application security engineer

PackageX

<div>
 <strong>
  About PackageX
 </strong>
 :
 <br/>
 <br/>
 PackageX is the execution layer for physical AI in enterprise logistics. We enable enterprises to see, understand, and execute real-world logistics operations in real time using Vision-Language-Action intelligence.
 <br/>
 <br/>
 We sit between systems of record (ERP, WMS, TMS) and the physical world, turning cameras, people, and automation into deterministic, auditable workflows. Rather than replacing existing systems, PackageX makes them operationally intelligent.
 <br/>
 <br/>
 We start with inbound receiving, the highest-friction choke point in logistics, and expand across adjacent workflows, sites, and automation modes. This creates a workflow-led enterprise expansion motion that compounds inside complex operations.
 <br/>
 <br/>
 We're a fast-growing pre-Series A stage startup in New York City with a distributed global team backed by Bullpen Capital, Pritzker Group, Sierra Ventures, Ludlow Ventures, MXV Capital, and NSV Wolf Capital.
 <br/>
 <br/>
 <strong>
  What We Are Looking For
  <br/>
  <br/>
 </strong>
 We&rsquo;re looking for a security engineer who is serious about their craft and genuinely curious about where the field is heading. This role sits at the intersection of traditional application security and the new challenges that come with building AI-powered products. You&rsquo;ll own security end-to-end, from hardening our cloud infrastructure and reviewing code, to thinking through what it means to secure systems that use large language models. You don&rsquo;t need to have done this exact job before, but you should be the kind of engineer who stays curious, learns fast, and cares deeply about getting things right.
 <br/>
 <br/>
 <strong>
  You will:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Own security across the SDLC from threat modeling during design, to security reviews during development, to vulnerability scanning in CI/CD. You&rsquo;ll use modern tooling (including AI-powered scanners where they genuinely help) to keep pace with a fast-moving engineering team
  </li>
  <li>
   Conduct vulnerability assessments and penetration tests across our web applications, APIs, and infrastructure. You&rsquo;ll identify issues before attackers do, document findings clearly, and work directly with developers to get them fixed
  </li>
  <li>
   Write and maintain security policies that engineers will actually follow, clear, practical, and grounded in how the team actually works, not copied from a compliance template
  </li>
  <li>
   Think carefully about the security risks that come with AI-powered products, such as prompt injection, sensitive data leaking through model outputs, and how to keep our LLM integrations safe for customers. This is a newer area, and you&rsquo;ll be helping us figure it out as we go
  </li>
  <li>
   Report on security posture to engineering leadership, tracking gaps, trends, and open issues in a way that helps the team prioritize and act, not just tick compliance boxes
  </li>
  <li>
   Review code for security issues and work closely with developers to fix them, building habits and processes so security feedback becomes a normal part of how the team ships, not a last-minute blocker
  </li>
  <li>
   Define and maintain security standards for how we build and deploy software, writing clear guidelines, putting automated checks in place, and making it easy for engineers to do the right thing by default
  </li>
  <li>
   Build automation that makes security work scale &mdash; whether that&rsquo;s smarter alerting, faster triage, or tooling that helps developers catch and fix issues without needing a security engineer in every conversation
