Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 3 days ago

Senior Application & AI Security Engineer

KSM (Katz, Sapper & Miller)48 open roles

Where
Indianapolis
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Application & AI Security EngineerKSM (Katz, Sapper & Miller) · Indianapolis

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on KSM (Katz, Sapper & Miller)'s own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.7% of postings close within 7 days. Measured by our own scanner across the market. KSM (Katz, Sapper & Miller) postings stay open a median of 53 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.5%3 days
  3. 12.7%7 days
  4. 20.4%14 days
  5. 35.6%30 days
  6. 58.7%60 days
This job: posted 3 days ago

KSM (Katz, Sapper & Miller) median: 53 days open

The posting

Job Description:

We’re KSM, one of the top 50 largest independent advisory, tax, and audit firms in the United States. But more than our size, it’s our people and culture that set us apart. We believe great things happen when people are supported, challenged, and given the freedom to do their very best work. That’s why we’ve built a workplace where your career and personal life can thrive together – where you have the flexibility to manage your time, the resources to grow, and a team that genuinely cares about your success.

We’ve been employee-owned since 2001, giving every team member a stake in our collective success. This ownership mentality fosters a culture of collaboration, curiosity, and excellence – where new ideas are welcomed, different perspectives are valued, and you’re encouraged to explore what excites you most. Whether you’re expanding your skills, tackling new challenges, or making an impact beyond the office, we provide the resources and support to help you grow in the direction that’s right for you.

At KSM, your contributions matter – not just to the firm, but to your colleagues, clients, and the communities we serve across the U.S. If you’re looking for a place where you can do meaningful work, build lasting relationships, and grow in ways that align with what’s most important to you, we’d love to meet you.

Position Summary

The Senior Application & AI Security Engineer is a hands-on individual contributor responsible for improving the security of KSM’s internally developed applications, APIs, AI-enabled solutions, and supporting integrations. This role partners directly with software developers, architects, and engineering teams to identify vulnerabilities, strengthen application designs, and implement and validate practical fixes. The engineer integrates security into application and AI development workflows, with particular attention to authentication, authorization, sensitive client data, and risks associated with large language models (LLMs), AI agents, and connected tools. Application and API security remain the primary focus of this position.

Key Responsibilities

  • Assess internally developed applications and APIs for vulnerabilities involving authentication, authorization, access control, and sensitive data exposure.
  • Perform hands-on application security testing, source code reviews, and architecture assessments; prioritize findings by exploitability and business impact.
  • Partner with developers to design and implement fixes, then independently validate that identified vulnerabilities are resolved.
  • Evaluate legacy applications, integrations, and application-to-application communications for security weaknesses.
  • Improve API protections, including service authentication, object-level authorization, secrets management, rate limiting, and abuse prevention.
  • Integrate practical security requirements and testing into the software development lifecycle and CI/CD pipelines.
  • Implement and maintain appropriate SAST, DAST, software composition analysis, and secrets-scanning capabilities.
  • Establish secure coding guidance and reusable patterns for traditional and AI-assisted development; review significant changes before production release.
  • Review application and AI architectures across AWS, Azure, and development environments, including client-data isolation and access to sensitive information.
  • Work with Security and Development to strengthen application, API, and AI integration logging, monitoring, and detection of unauthorized activity.
  • Assess AI-enabled applications, LLM integrations, and agent workflows for prompt injection, sensitive data disclosure, insecure tool execution, and excessive permissions.
  • Review how AI systems access, process, and transmit client information; evaluate controls for AWS Bedrock and other approved AI services.
  • Develop practical security testing for AI features, including adversarial tests of LLM integrations and agent tool calls.
  • Support investigations involving application or AI integration compromise and drive corrective actions to prevent recurrence.
  • Track application security findings through remediation and communicate material risks, priorities, and progress to leadership.

Qualifications & Experience

Required

  • 6+ years of hands-on experience in software development, application security engineering, or closely related technical roles.
  • Strong knowledge of web application and API security, including authentication, authorization, session management, and access control.
  • Demonstrated experience identifying, remediating, and validating vulnerabilities in production applications.
  • Ability to read, understand, and review application source code and collaborate directly with software developers.
  • Practical experience with application security assessments, manual testing, and code reviews.
  • Familiarity with OWASP Top 10, OWASP API Security Top 10, and OWASP Top 10 for LLM Applications.
  • Understanding of LLM application architectures, AI agent permissions, prompt injection, and the security implications of AI tool integrations.
  • Experience securing REST APIs, service-to-service authentication, and application credentials.
  • Experience incorporating security testing into CI/CD pipelines and software development workflows.
  • Ability to work independently, prioritize effectively, and explain technical risks and remediation to developers and business stakeholders.

Preferred

  • Professional software development experience in languages and frameworks used by KSM’s development teams.
  • Experience securing applications and APIs hosted in AWS or Azure.
  • Experience with SAST, DAST, software composition analysis, and secrets-scanning tools.
  • Experience with application penetration testing, threat modeling, or secure architecture reviews.
  • Experience protecting sensitive financial, personal, or confidential client information in multi-tenant applications.
  • Familiarity with OAuth 2.0, OpenID Connect, SAML, and modern identity integration patterns.
  • Experience improving application/API logging, monitoring, and detection capabilities, including AI integrations.
  • Hands-on experience securing production AI applications or integrations, including AWS Bedrock or comparable platforms.
  • Experience with AI security testing, adversarial evaluation, or assessing prompt injection and agent tool access.
  • Relevant credentials such as OSWE, CSSLP, or GWAPT, or equivalent demonstrated expertise.

We are an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, color, sex, sexual orientation, gender identity, disability, genetic information, national origin, race, religion, veteran status, or any other protected category.

KSM only accepts resumes directly submitted by a candidate and referrals submitted by current KSM employees. Unsolicited resumes or candidate profiles sent by staffing agencies and fee-based referral services will not be considered outside of a signed KSM vendor contract. KSM will not pay a fee to recruiters or agencies that do not have a signed KSM vendor contract.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against KSM (Katz, Sapper & Miller)'s own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on KSM (Katz, Sapper & Miller)'s form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    KSM (Katz, Sapper & Miller)'s answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.