Application Security Consultant- Remote (Anywhere in the U.S.)
About this role
The Application Security Practice at GuidePoint Security builds and matures application security programs and Secure SDLC capabilities to help clients identify, understand, and remediate risk across modern platforms and AI-native architectures. This team member will conduct challenging technical assessments, perform threat modeling and source code reviews, and advance testing methodologies for AI, LLM, and agentic application security. Professionals who thrive in this environment possess strong offensive testing abilities, practical AI fluency, and the capacity to translate complex technical findings into actionable remediation strategies for diverse client stakeholders.
Operating within a rapidly growing organization, the consultant will also build custom AI-driven tooling and automation harnesses to improve testing coverage and efficiency while contributing to original security research. The role exists to support expanding professional service offerings and to guide clients through emerging security threats across web, mobile, and autonomous systems. Ideal candidates combine a rigorous technical foundation in application security with a proactive mindset toward evolving industry standards.
What you will do
- Deliver application security services including security assessments for web, mobile, AI, and thick client applications, alongside threat modeling and source code reviews.
- Perform AI, LLM, and agentic application security assessments covering prompt injection, model bypass, excessive agency abuse, and RAG poisoning.
- Assess agentic AI architectures for insecure tool integrations, goal manipulation, and cross-prompt injection against relevant OWASP frameworks.
- Author comprehensive assessment deliverables that detail technical execution, core deficiencies, business impact, and realistic remediation strategies.
- Build and extend AI-driven tooling and automation harnesses using LLMs to improve testing coverage, consistency, and efficiency.
- Contribute to application security research projects and support marketing initiatives through conference speaking, blog articles, and whitepapers.
What you need
- Possess a High School Diploma with at least 5 years of experience, a Bachelor’s Degree with 2 years of experience, or a Master’s Degree.
- Bring a minimum of two years of experience performing application security assessments.
- Demonstrate at least one year of experience in an enterprise-level consulting services role.
- Have hands-on experience using testing tools such as Burp Suite, Postman, Netsparker, sqlmap, DirBuster, and OpenSSL.
- Show experience reviewing source code written in languages including JavaScript, Python, Java, C++, PHP, or C#.
- Demonstrate hands-on experience testing AI, LLM-powered applications, and agentic AI systems for security vulnerabilities.
- Familiarity with the OWASP Top 10 for LLM Applications and the OWASP Top 10 for Agentic Applications.
Nice to have
- Over four combined years of IT and information security experience
- Internal operational or DevSecOps experience
- Experience building AI agents, agent skills, custom tools, and full AI-assisted testing harnesses
- InfoSec community involvement such as conference speaking, blog authoring, and podcast participation
- Standard industry certifications
Skills and tech stack
Questions candidates ask
What is the remote work policy for this position?
The position is remote and available to candidates anywhere in the United States. Travel requirements for the role are up to 20%.
What kind of technical assessments will I perform?
You will execute application security assessments for web, mobile, and thick client applications, as well as AI, LLM, and agentic application security assessments. Additional responsibilities include threat modeling, source code reviews, and application architecture reviews.
What AI and security frameworks are relevant to the work?
Testing is mapped to industry standards such as the OWASP Top 10, the OWASP Top 10 for LLM Applications, and the OWASP Top 10 for Agentic Applications. You will also assess agentic AI architectures like LangChain, CrewAI, AutoGPT, and MCP-based agents.
What application frameworks and languages are expected?
You will need experience reviewing source code written in JavaScript, Python, Java, C++, PHP, or C#. Practical usage of LLM APIs and SDKs such as OpenAI, Anthropic, Bedrock, and Azure OpenAI is also required.
What applicant tracking and scheduling tools does the company use?
The company uses Greenhouse Software as an applicant tracking system and Zoom Scheduler for HR screen request scheduling.
The application is on the official GuidePoint Security careers page.
Apply on company site