Description of PositionTPG has an exciting opportunity for a senior application security professional to help secure the firm's software and AI systems. The number one focus of this role is the secure development and operation of agentic AI. TPG's Cybersecurity team protects the firm's applications, data, and clients across a fast-moving technology landscape. As the firm expands its use of generative and agentic AI, we are building application security expertise to ensure these systems are designed, deployed, and operated securely. This is a hands-on, high-impact role for a senior practitioner who enjoys partnering directly with software engineers and embedding security into how products are built.
Principal Responsibilities- Serve as the firm's subject-matter expert on agentic AI development - partnering with engineering teams to securely design, build, and operate AI agents, autonomous workflows, and tool-using LLM applications
- Identify and help remediate AI-specific risks such as prompt injection (direct and indirect), jailbreaking, insecure tool and function calling, excessive agency, memory and context poisoning, model and data leakage, and emergent privilege escalation across multi-step agentic workflows
- Establish security controls and guardrails for generative and agentic AI workloads, including the Model Context Protocol (MCP), agent frameworks, retrieval-augmented generation (RAG) pipelines, and the data sources and tools agents can access
- Partner with developers to secure authentication and authorization processes, including the design and review of identity flows, session management, secrets handling, and least-privilege access across applications and AI systems
- Review code scan analysis exception requests - evaluating SAST, DAST, SCA, and related findings, validating risk acceptance rationale, and making well-documented decisions that balance security with business needs
- Define and document SDLC, identity, and authentication best practices for developers, and create clear, practical guidance that makes secure development easier to adopt
- Review existing application stacks against security best practices, identify gaps, and work with development teams to define, prioritize, and track remediation plans
- Perform threat modeling and secure design reviews early in the development lifecycle to identify weaknesses before code is written
- Embed security controls into CI/CD pipelines and agentic delivery workflows, integrating automated testing and policy enforcement
- Apply recognized AI and application security frameworks - such as the OWASP Top 10, OWASP Top 10 for LLM Applications, NIST AI Risk Management Framework, and MITRE ATLAS - to assess and manage risk
- Manage third-party AI red-teaming engagements and third-party application penetration testing - defining scope, coordinating with vendors, and driving findings through remediation
- Mentor and educate developers on secure coding, secure AI development, and emerging application security threats
- Contribute to enterprise application and AI security standards, reference architectures, and governance policy
Requirements- Minimum 3 years experience in application security or product security and 7 total cumulative experience across software development and information security
- Demonstrated experience securing generative AI and/or agentic AI systems, or strong, current hands-on knowledge of LLM and agentic AI security risks and the ability to apply it in a production environment
- Deep familiarity with authentication and authorization protocols and standards (e.g., OAuth 2.0, OpenID Connect, SAML, JWT) and common identity and access pitfalls
- Strong working knowledge of the secure software development lifecycle (SDLC) and experience embedding security into developer workflows
- Strong familiarity with DevOps/CI-CD pipelines and modern deployment practices, including deploying serverless functions and containerized workloads to Kubernetes, and securing those build and deployment pipelines
- Hands-on experience with application security testing tools and techniques, including SAST, DAST, SCA, and manual secure code review
- Solid understanding of the OWASP Top 10, CWE, and CVSS scoring, and the ability to triage and prioritize vulnerabilities
- Practical knowledge of web, API, and cloud application architectures, and the security risks associated with each
- Ability to read and understand code in one or more common languages (e.g., Python, JavaScript/TypeScript, Java, C#, or Go)
- Strong written and verbal communication skills, with the ability to explain security concepts to both technical and non-technical audiences
- Strong collaboration and influencing skills, including the ability to influence engineering teams without direct authority and to communicate risk clearly to both developers and leadership
- Strong attention to detail and sound, risk-based judgment
Preferred Qualifications- Bachelor's degree or higher in Computer Science, Information/Cyber Security, or a related field, or equivalent work experience
- Hands-on experience with AI agent frameworks and tooling and with the Model Context Protocol (MCP)
- Experience with AI red-teaming, adversarial testing of LLMs and agents, or building AI security guardrails and evaluation pipelines
- Relevant certifications such as CSSLP, GIAC GWAPT, OffSec OSWE, CISSP, or a recognized AI security certification
- Experience securing cloud-native environments (AWS, Azure, or GCP) and infrastructure-as-code
- Experience integrating security tooling into CI/CD platforms such as GitHub Actions, GitLab CI, or Jenkins
- Hands-on experience with GitHub Advanced Security (code scanning, secret scanning, and dependency review/Dependabot)
- Familiarity with the NIST Secure Software Development Framework (SSDF), OWASP SAMM, and software supply chain security (e.g., SLSA)
- Experience in financial services or another regulated industry
- Prior experience mentoring developers or leading security champion / secure-by-design programs
