Application Security Engineer

What you'll do

• Build and operate vulnerability identification, triage, and remediation capabilities, integrating security findings into developer workflows and maturing the HackerOne program.
• Lead threat modeling, security design reviews, and offensive testing; turn findings into secure design standards, rules, and CI guardrails.
• Build AI agents and automated workflows for vulnerability triage, exploit verification, and remediation drafting; partner with engineering teams to harden applications and services.

What they ask for

• Application security or software engineering experience with a security focus; strong skills in at least one of Python, Go, TypeScript, or Ruby, and ability to read and write code across the others.
• Hands-on deployment experience with GitHub Advanced Security, Semgrep, or equivalent security risk detection tools.
• Strong understanding of application and API vulnerability classes, including GraphQL, REST, and gRPC security pitfalls; practical threat modeling skills.
• Experience with cloud and container security on AWS and Kubernetes, including IAM, secrets management, and CI/CD pipeline security.

Nice to have

• Offensive security, bug bounty or coordinated disclosure program experience, or mobile application security review experience.
• Experience securing AI/ML pipelines, agent frameworks, or MCP-style integrations; OSCP, OSWE, or similar offensive certifications.

Tools

Go, Python, TypeScript, Ruby, Terraform, AWS, Kubernetes, Apollo GraphQL

AI focus

Build AI agents and automated workflows for vulnerability triage, exploit verification, and remediation drafting; establish secure-by-default practices for AI-enabled engineering, agents, and MCP integrations.