  </li>
  <li>
   Participate in product and engineering design discussions &mdash; raising security concerns early, helping the team understand the risks, and finding solutions that don&rsquo;t slow down shipping
  </li>
  <li>
   Embed security into our CI/CD pipelines and development workflows &mdash; reducing the time between finding a vulnerability and getting it fixed, and making security a shared responsibility across the engineering team
  </li>
  <li>
   Keep up with how the security landscape is evolving &mdash; particularly as AI becomes a bigger part of how software is built and attacked. You&rsquo;ll bring that knowledge back to the team and help us stay ahead of new threats
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Skills and Qualification:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   A degree in Computer Science, Information Security, or a related field
  </li>
  <li>
   3+ years of hands-on experience in application security or security engineering.
  </li>
  <li>
   Proven ability to build, manage, and monitor security in production environments where reliability matters &mdash; you&rsquo;ve operated under pressure, handled incidents, and know what it takes to keep systems safe at scale
  </li>
  <li>
   Solid experience securing web applications, APIs, and cloud infrastructure &mdash; covering areas like intrusion detection, access control design, incident response, and security policy development. You know the fundamentals well and can apply them in a real product context
  </li>
  <li>
   Experience with static and dynamic code analysis, you&rsquo;ve worked with SAST and DAST tools, know their limitations, and can help developers actually act on what those tools surface rather than just generating noise
  </li>
  <li>
   Familiarity with modern cloud architectures, serverless, microservices, and API-first designs. Bonus if you&rsquo;ve thought about what it means to secure systems that call LLM APIs or handle AI-generated outputs as part of their core workflow
  </li>
  <li>
   Strong understanding of OWASP Top 10 vulnerabilities and how to defend against them. Familiarity with the OWASP Top 10 for LLMs is a plus; we&rsquo;re building AI-powered products and need someone who can think through what that means for security
  </li>
  <li>
   Good understanding of RESTful API security, authentication, authorization, rate limiting, and input validation. Our platform is API-heavy, and we need someone who can spot the common mistakes and knows how to prevent them
  </li>
  <li>
   Strong experience in penetration testing and vulnerability analysis. You can run an assessment end-to-end, write up findings that people actually read, and follow through until issues are resolved &mdash; not just hand over a report and move on
  </li>
  <li>
   Experience working with AWS and/or GCP, securing cloud infrastructure, managing IAM policies, and understanding how cloud-native services introduce their own security considerations. We run primarily on AWS
   <br/>
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  What can you expect from the application process?
  <br/>
  <br/>
 </strong>
 All applications will be looked at by the People team, who will reach out to shortlisted candidates. Across various interview rounds, you'll speak with the hiring manager and other functional heads. We want to have an open discussion about your work and how we can be a great fit. The process may also involve an assessment or presentation relevant to the role. You can expect an offer after three rounds of interviews. All offers are subject to satisfactory reference and background checks.
 <br/>
 <br/>
 We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
</div>


