Staff Security Engineer
Location: Remote (with occasional onsite required)
Experience: 8+ years
About the Role
We're looking for a Staff Security Engineer to focus on security into our AI-first development lifecycle from the ground up.
You'll work alongside Staff Engineers building high-performance applications, ensuring our systems meet rigorous compliance standards while enabling rapid, AI-assisted development.
This role isn't about bolting security reviews onto the end of a pipeline. You'll shape how security integrates with agentic development patterns, defining guardrails that let teams move fast without compromising compliance or data protection.
What You'll Do
Architect secure systems that meet HIPAA and other regulatory requirements while supporting high-performance Go/Rust backends and TypeScript frontends
Define security patterns for AI-assisted development—ensuring agentic workflows don't introduce vulnerabilities through prompt injection, data leakage, or unvalidated AI-generated code
Build compliance into the SDLC—automate security checks, audit logging, and policy enforcement that work with (not against) AI-first workflows
Threat model AI-integrated systems—identify risks unique to long-running agent loops, multi-agent orchestration, and LLM-powered features
Own security architecture decisions and influence technical direction across the team
Establish secure development practices that the team can adopt without friction, including AI-assisted security reviews
What We're Looking For
8+ years in security engineering, with experience in application security, infrastructure security, or security architecture
Familiarity with modern backend stacks—you can review Go or Rust code and understand TypeScript frontend security concerns
Experience securing AI/ML systems—or strong interest and aptitude in LLM security risks (prompt injection, training data exposure, model manipulation)
Practical compliance mindset—you know how to satisfy auditors without creating engineering bottlenecks
Threat modeling skills—you think in attack surfaces and can anticipate risks in novel architectures
Nice to Have
Experience with agentic development patterns (BMAD or similar) from a security perspective
Background in secure SDLC tooling (SAST, DAST, dependency scanning, policy-as-code)
Contributions to security frameworks or compliance automation
Experience with PHI/PII data handling at scale
Certifications: CISSP, CCSP, or healthcare-specific security credentials
Why This Role
Security in AI-first development is an emerging discipline. You won't be following a playbook—you'll be writing it. You'll have direct influence on how we balance velocity with compliance, shaping patterns that protect sensitive data while enabling teams to leverage agentic workflows effectively.
This posting is for an existing vacancy that we are actively looking to fill.
We use artificial intelligence (AI) to assist in the screening, assessment, and selection of applicants.
ABOUT US
iTMethods builds sovereign AI infrastructure for regulated industries. For 20 years, we've earned the trust of 100+ enterprise customers in financial services, healthcare, pharma, semiconductor, defence, and technology. Our platform — The Fortress Family (Forge, Reign, BioCompute) — helps organizations govern AI where compliance isn't optional and evidence matters.
🔗 itmethods.com