Application Security Engineer

ElevenLabs ElevenLabs · AI Frontier · United Kingdom · Engineering & Product

ElevenLabs is an AI research and product company that has expanded into voice, creative tools, and APIs. They are seeking an Application Security Engineer to build systems and tooling that enable secure software shipping at high velocity, integrating with AI-assisted and agentic coding workflows. The role involves designing security tooling, reviewing architectures, identifying and remediating vulnerabilities, shipping security features, and implementing supply chain controls. Requires a strong software engineering background, experience in cloud-native environments, and application security expertise. Bonus points for experience securing AI/ML systems or working in regulated environments.

What you'd actually do

  1. Design and build application security tooling and guardrails that integrate directly into modern development workflows, including environments that heavily leverage AI-assisted and agentic coding
  2. Partner with Engineering and Infrastructure teams to review application architectures, develop threat models and build in secure by default patterns throughout the software development lifecycle
  3. Identify, prioritise and remediate application security vulnerabilities, working directly with engineers and contributing to fixes where required, across the entire stack.
  4. Ship new security features which directly improve the security posture of our products in production
  5. Design and implement supply chain security controls across build and deployment pipelines, including artefact signing, provenance, dynamic admission controls and SBOM generation

Skills

Required

  • Python
  • TypeScript
  • AWS or GCP
  • Kubernetes
  • Terraform
  • application security
  • software engineering

Nice to have

  • Securing AI or Machine Learning systems
  • training pipelines
  • developer experience
  • platform engineering
  • building developer tooling
  • open source security projects
  • published research
  • talks at security conferences
  • regulated environments (SOC 2, ISO27001, PCI, HIPAA or similar)

What the JD emphasized

  • building systems and tooling that enable teams to ship secure software at high velocity
  • AI-assisted and agentic coding
  • building and scaling security programs or developer security tooling from scratch
  • production quality code
  • cloud-native environments (AWS or GCP), Kubernetes, and infrastructure-as-code (Terraform)
  • prioritise fixes without relying on CVE scores alone
  • driving real security improvements through technical design, implementation and secure defaults, rather than through policy or manual review alone