Application Security Engineer

Instabug

<div><p><b>Job Purpose<br>
</b><br>
<br>
</p><p>As an Application Security Engineer at Luciq, you will help shape and build our application security program alongside the wider team. This is a hands-on, high-ownership role where you will work closely with product and development teams across the full software development lifecycle &mdash; reviewing designs before code is written, identifying risks as features take shape, and ensuring security is embedded into how we build and ship software, not bolted on after the fact. Our stack runs on Ruby on Rails, Go, and Python, deployed on AWS with Terraform managing infrastructure as code and Jenkins powering CI/CD. You will read and review code in these languages &mdash; not just rely on scanner output &mdash; and work with AWS security services (SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront) to provide visibility and protection across our infrastructure. The role spans web applications, APIs, our mobile SDK (iOS and Android), cloud, and CI/CD &mdash; partnering with engineers, PMs, Platform, and the Security team to make the secure path the default path. This role can be filled at mid-level with a clear growth path to senior-level as you grow into shaping our application security program, or at senior-level if you're already operating at that scope.
</p><p>You will join a lean Security team, which entails stepping beyond core AppSec for incident triage, addressing customer security questionnaires, or supporting cross-functional cloud and compliance reviews. We value this variety as a core facet of the role; if you are seeking hyper-specialized work restricted strictly to application security, this may not be the right fit.<br>
</p><p></p><br>
<br>
<p>Job Responsibilities
</p><ul><li><b>Secure Design &amp; Code Review
</b></li></ul><ul><li><div><ul><li>Run and lead threat modeling sessions with product and engineering teams during feature design. This is a hands-on role with expectations to deliver fixes in the product as needed while enabling other engineers.
</li><li>Conduct security code reviews and architecture reviews across web applications, APIs, and services in Ruby, Go, and Python
</li><li>Leverage AI and make sure that we enable engineers to adhere to security acceptance criteria. Provide guidance to engineers on secure design as we iterate and build the product.
</li></ul></div></li></ul><ul><li><b>Vulnerability Management
</b></li></ul><ul><li><div><ul><li>Validate, triage, and drive remediation of vulnerabilities &mdash; partner with engineering teams across the full lifecycle from discovery through SLA support
</li><li>Coordinate with engineering teams on fix verification and root-cause prevention
</li></ul></div></li></ul><ul><li><b>Security Automation in CI/CD
</b></li></ul><ul><li><div><ul><li>Build and maintain automated security testing in CI/CD &mdash; SAST, SCA, secret scanning
</li><li>Tune tooling for signal over noise; integrate findings into developer workflows
</li><li>Operate secret-scanning and leaked-credential response workflows
</li></ul></div></li></ul><ul><li><b>Cloud &amp; Infrastructure Security
</b></li></ul><ul><li><div><ul><li>Support cloud security reviews &mdash; IAM policies, network segmentation, container/Kubernetes configurations, and Terraform policy-as-code
</li><li>Work with AWS security services (SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront) to maintain visibility and detection across our infrastructure
</li></ul></div></li></ul><ul><li><b>Supply Chain &amp; Build Security
</b></li></ul><ul><li><div><ul><li>Own dependency risk via SCA, lockfiles, and pinning
</li><li>Drive CI/CD pipeline hardening &mdash; build runners, OIDC-to-cloud, artifact signing, SBOM standards
