Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 12 hours agoWe saw it 7 min after it went up

Staff AI Security Engineer

Agoda311 open roles

Pay
SGD 10,900 – SGD 16,300 a month
Where
Singapore
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowStaff AI Security EngineerAgoda · Singapore

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Agoda's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.5% of postings close within 7 days. Measured by our own scanner across the market. Agoda postings stay open a median of 32 days.

Share of postings closed within
  1. 2.3%1 day
  2. 4.6%3 days
  3. 13.5%7 days
  4. 21.8%14 days
  5. 36.6%30 days
  6. 58.9%60 days
This job: posted 12 hours ago

Agoda median: 32 days open

The posting

About Agoda

At Agoda, we bridge the world through travel. Our story began in 2005, when two lifelong friends and entrepreneurs, driven by their passion for travel, launched Agoda to make it easier for everyone to explore the world.

Today, we are part of Booking Holdings [NASDAQ: BKNG], with a diverse team of over 7,000 people from 90 countries, working together in offices around the globe. Every day, we connect people to destinations and experiences, with our great deals across our millions of hotels and holiday properties, flights, and experiences worldwide.

No two days are the same at Agoda. Data and technology are at the heart of our culture, fueling our curiosity and innovation. If you’re ready to begin your best journey and help build travel for the world, join us.

Get to Know Our Team

The Security Department oversees application security, compliance, GRC, and security operations for all Agoda. We are vigilant in ensuring there is no breach or vulnerability threatening our company or endangering our employees in order to keep Agoda safe and protected. This would be a great challenge for those who want to work with the best technology in a dynamic and advanced environment.

The Opportunity

You will be joining the AppSec Engineering team at a pivotal moment: AI is changing both how we defend Agoda and what we need to defend. As an AI Security Engineer, you will build AI-powered security engineering capabilities that let a lean team secure a fast paced DevSecOps environment where code ships continuously, and you will make sure the AI systems and agents Agoda builds are secure by design. This is a builder's role with a primary focus on security engineering and threat modeling: you will ship and own production systems, not just own one-off scripts.

What You Will Do

  • Design, build, and operate AI-powered security engineering systems, such as LLM-driven secure code review, finding triage and de-duplication, and automated fix suggestions, and own them end-to-end in production.
  • Build AI-assisted threat modeling that scales our design reviews: drafting threat models from design docs and architecture, flagging high-risk changes, and routing the reviews that need a human in the room.
  • Harden the AI developer platforms our engineers use every day, such as Cursor, Codex and Claude, always-on agent platforms including MCP/plugin governance and policy controls.
  • Lead security design reviews and threat modeling for the AI systems and agents built at Agoda, including LLM-integrated products, RAG pipelines, MCP/tool integrations, and internal agentic platforms.
  • Define and implement security controls and guardrails for AI agents: agent identity and delegated credentials, least-privilege tool access, sandboxing, human-in-the-loop approval for risky actions, and audit logging.
  • Develop defenses against AI-specific threats such as prompt injection, data exfiltration through tools, insecure output handling, and model and supply chain risks, and turn them into secure-by-default patterns and standards for engineering teams.
  • Build agentic security tooling that automates AppSec workflows end-to-end, from intake and risk scoring to ticketing and remediation tracking, keeping outcomes measurable, auditable, and safe.
  • Measure and continuously improve the quality of our AI security tooling (precision, coverage, false-positive rate) by tuning models, prompts, and pipelines.
  • Partner with product, platform, data, and AI engineering teams as an embedded security owner, and work closely with AppSec analysts to turn their findings into scalable, automated fixes.
  • Stay ahead of AI security research and industry frameworks, and share what you learn across Agoda's engineering community.

What You Will Bring

  • Software engineering and production systems: Strong software engineering foundations, with at least 3 years of SDLC experience in Python, Go, TypeScript/Node.js, Kotlin, or similar, and a track record of building and operating production quality systems.
  • Security expertise: At least 6 years of relevant experience across security engineering, application security, threat modeling, secure coding, identity and access management, software development, or cloud security. Strong knowledge of secure design for distributed systems and microservices, OWASP Top 10 vulnerabilities and code level remediation, OAuth 2.0/OIDC, service to service authentication, and least privilege.
  • Cloud and AI security: At least 2 years of experience with public or private cloud environments, and 1 year of hands on experience building LLM enabled applications, agents, tool calling/MCP, RAG, or evaluation pipelines. Understand key AI and LLM risks, including prompt injection, excessive agency, sensitive data leakage, and insecure output handling, with familiarity with OWASP Top 10 for LLM Applications or MITRE ATLAS.
  • Security mindset: Applies an analytical, offensive security mindset to identify and understand how vulnerabilities are discovered and exploited. Uses AI thoughtfully as part of their work, exercises autonomy in ambiguous problem spaces, and communicates technical and nontechnical concepts effectively to diverse audiences.

It is Great if You Have

  • Experience securing agentic, code-execution, or LLM-integrated systems in production (sandboxing, isolation, guardrails).
  • Experience building developer-facing security tooling or security automation integrated into CI/CD.
  • Experience with LLM evaluation or red-teaming of AI systems, or contributions to AI security research, open-source tools, or community frameworks.
  • Familiarity with AI governance and risk frameworks such as NIST AI RMF or ISO/IEC 42001.

Salary and Location

This role is based in Singapore.

Monthly base salary: SGD 10,900-16,300

Please review our Hiring Process Guidelines before your interview — click here to learn how interviewing at Agoda works.

Discover more about working at Agoda

  • Agoda Careers https://careersatagoda.com
  • Facebook https://www.facebook.com/agodacareers/
  • LinkedIn https://www.linkedin.com/company/agoda
  • YouTube https://www.youtube.com/agodalife

Equal Opportunity Employer

At Agoda, we pride ourselves on being a company represented by people of all different backgrounds and orientations. We prioritize attracting diverse talent and cultivating an inclusive environment that encourages collaboration and innovation. Employment at Agoda is based solely on a person’s merit and qualifications. We are committed to providing equal employment opportunity regardless of sex, age, race, color, national origin, religion, marital status, pregnancy, sexual orientation, gender identity, disability, citizenship, veteran or military status, and other legally protected characteristics.

We will keep your application on file so that we can consider you for future vacancies and you can always ask to have your details removed from the file. For more details please read our privacy policy.

Disclaimer

We do not accept any terms or conditions, nor do we recognize any agency’s representation of a candidate, from unsolicited third-party or agency submissions. If we receive unsolicited or speculative CVs, we reserve the right to contact and hire the candidate directly without any obligation to pay a recruitment fee.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Agoda's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Agoda's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Agoda's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.