> Markdown version of [/jobs/ext/4616794-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4616794-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Application Security Engineer

- **Company:** Gravity It
- **Location:** Miami, FL, United States
- **Experience:** Expert
- **Contract:** Temporary contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Data Analysis, Microsoft Azure, Cloud Engineering, Distributed Systems, Identity and Access Management, Network Security, OAuth, OpenID, Web Applications, Policy as Code, Cloud Platform System, Software Security, Backend, Agentic-AI, Rate Limiting, Api Gateway, Devsecops
- **Published:** November 7, 2026
- **Apply:** https://www.juju.com/job/28_25197_0ecc6860c78cf32a2e5960fc033bf36f

## About the Role

* Strong experience in security engineering, application security, or platform security
 * Hands-on experience securing large-scale, consumer-facing eCommerce platforms
 * Strong foundation in web application and API security
 * Deep understanding of OAuth 2.0/2.1, OIDC, token-based authorization, service principals
 * Experience designing fine-grained least-privilege access models for distributed systems
 * Non-Human Identity (NHI) lifecycle management in dynamic environments
 * Experience with AI-enabled or automation-heavy systems; familiarity with agentic/autonomous system risks
 * Ability to reason about non-deterministic execution and enforce deterministic controls
 * MCP Security Standards and agent runtime authorization
 * Experience with WAFs, API gateways, edge security controls
 * Familiarity with cloud-native architectures and service-to-service security
 * Strong written/verbal communication; able to translate complex security concepts for cross-functional teams (product, platform, AI/ML, identity)
 * DevSecOps/AppSec experience required

Nice to Have

 * Experience with agent frameworks or orchestration systems
 * Familiarity with policy-as-code or runtime enforcement models
 * Background in fraud, abuse prevention, or financial transaction security
 * Experience in regulated or high-availability environments

## Description

Our client is seeking a senior Security Engineer to support a strategic initiative embedding agentic AI into a large-scale eCommerce platform - spanning guest-facing autonomous features (search, personalization, booking) and internal agentic services (content, knowledge, analytics). This role blends agentic AI security, identity and access management, and enterprise eCommerce application security. The engineer will design and operationalize runtime guardrails, identity-aware authorization, and policy enforcement across guest-facing and internal systems.

This is not a traditional AppSec role - the ideal candidate is comfortable securing non-deterministic systems, tool-calling agents, and identity-driven control planes, while applying proven web, API, and edge-security fundamentals.

Responsibilities

 * Design and implement security control planes for agentic AI systems
 * Define runtime authorization boundaries for AI agents, including tool-level access control and least-privilege execution
 * Establish policy enforcement points governing agent behavior ahead of high-impact actions
 * Support human-in-the-loop workflows for sensitive/high-risk AI-initiated actions
 * Design and review identity models for guests, employees, and non-human agent/workload identities
 * Implement/advise on OAuth/OIDC-based delegation and short-lived credential strategies
 * Ensure end-to-end attribution across user ? agent ? tool execution chains
 * Secure guest-facing eCommerce flows: search, personalization, cart, booking
 * Review backend service architectures supporting AI-driven experiences
 * Promote agent-safe API patterns: idempotency, preview/apply, rollback, rate limiting
 * Collaborate on edge controls: WAFs, bot mitigation, API gateways
 * Ensure consistent enforcement from edge ? API ? service ? AI runtime layers
 * Support secure cloud-native, containerized, and sandboxed deployments (Google, AWS, Azure)
 * Define security telemetry and audit requirements for agentic systems
 * Support detection/response for runaway agents or excessive autonomy
 * Align implementations with enterprise security standards and governance