Application Security Engineer

What you'll do

• Build and operate vulnerability identification tools and triage workflows for consumer products and GraphQL APIs.
• Manage the AppSec tooling stack including static/dynamic testing, supply chain risk detection, and secrets scanning.
• Manage the HackerOne bug bounty program by improving triage workflows and strengthening researcher relationships.
• Lead threat modeling and security design reviews to create automated guardrails and lint checks for new features.
• Develop AI agents and automated workflows to triage vulnerabilities and draft remediation pull requests.
• Partner with engineering teams to harden authentication, authorization, and input validation across Kubernetes workloads.
• Execute offensive security testing and red team exercises to identify and mitigate risks in high-risk flows.
• Establish "secure by default" standards for AI-driven engineering tools and agent-driven workflows.

What we're looking for

• 5+ years of experience in application security or software engineering with a security focus.
• Proficiency in at least one of Python, Go, TypeScript, or Ruby, with the ability to read and write code across others.
• Hands-on expertise using GitHub Advanced Security, Semgrep, or equivalent tools for risk detection.
• Strong knowledge of common application and API vulnerability classes including GraphQL, REST, and gRPC.
• Practical threat modeling skills to identify critical risks in architecture diagrams and service designs.
• Experience with cloud and container security on AWS and Kubernetes, including IAM and secrets management.
• Ability to build AI agents and automated workflows for vulnerability triage and remediation.
• Experience with offensive security, bug bounty programs, or mobile application security is preferred.