Lead AI Security Engineer (EPAM SISTEMOS, UAB)

Job description:
We are seeking a Lead AI Security Engineer to secure software across the full development lifecycle. This role embeds security into design, code, build and release; operates application security tooling and pipelines; partners with engineering to drive remediation; and applies AI both to accelerate AppSec work and to secure AI- and LLM-powered applications.
This position offers hybrid setup with the flexibility to work from any location in Lithuania, whether it's your home or our dynamic offices in Vilnius and Kaunas.
Embed security into the full software development lifecycle and drive shift-left and secure-by-design practices across engineering teams
Perform and facilitate threat modeling, architecture security reviews, and design reviews for applications, services, and APIs
Conduct secure code reviews (manual and AI-assisted) and advise developers on secure coding patterns and remediation
Implement, configure, tune, and operate application security tooling, including SAST, DAST, IAST, SCA, secrets scanning, and IaC scanning, integrated into CI/CD pipelines
Triage, validate, prioritize, and reduce false positives in security findings, and partner with development teams to track issues through to remediation
Define, implement, and maintain security gates and policies in CI/CD pipelines that balance risk reduction with developer velocity
Secure the software supply chain, including dependency and open-source risk management, SBOM generation, artifact integrity and signing, and build pipeline hardening
Support and coordinate application penetration testing and validate fixes for identified vulnerabilities
Drive secrets management, secure configuration, API security, container and image security, and microservice security practices
Establish and run a security champions program, and develop and deliver secure-coding training, guidelines, and reusable security patterns for developers
Define and maintain application security standards, baselines, and policy-as-code, and contribute to vulnerability management and risk-acceptance processes
Build, deploy, and maintain AI-assisted automations and agentic workflows that reduce manual effort across daily application security activities, such as: vulnerability triage, deduplication, prioritization, and false-positive reduction; automated and assisted code review with concrete remediation guidance and example fixes; threat modeling support and abuse-case and attack-path generation; finding enrichment, root-cause analysis, and remediation-PR drafting; compliance evidence collection; secure-coding documentation, query, and runbook automation
Build and integrate AI agents and LLM-backed automations into the SDLC and CI/CD pipelines, connecting models to scanners, code hosts, ticketing, and security tooling via function calling, REST, and webhooks
Develop, test, and maintain reusable prompts, structured-prompting patterns, and prompt templates for recurring AppSec tasks, and tune them for…