Passionate about precision medicine and advancing the healthcare industry?
Recent advancements in underlying technology have finally made it possible for AI to impact clinical care in a meaningful way. Tempus' proprietary platform connects an entire ecosystem of real-world evidence to deliver real-time, actionable insights to physicians, providing critical information about the right treatments for the right patients, at the right time.
Passionate about precision medicine and advancing the healthcare industry?
Recent advancements in underlying technology have finally made it possible for AI to impact clinical care in a meaningful way. Tempus' proprietary platform connects an entire ecosystem of real-world evidence to deliver real-time, actionable insights to physicians, providing critical information about the right treatments for the right patients, at the right time.
About the role:
As an Application Security Engineer, you will secure how Tempus builds software, from design through release. You will partner with product and engineering teams to build security into the software development lifecycle (SDLC), and you will assess our applications and APIs the way an attacker would, through security assessments and penetration tests. The applications you secure handle sensitive clinical and genomic data and increasingly include AI-powered capabilities, so securing AI and LLM-enabled systems is a core part of the role.
You will own well-defined application security problems within your team's scope, with guidance from your lead.
What you'll do
- Embed security into the SDLC through threat modeling, design reviews, security requirements, and security-focused code reviews with product and development teams.
- Plan and conduct application security assessments and penetration tests of web applications, APIs, and cloud-hosted services, and document findings with clear risk ratings and practical remediation guidance.
- Threat model and assess AI and LLM-enabled features (agents, RAG pipelines, tool and MCP integrations), including adversarial prompt testing and validation of guardrails, permissions, and data access controls.
- Select, integrate, and tune SAST, DAST, software composition analysis, and secrets scanning in CI/CD pipelines.
- Build automation, secure-by-default patterns, and guardrails that prevent whole classes of vulnerabilities.
- Use AI-assisted tooling to scale code review, triage, and remediation, applying human judgment to validate the results.
- Reproduce, triage, and prioritize application security vulnerabilities, and work with developers through to remediation.
- Communicate the nature, severity, and business risk of security issues to development teams and leadership.
- Design, implement, and document application security controls, standards, and secure coding guidance.
- Run and support the vulnerability disclosure program.
- Coach developers on secure design and coding through consulting, training, and everyday collaboration.
What you'll bring
- 3-5 years of experience in application security, penetration testing, or software engineering with a security focus.
- Hands-on experience testing web applications, APIs, and cloud-hosted services, using proxying and penetration testing tools (e.g. Burp Suite), and strong command of common security flaws and mitigations (e.g. OWASP Top 10).
- Experience performing security design reviews at the architecture level
- Working experience securing AI and LLM-enabled applications: how they are designed and how they fail, including prompt injection, data leakage, excessive agency, and insecure output handling (e.g. OWASP Top 10 for LLM Applications).
- Practical experience with at least one threat modeling method (e.g. STRIDE, PASTA, attack trees).
- Experience with SAST, DAST, and SCA tools and integrating them into CI/CD pipelines.
- Proficiency in Python, Go, or JavaScript for security tooling and automation, and the ability to read and review code.
- Solid understanding of network and web protocols (TCP/IP, HTTP/S), authentication and authorization (e.g. OAuth/OIDC), and cryptography fundamentals.
- Able to work well with software development teams and Product Managers.
- Excellent written and verbal communication, with the ability to explain complex topics clearly and concisely.
Bonus points for:
- Hands-on AI red teaming or security testing of agentic or RAG systems; familiarity with MITRE ATLAS or the NIST AI Risk Management Framework
- Experience with Docker, Kubernetes, GCP or AWS, and infrastructure-as-code scanning
- Bug bounty or vulnerability disclosure program experience
- Experience with HIPAA and healthcare data protection
- An interest in working in biotech, genomics, and precision medicine
- Certifications such as GWAPT, OSCP, CSSLP, CISSP, or ISC2 CC (Certified in Cybersecurity)
CHI: $85,000-$130,000
The expected salary range may vary for other locations. Actual salary may vary based on qualifications and experience. Tempus offers a full range of benefits, which may include incentive compensation, restricted stock units, medical and other benefits depending on the position.
We are an equal opportunity employer. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.
Skills Required
- 3-5 years of experience in application security, penetration testing, or software engineering with a security focus
- Hands-on experience testing web applications, APIs, and cloud-hosted services
- Experience using proxying and penetration testing tools such as Burp Suite
- Strong knowledge of common security flaws and mitigations, including the OWASP Top 10
- Experience performing architecture-level security design reviews
- Experience securing AI and LLM-enabled applications, including prompt injection, data leakage, excessive agency, and insecure output handling
- Practical experience with at least one threat modeling method, such as STRIDE, PASTA, or attack trees
- Experience with SAST, DAST, and SCA tools and integrating them into CI/CD pipelines
- Proficiency in Python, Go, or JavaScript for security tooling and automation
- Ability to read and review software code
- Understanding of TCP/IP, HTTP/S, authentication, authorization, OAuth/OIDC, and cryptography fundamentals
- Ability to collaborate effectively with software development teams and Product Managers
- Excellent written and verbal communication skills
- Hands-on AI red teaming or security testing of agentic or RAG systems
- Familiarity with MITRE ATLAS or the NIST AI Risk Management Framework
- Experience with Docker, Kubernetes, GCP or AWS, and infrastructure-as-code scanning
- Bug bounty or vulnerability disclosure program experience
- Experience with HIPAA and healthcare data protection
- Interest in biotech, genomics, and precision medicine
- Certifications such as GWAPT, OSCP, CSSLP, CISSP, or ISC2 CC
What the Team is Saying
Tempus AI Compensation & Benefits Highlights
-
Healthcare Strength — Healthcare is considered solid, with PPO coverage often described as good and medical, dental, and vision options broadly available. Feedback suggests the overall health offering is a relative strong point despite mixed comments on premiums.
-
Leave & Time Off Breadth — Time off is frequently characterized as flexible, with reports of unlimited or generous PTO in many corporate roles. Feedback suggests policies can vary by team, but the offering is generally viewed favorably.
-
Wellbeing & Lifestyle Benefits — Workplace perks such as free meals/snacks, on-site amenities like a barista, gym discounts, and commuter benefits are commonly highlighted. Feedback suggests these lifestyle benefits add day-to-day value, especially at larger offices.
Tempus AI Insights
What We Do
We bring together one of the world’s largest libraries of multimodal clinical and molecular data with a robust suite of AI tools to help physicians personalize care in real time, connect patients with therapies and clinical trials, and enable partners to accelerate discovery and development of new treatments. With ~8 million de-identified research records and 350+ petabytes of data, Tempus partners with more than half of U.S. oncologists and the majority of the top 20 global pharma companies. Our teams are pioneering work across oncology, neurology, psychiatry, cardiology, and beyond—transforming how care is delivered and therapies are developed. At Tempus, every role contributes to our mission: to help each patient benefit from the experiences of those who came before. For more information, visit tempus.com.
Why Work With Us
We’re looking for people who can change the world. People who question the status quo and refuse to shy away from tough problems. For builders who are never done building, and the learners who are never done learning. Passionate individuals with undying curiosity who want to take on one of the greatest challenges humanity has ever faced—head on.
Gallery
Tempus AI Offices
Hybrid Workspace
Employees engage in a combination of remote and on-site work.
Most of the team follows a hybrid policy, with some roles allowing for a fully remote arrangement and some roles being onsite only.
