About BJAK: Pioneering FinTech Innovation Across Southeast Asia
At BJAK, we're driven by a powerful mission: to empower millions across Southeast Asia with smarter, more accessible ways to plan, save, and grow their money. Since our inception in 2019, we've rapidly evolved from building the region's first mobile-first, online insurance platform – now the unequivocal market leader – to expanding our horizon across the full spectrum of financial services. From spending and saving to investing, exchanging, and traveling, we're redefining how people engage with their finances every single day.
We are a vibrant, global team, spanning over 20 nationalities, working both from our offices and remotely. Our culture thrives on passion, innovation, and a shared commitment to building groundbreaking, next-generation products that democratize financial access, not just for an exclusive few. We seek individuals who are ignited by challenges, driven by impact, and dedicated to transforming the financial landscape.
If you're ready to make a significant impact and work on products that touch millions of lives, we want to hear from you.
AI Security Engineer: Safeguarding Next-Gen Financial AI
Step into a critical role securing BJAK's innovative AI-enabled products and agent workflows. As an AI Security Engineer, you'll be at the forefront of protecting sensitive customer data, ensuring robust agent permissions, guaranteeing user data isolation, and fortifying our systems against sophisticated prompt injection attacks stemming from untrusted content. This is a unique opportunity to define the security posture for cutting-edge AI applications in the FinTech space.
What You Will Pionee
Architect Data Privacy: Assess and design robust controls for customer data shared with third-party model vendors, focusing on data minimization, vendor control oversight, retention policies, logging practices, and approved data usage.
Engineer Least Privilege: Design and implement stringent controls that limit AI agent permissions, tools, actions, and system access through the application of least privilege principles and explicit authorization mechanisms.
Fortify Data Isolation: Implement and rigorously test tenant and user data isolation across all touchpoints, including prompts, conversation history, retrieval-augmented generation (RAG), memory components, and AI-connected services.
Preempt Advanced Threats: Conduct comprehensive threat modeling and penetration testing specifically targeting prompt injection and indirect injection vectors, including those originating from uploaded documents, retrieved content, links, and other untrusted inputs.
Collaborate on Secure Design: Partner closely with Product and Engineering teams to establish best practices for safe document ingestion, secure content handling, stringent output validation, and a robust approval process for sensitive AI-driven actions.
Ensure Regulatory Compliance: Provide critical support for SC TRM and BNM RMiT compliance regarding AI technology risks, including conducting assessments, overseeing third-party vendors, compiling control evidence, and driving remediation efforts.
Develop Defensive Capabilities: Build and implement advanced security tests, continuous monitoring solutions, and rapid response procedures to address AI misuse, potential data exposure, unauthorized actions, and vendor-related security incidents.
What We Look For In You
Educational Foundation: A Bachelor's degree in Computer Science, Cybersecurity, Artificial Intelligence, or a related field, or equivalent practical experience.
Proven Expertise: A minimum of 3+ years of hands-on experience in application security, product security, security engineering, or specialized AI system security.
Regulatory Acumen: Demonstrated experience implementing or owning controls related to SC TRM and BNM RMiT, technology risk management, or providing regulatory control evidence.
AI Architecture Knowledge: A deep understanding of third-party LLM integrations, model APIs, AI agent tooling, Retrieval-Augmented Generation (RAG) systems, and modern AI application architectures.
Threat Intelligence: In-depth knowledge of prompt injection, indirect injection, cross-user data leakage, risks associated with excessive agent permissions, and vendor data disclosure vulnerabilities.
Technical Proficiency: Strong programming or scripting skills, preferably in Python and TypeScript/Node.js, coupled with experience with APIs and cloud platforms such as AWS or GCP.
Collaborative Spirit: Exceptional ability to collaborate effectively with diverse teams including Product, Legal, Compliance, Data, and Engineering to implement practical security controls and communicate complex risks clearly.
Language
As a global team, English is our primary working language. Strong English communication skills, both written and verbal, are essential for this role.