Application Security Engineer

What you'll do

• Build and operate vulnerability identification tools and triage workflows for consumer products and GraphQL APIs.
• Manage the AppSec tooling stack including static/dynamic testing, supply chain risk detection, and secrets scanning.
• Manage the HackerOne bug bounty program by improving triage workflows and strengthening researcher relationships.
• Lead threat modeling and security design reviews to create automated guardrails and lint checks for new features.
• Develop AI agents and automated workflows to triage vulnerabilities and draft remediation pull requests.
• Harden authentication, authorization, and input validation across Kubernetes workloads and production services.
• Execute offensive security testing, red team exercises, and adversarial analysis of high-risk flows.
• Establish "secure by default" standards for AI-driven engineering tools and agent-driven workflows.

What we're looking for

• 5+ years of experience in application security or software engineering with a security focus.
• Proficiency in at least one of Python, Go, TypeScript, or Ruby, with the ability to read and write code across others.
• Hands-on expertise using security detection tools such as GitHub Advanced Security, Semgrep, or equivalent.
• Strong knowledge of application and API vulnerability classes including GraphQL, REST, and gRPC.
• Practical threat modeling skills for architecture diagrams and service designs.
• Experience with cloud and container security on AWS and Kubernetes, including IAM and secrets management.
• Ability to build AI agents and automated workflows for vulnerability triage and remediation.
• Experience in offensive security, bug bounty programs, or securing AI/ML pipelines is preferred.