
• Familiarity with recognised AI and application security guidance, such as the OWASP GenAI Security Project, NIST AI Risk Management Framework, or MITRE ATLAS.
• Experience testing RAG pipelines, model integrations, agent tools, sandboxes, RBAC, tenant-isolation controls, and other AI-specific attack surfaces.
• Familiarity with government enterprise environments and high-security data compliance requirements, including IM8.