</li></ul></div></li></ul><ul><li><b>Cross-functional Security Enablement
</b></li></ul><ul><li><div><ul><li>Develop secure coding guidelines and reusable patterns that make the secure path the default
</li><li>Drive S-SDLC adoption across engineering teams
</li><li>Review security posture of our mobile SDK across iOS and Android &mdash; data handling, transport security, local storage, IPC, encryption, third-party dependency risk, and SDK consumer-facing security defaults
</li><li>Assess security risks in AI/LLM integrations &mdash; prompt injection, insecure output handling, trust boundaries in agentic architectures
</li><li>Support compliance initiatives (SOC 2, ISO 27001) &mdash; translate control requirements into engineering practices and assist with audit evidence collection
</li>Use AI tooling actively in your own workflow AI-assisted code review, threat modeling drafts, vulnerability research, and security artifact generation and help shape how the rest of engineering uses AI safely<br>
<li>
</li></ul></div></li></ul><p></p><br>
<br>
<p><b>Job Requirements<br>
</b></p><p></p><br>
<p><b>Must-Haves
</b></p><ul><li><b>Experience </b>: 3-6 years in application security, or security engineering
</li><li><b>Education </b>: Bachelor's degree in Computer Science, Information Security, or equivalent practical experience
</li><li><b>Secure code review </b>in at least one of: Python, Ruby, Go &mdash; can read code and reason about vulnerabilities, not rely on scanner output
</li><li><b>OWASP Top 10 (Web and API) </b>as root-cause patterns, not a memorized checklist &mdash; including SSRF, insecure deserialization, injection classes, and access-control flaws
</li><li><b>Threat modeling </b>: practical experience with STRIDE and data flow diagrams; can lead a session with a product team and produce actionable output
</li><li><b>Auth and identity </b>: working depth in session management, RBAC/ABAC models
</li><li><b>CI/CD security automation </b>: hands-on experience integrating SAST, SCA, and secret scanning into pipelines and tuning for actionable signal
</li><li><b>Proactive and ownership-driven </b>&mdash; does not wait to be told what to secure
</li><li>Comfortable working <b>cross-functionally </b>with product engineers, platform engineers, and the wider team
</li><li>Strong <b>analytical and problem-solving </b>abilities
</li><li>Fluent in <b>English </b>, with strong written and verbal communication
<br>
</li><li><b>Communication </b>: clear written and verbal communication can explain a vulnerability to an engineer, a PM, or a VP<br>
<br>
<br>
</li></ul><p><b>Strong Plus
</b></p><p>We expect strong candidates to have <i>some </i>of these not all. The more, the better.
</p><ul><li><b>Mobile SDK security </b>: OWASP Mobile Top 10 and MASVS/MASTG; Android (Kotlin) or iOS (Swift); experience with Frida, objection, or MobSF
</li><li><b>AWS security service depth </b>: SecurityHub, Inspector, GuardDuty, CloudTrail, CloudFront beyond IAM
</li><li><b>Container and Kubernetes </b>security fundamentals
</li><li><b>Supply chain depth </b>: SLSA framework, SBOM <b>AI/LLM security </b>: prompt injection mitigations, OWASP LLM Top 10, securing agentic architectures and tool-use boundaries
</li><li>Familiarity with <b>ISO 27001 or SOC 2 </b>.<br>
<br>
<br>
</li></ul><p><b>Nice to Have
</b></p><ul><li>Terraform and policy-as-code: tfsec, Checkov, OPA/Conftest
</li><li>Experience building or bootstrapping a security program
</li><li>Bug bounty participation, published CVEs, or documented security research
</li><li>Hands-on certifications: OSCP, OSWE, eMAPT
</li><li>Incident response experience &mdash; triage, containment, root-cause analysis
</li><li>Red teaming or purple teaming experience</li></ul></div>

