About AppViewX

AppViewX is the only machine and agent identity security company built for the AI and quantum era, bringing together discovery, automation, control, and intelligence. The AVX Platform helps enterprises reduce risk by providing complete visibility and governance over every machine and AI agent identity, automating their lifecycle, controlling their access, and proving compliance at the speed business demands. Trusted by global enterprises across financial services, healthcare, and technology, AppViewX is recognized as a leader in the IDC 2026 MarketScape for Certificate Lifecycle Management and KuppingerCole’s 2025 Non-Human Identity Management Leadership Compass. For more information, users can visit appviewx.com.

Our Values

Our values define how we work, make decisions, and deliver for our customers and each other. Some reflect strengths deeply engrained in how we work. Others represent the standards we are committed to building together.

We Do What We Say: We own our commitments, communicate honestly about progress, and measure success by results, not activity.
We Are Trusted Experts: We continuously build our expertise, offer candid guidance, and focus on the outcomes our customers and colleagues need.
We Raise the Bar: We stay curious, challenge the status quo, take smart risks, and turn better ideas into meaningful results.
We Win Together: We share information, debate openly, commit together, and recognize that our success is connected to the success of our customers and teammates.

If these values reflect how you want to work and contribute, you will find an opportunity to make a meaningful impact at AppViewX.

Role Overview

AppViewX is building Agent Identity Security and shipping AI-enabled features into products that secure the machine and agent identities of the world’s largest enterprises. Internally, every business unit is moving to AI-augmented and increasingly agentic workflows. Our customers, auditors, and board expect us to be the most credible practitioner of AI security in our category, not just a vendor of it.

This role has two mandates that reinforce each other. First, secure AI and agentic AI: the models, agents, tools, MCP servers, data pipelines, and identities across both our products and our corporate environment. Second, use AI and agents to secure AppViewX: automate detection, triage, testing, and assurance so a lean team operates at a scale that would otherwise take several times the headcount. This is a Senior-level role: you are strong across every domain of security and privacy engineering, you operate with minimal direction in ambiguity, and you mature the technical and administrative controls of the whole organization as the technology changes beneath us. You are an engineer who has personally broken and hardened agentic systems in production, and who has personally built agents that do real security work.

Key Responsibilities

Securing AI and agentic AI

AI security threat modeling. Author and maintain threat models for AI-enabled product changes and internal agent deployments, covering prompt injection (direct and indirect), tool misuse, excessive agency, data exfiltration, memory and context poisoning, and cross-agent trust. Align to OWASP LLM Top 10, OWASP Agentic AI threats, and MITRE ATLAS.
Agent identity, permissioning, and tool-call controls. Define and implement least-privilege, short-lived, auditable identities and scoped credentials for agents; human-in-the-loop gates for high-impact actions; and sandboxing, egress control, and policy enforcement around tool calls and MCP servers. This is our core domain, and we should be the reference implementation.
Prompt and output safety in product. Build input and output guardrails, content and data-leak filters, and structured-output validation into AI-enabled product features, delivered as reusable components engineering can adopt by default.
AI penetration testing and adversarial testing. Lead hands-on penetration tests and adversarial campaigns against AppViewX AI features, internal agents, RAG pipelines, and MCP servers, covering every category of the OWASP Top 10 for LLM Applications and the OWASP agentic threat taxonomy: prompt injection, insecure output handling, training data and context poisoning, model denial of service, supply chain, sensitive information disclosure, insecure plugin and tool design, excessive agency, overreliance, and model theft. Use manual tradecraft plus automated attack agents and fuzzing, scope and run external AI pen test vendors, and turn every finding into a fixed control, regression test, and detection, not a slide deck.