Application Security Engineer

What you'll do

• Build and operate the application vulnerability identification capability across consumer products, admin tools, and GraphQL APIs.
• Manage the AppSec tooling stack, including static/dynamic testing, supply chain risk detection, and secrets scanning.
• Own and mature the HackerOne bug bounty program by improving triage workflows and researcher relationships.
• Lead threat modeling and security design reviews for new services, APIs, and mobile features.
• Develop AI agents and automated workflows to triage vulnerability reports and draft remediation pull requests.
• Partner with engineering teams to harden authentication, authorization, and input validation across production services.
• Execute internal security testing, red team exercises, and adversarial analysis of high-risk flows.
• Establish secure design standards and "secure by default" practices for AI-driven engineering workflows.

What we're looking for

• Experience in application security or software engineering with a security focus.
• Proficiency in at least one of Python, Go, TypeScript, or Ruby, with the ability to read and write the others.
• Hands-on expertise in security risk detection tools like GitHub Advanced Security or Semgrep.
• Strong grasp of application and API vulnerability classes including GraphQL, REST, and gRPC.
• Practical threat modeling skills for architecture diagrams and service designs.
• Experience with cloud and container security on AWS and Kubernetes, including IAM and secrets management.
• Offensive security experience including pentesting, API security, or red team operations (preferred).
• Experience running a bug bounty program, mobile security reviews, or securing AI/ML pipelines (preferred).