<div><div><div><div><b>About PackageX</b>:</div>
<div>
PackageX is the execution layer for physical AI in enterprise logistics. We enable enterprises to see, understand, and execute real-world logistics operations in real time using Vision&ndash;Language&ndash;Action intelligence.</div><br>
<div></div>
<div>
We sit between systems of record (ERP, WMS, TMS) and the physical world, turning cameras, people, and automation into deterministic, auditable workflows. Rather than replacing existing systems, PackageX makes them operationally intelligent.</div><br>
<div></div>
<div>
We start with inbound receiving, the highest-friction choke point in logistics, and expand across adjacent workflows, sites, and automation modes. This creates a workflow-led enterprise expansion motion that compounds inside complex operations.</div><br>
<div></div>
<div>
We're a fast-growing pre-Series A stage startup in New York City with a distributed global team backed by Bullpen Capital, Pritzker Group, Sierra Ventures, Ludlow Ventures, MXV Capital, and NSV Wolf Capital.</div><br>
<div></div>
<div><b>
What we are looking for</b></div>
<div>
We&rsquo;re looking for a security engineer who is serious about their craft and genuinely curious about where the field is heading. This role sits at the intersection of traditional application security and the new challenges that come with building AI-powered products. You&rsquo;ll own security end-to-end, from hardening our cloud infrastructure and reviewing code, to thinking through what it means to secure systems that use large language models. You don&rsquo;t need to have done this exact job before, but you should be the kind of engineer who stays curious, learns fast, and cares deeply about getting things right.</div><br>
<div></div>
<div><b>
You will:
</b></div><ul><li>Own security across the SDLC from threat modeling during design, to security reviews during development, to vulnerability scanning in CI/CD. You&rsquo;ll use modern tooling (including AI-powered scanners where they genuinely help) to keep pace with a fast-moving engineering team.</li>
<li>Conduct vulnerability assessments and penetration tests across our web applications, APIs, and infrastructure. You&rsquo;ll identify issues before attackers do, document findings clearly, and work directly with developers to get them fixed.</li>
<li>Write and maintain security policies that engineers will actually follow, clear, practical, and grounded in how the team actually works, not copied from a compliance template.</li>
<li>Think carefully about the security risks that come with AI-powered products, such as prompt injection, sensitive data leaking through model outputs, and how to keep our LLM integrations safe for customers. This is a newer area, and you&rsquo;ll be helping us figure it out as we go.</li>
<li>Report on security posture to engineering leadership, tracking gaps, trends, and open issues in a way that helps the team prioritize and act, not just tick compliance boxes.</li>
<li>Review code for security issues and work closely with developers to fix them, building habits and processes so security feedback becomes a normal part of how the team ships, not a last-minute blocker.</li>
<li>Define and maintain security standards for how we build and deploy software, writing clear guidelines, putting automated checks in place, and making it easy for engineers to do the right thing by default.</li>
<li>Build automation that makes security work scale &mdash; whether that&rsquo;s smarter alerting, faster triage, or tooling that helps developers catch and fix issues without needing a security engineer in every conversation.</li>
<li>Participate in product and engineering design discussions &mdash; raising security concerns early, helping the team understand the risks, and finding solutions that don&rsquo;t slow down shipping.</li>
<li>Embed security into our CI/CD pipelines and development workflows &mdash; reducing the time between finding a vulnerability and getting it fixed, and making security a shared responsibility across the engineering team.</li>
<li>Keep up with how the security landscape is evolving &mdash; particularly as AI becomes a bigger part of how software is built and attacked. You&rsquo;ll bring that knowledge back to the team and help us stay ahead of new threats.</li></ul><br>
<div></div>
<div><b>
Skills and Qualification:</b></div>
<ul>
<li>A degree in Computer Science, Information Security, or a related field</li>
<li>3+ years of hands-on experience in application security or security engineering.
</li><li>Proven ability to build, manage, and monitor security in production environments where reliability matters &mdash; you&rsquo;ve operated under pressure, handled incidents, and know what it takes to keep systems safe at scale.</li>
<li>Solid experience securing web applications, APIs, and cloud infrastructure &mdash; covering areas like intrusion detection, access control design, incident response, and security policy development. You know the fundamentals well and can apply them in a real product context.</li>
<li>Experience with static and dynamic code analysis, you&rsquo;ve worked with SAST and DAST tools, know their limitations, and can help developers actually act on what those tools surface rather than just generating noise.</li>
<li>Familiarity with modern cloud architectures, serverless, microservices, and API-first designs. Bonus if you&rsquo;ve thought about what it means to secure systems that call LLM APIs or handle AI-generated outputs as part of their core workflow.</li>
<li>Strong understanding of OWASP Top 10 vulnerabilities and how to defend against them. Familiarity with the OWASP Top 10 for LLMs is a plus; we&rsquo;re building AI-powered products and need someone who can think through what that means for security.</li>
<li>Good understanding of RESTful API security, authentication, authorization, rate limiting, and input validation. Our platform is API-heavy, and we need someone who can spot the common mistakes and knows how to prevent them.</li>
<li>Strong experience in penetration testing and vulnerability analysis. You can run an assessment end-to-end, write up findings that people actually read, and follow through until issues are resolved &mdash; not just hand over a report and move on.</li>
<li>Experience working with AWS and/or GCP, securing cloud infrastructure, managing IAM policies, and understanding how cloud-native services introduce their own security considerations. We run primarily on AWS.</li></ul><br>
<div></div>
<div><b>
What can you expect from the application process?</b></div>
<div>
All applications will be looked at by the People team, who will reach out to shortlisted candidates. Across various interview rounds, you'll speak with the hiring manager and other functional heads. We want to have an open discussion about your work and how we can be a great fit. The process may also involve an assessment or presentation relevant to the role. You can expect an offer after three rounds of interviews. All offers are subject to satisfactory reference and background checks.</div><br>
<p></p>
</div></div>
<div><div>We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.</div></div></div>

