AI Security Engineer at BJAK: Secure the Future of AI-Powered Finance
About BJAK: Pioneering the Future of Finance
At BJAK, we believe everyone deserves smarter ways to manage their money. Born in 2019 with a vision to revolutionize financial accessibility, we rapidly built Southeast Asia's leading mobile-first insurance platform. Today, we're expanding our reach across spending, saving, investing, exchanging, and travel – empowering millions to get more from their money every single day.
We are a global team of over 20 nationalities, united by a passion for building next-generation products that redefine financial applications for everyone, not just a select few. If you're driven by impact, thrive on innovation, and aren't afraid to challenge the status quo, you've found your home.
The Opportunity: Shape the Security of AI-Powered Finance
As an AI Security Engineer, you'll be at the forefront of securing BJAK's innovative, AI-enabled financial products and agent workflows. In a landscape rapidly evolving with third-party models, your expertise will be crucial in protecting sensitive customer data, ensuring robust agent permissions, maintaining user data isolation, and fortifying against sophisticated threats like prompt injection via untrusted content. This is a high-impact role where your contributions directly safeguard our users and uphold our trust.
What You'll Do: Core Responsibilities
Data Minimization & Vendor Security: Assess and design robust controls for customer data shared with third-party model vendors, focusing on data minimization, vendor security controls, retention policies, comprehensive logging, and approved data usage.
AI Agent & System Access Control: Design and implement least privilege controls for AI agent permissions, tools, actions, and system access, ensuring explicit authorization for all critical operations.
Tenant & User Data Isolation: Implement and rigorously test tenant and user data isolation mechanisms across all AI components, including prompts, conversation history, retrieval-augmented generation (RAG), memory, and interconnected AI services.
Advanced Threat Modeling & Injection Testing: Proactively threat model and conduct comprehensive testing for prompt injection and indirect injection vulnerabilities through uploaded documents, retrieved content, embedded links, and other untrusted inputs.
Secure AI Product Development: Partner closely with Product and Engineering teams to establish safe document ingestion practices, secure content handling, stringent output validation, and approval processes for sensitive actions.
Regulatory Compliance & Risk Management: Provide critical support for SC TRM and BNM RMiT regarding AI technology risks, including conducting assessments, overseeing third-party risks, gathering control evidence, and driving remediation efforts.
Build & Monitor AI Security: Develop and implement advanced security tests, comprehensive monitoring solutions, and rapid response procedures for AI misuse, data exposure incidents, unauthorized actions, and vendor-related security incidents.
What You'll Bring: Your Expertise
Educational Foundation: A Degree in Computer Science, Cybersecurity, AI, or a related field, or equivalent practical experience demonstrates your foundational understanding.
Proven Security Experience: 3+ years of dedicated experience in application security, product security, security engineering, or specialized AI system security.
Regulatory Compliance Acumen: Hands-on experience implementing, owning, or providing evidence for SC TRM and BNM RMiT controls, technology risk frameworks, or other relevant regulatory compliance.
Deep AI Architecture Knowledge: Strong understanding of third-party LLM integrations, model APIs, AI agent tooling, RAG architectures, and overall AI application development.
AI-Specific Threat Awareness: In-depth knowledge of prompt injection, indirect injection, cross-user data leakage, excessive agent permissions, and vendor data disclosure risks.
Technical Proficiency: Solid programming or scripting skills, preferably in Python and TypeScript/Node.js, alongside experience with APIs and cloud platforms like AWS or GCP.
Collaborative Spirit: Demonstrated ability to collaborate effectively with Product, Legal, Compliance, Data, and Engineering teams to implement practical security controls and communicate risks clearly.
Language Requirements
Given our global team and operations, strong English communication skills (both written and verbal) are essential for this role.