Application Security Engineer

What you'll do

• Build and operate vulnerability identification tools and triage workflows for consumer products and internal systems.
• Manage and integrate the AppSec tooling stack into developer workflows across GitHub, Linear, and Slack.
• Manage the HackerOne bug bounty program by improving triage workflows and strengthening researcher relationships.
• Lead threat modeling and security design reviews to create automated guardrails and lint checks for new features.
• Develop AI agents and automated workflows to triage vulnerabilities and draft remediation pull requests.
• Harden authentication, authorization, and input validation across GraphQL APIs and Kubernetes workloads.
• Execute offensive security testing and red team exercises to identify risks in high-priority flows.
• Establish "secure by default" standards for AI-driven engineering tools and agent-driven workflows.

What we're looking for

• 5+ years of application security or software engineering experience with a security focus.
• Proficiency in at least one of Python, Go, TypeScript, or Ruby, with the ability to read and write code across the others.
• Hands-on expertise with security risk detection tools such as GitHub Advanced Security or Semgrep.
• Strong knowledge of application and API vulnerability classes including GraphQL, REST, and gRPC.
• Experience with cloud and container security on AWS and Kubernetes, including IAM and secrets management.
• Practical threat modeling skills for architecture diagrams and service designs.
• Offensive security experience in pentesting, API security, or red team operations (preferred).
• Experience running bug bounty programs, mobile security reviews, or securing AI/ML pipelines (preferred).