Openkyber

<div><p><b>Title :</b> Security Engineer Location : Remote Job Type : Contract (7 Months) Compensation : $75.19 - $97.74/hr Industry: Retail</p>
<p>- About the Role We are partnering with a leading Fortune 50 retail organization known for its large-scale digital presence and commitment to innovation to hire a Security Engineer specializing in penetration testing. This role focuses on identifying and mitigating security vulnerabilities across web applications, APIs, and enterprise systems. You will play a key role in safeguarding customer data and ensuring secure, resilient systems in a fast-paced, highly collaborative environment.</p>
<p><b>Job Description</b></p>
<p>The Security Engineer will be responsible for conducting comprehensive penetration testing engagements across complex enterprise environments. This includes evaluating web applications, APIs, and other systems for vulnerabilities, validating risks, and partnering closely with engineering teams to drive remediation efforts.</p>
<ul><li>Conduct end-to-end penetration tests, including scoping, exploitation, validation, and reporting</li>
<li>Identify and assess vulnerabilities in web applications and APIs, including OWASP Top 10 risks</li>
<li>Utilize advanced security testing tools such as Burp Suite, Nmap, and exploitation frameworks</li>
<li>Develop scripts and automation in Python or Go to enhance testing efficiency</li>
<li>Document security findings clearly, providing actionable remediation recommendations</li>
<li>Partner with engineering teams to validate fixes and strengthen overall security posture</li>
<li>Support risk identification efforts, including pre-deployment threat modeling activities</li>
<li>Contribute to security initiatives such as bug bounty programs and vulnerability triage</li>
<li>Assist in improving penetration testing processes, tools, and methodologies</li>
<li>Provide mentorship or technical guidance to junior team members when applicable</li>
</ul><p><b>Qualifications</b></p>
<p><b>Required Qualifications</b></p>
<ul><li>Bachelor's degree in Computer Science, Cybersecurity, or equivalent practical experience</li>
<li>7+ years of experience in cybersecurity, with progressive responsibility in penetration testing</li>
<li>5+ years of hands-on penetration testing experience focused on web applications and APIs in enterprise environments</li>
<li>Proven ability to execute full penetration testing lifecycle (scoping through reporting)</li>
<li>Strong knowledge of web application security vulnerabilities, including OWASP Top 10, authentication/authorization flaws, and injection attacks</li>
<li>Advanced proficiency with security testing tools such as Burp Suite, Nmap, and common exploitation frameworks</li>
<li>Experience developing scripts or automation using Python or Go</li>
<li>Strong documentation skills with the ability to communicate findings and remediation steps clearly</li>
<li>Experience collaborating with engineering teams to remediate vulnerabilities</li>
</ul><p><b>Preferred Qualifications</b></p>
<ul><li>Experience testing mobile applications, hardware/embedded systems, or third-party/vendor platforms</li>
<li>Familiarity with PCI penetration testing requirements and compliance frameworks</li>
<li>Experience supporting or contributing to bug bounty programs (triage, validation, escalation)</li>
<li>Exposure to threat modeling and proactive risk identification</li>
<li>Experience mentoring or guiding other security testers</li>
<li>Advanced understanding of networking and system architecture in large-scale environments</li>
<li>Experience improving or automating penetration testing processes and tooling</li>
<li>Relevant certifications such as OSCP, OSCE, OSWE, or CISSP</li>
</ul><p>Benefits Dahl Consulting is proud to offer a comprehensive benefits package to eligible employees that will allow you to choose the best coverage to meet your family's needs.</p>
<p>For details, please review the DAHL Benefits Summary: https://www.dahlconsulting.com/benefits-w2fta/ .</p>
<p>How to Apply Take the first step on your new career path! To submit yourself for consideration for this role, simply click the apply button and complete our mobile-friendly online application. Once we've reviewed your application details, a recruiter will reach out to you with next steps!</p>
<p>Equal Opportunity Statement As an equal opportunity employer, OpenKyber welcomes candidates of all backgrounds and experiences to apply. If this position sounds like the right opportunity for you, we encourage you to take the next step and connect with us. We look forward to meeting you!</p>
<p><b>For applications and inquiries, contact:</b> hirings@openkyber.com</p></div>

