Job Description

About the Role

We handle protected health information at scale across health systems and millions of patient encounters. Security is not a layer we add at the end. It is built into how we work. As a Senior AI AppSec Engineer, you own the application security practice at Fabric, partnering directly with engineering to embed security throughout the development lifecycle, build the tooling and automation that keeps our platform secure, and ensure our applications meet the compliance standards our health system customers require. This role empowers you to leverage modern AI tools and automated workflows to accelerate threat modeling, streamline code reviews, and scale our security operations efficiently.

What You'll Do

As a Senior AI AppSec Engineer, you will be the driving force behind application security at Fabric, operating as a partner to engineering rather than a gatekeeper. Your primary responsibilities will include:

• Designing and implementing robust security architectures for our features, ensuring strict protections against prompt injection, adversarial machine learning, and data exfiltration.
• Establishing safe boundaries, sandboxing, and security guardrails for internal engineering teams utilizing agentic coding harnesses to write our codebase.
• Partner with engineering teams to embed security throughout the SDLC across Fabric's Ruby on Rails, Python, React, and Node.js applications. Conduct security-focused code reviews and provide actionable guidance on secure coding practices.
• Lead threat modeling exercises for new features and architectural changes. Conduct application penetration testing and vulnerability assessments across the platform, prioritizing findings and working directly with engineering to drive remediation.
• Implement and manage SAST and DAST tooling integrated into CI/CD pipelines. Build security guardrails and automated checks that allow engineering to move fast without introducing risk to the platform or patient data.
• Ensure application security practices meet HIPAA, SOC 2, and HITRUST requirements. Assess third-party integrations and APIs for security risk, including EHR integrations with Epic and Cerner.
• Run secure coding training and awareness programs for engineering teams. Serve as the internal subject matter expert on application security and lead response to application-layer security incidents.

Why You Might Be a Good Fit

• You bring a true hacker mindset to your work, constantly thinking about how to break complex systems in order to build more resilient defenses.
• You possess a deep, native understanding of AI security, specifically around the unique attack vectors introduced by large language models and agentic workflows.
• You are highly collaborative and enjoy partnering directly with engineering teams to solve security challenges, rather than acting as an isolated gatekeeper.
• You actively use modern AI tools to accelerate your own daily workflows, treating AI-assisted code analysis and vulnerability remediation as table stakes.
• You understand that in healthcare, a vulnerability is not just a technical problem. It is a patient safety and compliance issue.
• You are energized by building a security practice and shaping how a fast-growing company approaches both product and AI security.

This Might Not Be The Right Fit If...

• Your AI security experience has mostly been high-level, and you haven't yet had the opportunity to dive deeply into production LLM hardening or structural red-teaming.
• You have limited experience securing agentic pipelines and LLM-driven features.
• You are primarily a compliance or GRC-focused security professional and are not comfortable getting directly into the code.
• You prefer manual vulnerability remediation workflows over leveraging AI to accelerate your daily tasks.
• You prefer working in a mature, established security program over building and defining one.
• You are not comfortable working closely with engineering as a partner rather than an oversight function.
• You do not have experience in a regulated environment where security decisions carry direct compliance implications.

Your Qualifications

• 5+ years of experience in application security with hands-on experience in security assessments, penetration testing, and secure code review.
• Deep expertise in AI-native security, including advanced defense mechanisms against prompt injection, LLM production hardening, and adversarial machine learning.
• Experience securing agentic coding workflows and establishing robust guardrails for AI-generated code.
• A true "hacker" mindset with a proven track record of finding and exploiting complex vulnerabilities to build stronger defenses.
• Proficiency in utilizing modern AI assistants to accelerate your own daily workflows, including code analysis and vulnerability remediation.
• Proficiency in at least one programming language in Fabric's stack, such as Ruby, Python, or JavaScript/TypeScript.
• Experience integrating SAST and DAST tooling into CI/CD pipelines.
• Deep understanding of the OWASP Top 10, threat modeling methodologies, and common application vulnerabilities.
• Familiarity with cloud security in AWS environments and an understanding of HIPAA or other regulated industry security requirements.

Bonus Points

• Experience securing healthcare applications or working with PHI.
• Familiarity with EHR integration security including FHIR, HL7, Epic, or Cerner APIs.
• Security certifications such as OSCP, GWEB, or BSCP.
• Experience with bug bounty program management.
• SOC 2 or HITRUST audit support experience.

The national pay range for this role is $130,000.00 – $160,000.00 per year. Actual compensation will be determined by factors such as the candidate's geographic market, experience, skills, and qualifications. Certain roles may also be eligible for additional compensation, including a comprehensive benefits package such as medical, dental, vision, unlimited PTO, and a 401(k) plan, stock options and bonuses. If your compensation requirement is greater than our posted range, please still consider applying; a determination can be made based on unique qualifications. Expected compensation ranges for this role may change over time.