Security Trainee

Smart Working Solutions

<div><div><p><b>About Smart Working</b></p>
<p>
At Smart Working, we believe your job should not only look right on paper but also feel right every day. This isn&rsquo;t just another remote opportunity - it&rsquo;s about finding where you truly belong, no matter where you are. From day one, you&rsquo;re welcomed into a genuine community that values your growth and well-being.</p>
<p>
Our mission is simple: to break down geographic barriers and connect skilled professionals with outstanding global teams and products for full-time, long-term roles. We help you discover meaningful work with teams that invest in your success, where you&rsquo;re empowered to grow personally and professionally.<br>
Join one of the highest-rated workplaces on Glassdoor and experience what it means to thrive in a truly remote-first world.</p>
<p><b>
About the Role</b></p>
<p>
As a <b>Senior Security Engineer</b>, you will play a critical role in designing and implementing security controls across mobile applications, backend services, and web platforms. You will help ensure that systems are secure by design, protecting both customer data and platform integrity while meeting strict internal security standards and regulatory requirements.<br>
Working closely with engineering teams, you will contribute to embedding security practices across the development lifecycle, from secure coding and threat modelling to DevSecOps and infrastructure security. You will help identify vulnerabilities, assess risk, and implement proactive security measures that strengthen the organisation&rsquo;s overall security posture.</p>
<p>
This role is ideal for a security engineer who enjoys working at the intersection of application security, secure architecture, and engineering enablement, helping development teams build resilient and compliant systems.</p>
</div>
<h3 class="jobSectionHeader"><b>Responsibilities</b></h3><ul>
<li>Design and implement security controls for mobile applications, backend services, and web platforms</li>
<li>Conduct threat modelling and risk assessments for new and existing systems</li>
<li>Embed secure coding practices across engineering teams, aligned with OWASP standards</li>
<li>Partner with engineers to ensure security is integrated throughout the software development lifecycle (SDLC)</li>
<li>Identify and remediate application vulnerabilities and security risks</li>
<li>Contribute to the implementation and improvement of DevSecOps practices</li>
<li>Provide guidance on secure architecture and secure software design</li>
<li>Support the development and enforcement of security policies, controls, and engineering standards</li>
<li>Improve the organisation&rsquo;s application security posture through proactive security reviews and testing</li>
<li>Work with teams to ensure systems meet internal security standards and external regulatory requirements</li>
<li>Provide security expertise for infrastructure components including containers and cloud-native environments</li>
<li>Contribute to incident response and vulnerability management processes</li>
</ul><h3 class="jobSectionHeader"><b>Requirements</b></h3><ul>
<li>6+ years of experience in security engineering or application security</li>
<li>3+ years of experience in Application Security (AppSec)</li>
<li>3+ years of experience conducting threat modelling and risk assessments</li>
<li>3+ years of experience applying secure coding principles aligned with OWASP standards</li>
<li>Strong understanding of application security vulnerabilities and mitigation strategies</li>
<li>Proven experience collaborating with engineering teams to build secure-by-design applications</li>
<li>2&ndash;3 years of experience implementing DevSecOps practices</li>
<li>2&ndash;3 years of experience securing containerised environments such as Docker or Kubernetes</li>
<li>2+ years of experience applying cryptography and encryption techniques in application security</li>
</ul><h3 class="jobSectionHeader"><b>Nice to Have</b></h3><ul>
<li>Experience working within a bank, fintech company, or other regulated environment</li>
<li>Familiarity with financial services security standards and regulatory frameworks</li>
<li>Experience securing mobile applications and modern web platforms</li>
</ul>
<p>We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.</p></div>

Senior Security Engineer (Remote, Full-Time) [AS219] PK

Schweitzer Engineering Laboratories

<div><div><div>Job Description</div></div><div><div><div><div><p>
The devices we make at SEL are embedded in the power grid. They prevent blackouts. They make outages safer and shorter in duration; they add cybersecurity, automation, and communication. They use cutting-edge technologies and operate at speeds that push other pieces of the grid to go faster. As an Application Engineer - Protection, you&rsquo;ll provide solutions and services that help our customers protect and control critical electrical infrastructure and power systems worldwide.</p><p></p><p><b>
As Application Engineer &ndash; Protection, a typical day might include the following:</b></p><ul><li><p>
Develop expertise in power system protection, and all related SEL products.</p></li><li><p>
Help customers apply SEL products through visits, demonstrations, training courses, email, and telephone contact.</p></li><li><p>
Contribute to product specifications, application and testing software, and literature.</p></li><li><p>
Participate in SEL marketing and sales activities and industry technical meetings and conferences.</p></li><li><p>
Teach in customer on-site and online visits, SEL University courses, and hands-on seminars for customers and SEL personnel.</p></li><li><p>
Maintain customer application and quality information, and develop industry relationships.</p></li><li><p>
Other duties as assigned.</p></li></ul><p></p><p><b>
This job might be for you if:</b></p><ul><li><p>
Your educational background is in electrical engineering</p></li><li><p>
You have a strong understanding of power system protection principles, relay protection and control schemes, and relay coordination techniques.</p></li><li><p>
You are familiar with relevant industry standards, such as IEEE, IEC, and NERC/FERC regulations.</p></li><li><p>
You have proven experience in designing and implementing protection and control schemes in a utility or industrial setting.</p></li><li><p>
Demonstrated problem-solving skills and the ability to analyze complex power system protection challenges.</p></li><li><p>
You are willing to travel locally &amp; internationally.</p></li><li><p>
You have strong communication skills in English &amp; Arabic.</p></li></ul><p></p><p><b>
Location
</b></p><p>Saudi Arabia - Khobar</p><p></p><p><b>
Why SEL?
</b></p><p><b>Competitive pay. Superior benefits. Inspiring work.
</b></p><p>We provide and take care of our employees with outstanding benefits, competitive pay, challenging work, and a rewarding career.</p><p>
Top tier medical, prescription, dental, vision, life, and disability insurance.</p><p>
Varied leave plans like annual leaves, sick leaves, parental leaves etc. to maintain a healthy life balance</p><p>
Yearly flight tickets to home country for expat employees and their family members based on their eligibility</p><p>
Developmental programs like tuition assistance, internships, skill development courses and engineering development programs (EDP).</p><p>
Wellbeing benefits like free and confidential Employee Assistance Program (EAP) and reimbursable yearly gym membership</p><p>
International Travel Medical and Security Assistance to assist our traveling employees and accompanying family members worldwide</p><p>
Additional compensation for working on customer sites in the field based on eligibility</p><p></p><p><b>
Pay Range Data</b></p><p>
We base our starting pay offer on location and job-related factors such as candidate experience, training, knowledge, and skills</p><p></p><p><b>
Communication with Applicants</b></p><p>
We communicate with all applicants. If you do not receive a response about your application, please check your SPAM filter or reach out to us at careers@selinc.com.</p><p></p><p>
SEL is an Equal Opportunity Employer: Vets/Disabled.</p></div></div></div></div></div><p></p>

Application Engineer II - Protection

International Turnkey Systems - ITS

<div>
 <p>
  For a
  <strong>
   well-known Islamic Bank in Kuwait
  </strong>
  , we are hiring an AI Penetration Tester to join VMPT team and lead hands-on security testing for LLM/GenAI, ML, and AI-enabled applications (chatbots, RAG, AI agents, model APIs, and AI-assisted business workflows). The role blends traditional penetration testing + secure code review + vulnerability assessment with AI red teaming focused on modern AI risks such as prompt injection and insecure output handling as documented by OWASP&rsquo;s Top 10 for LLM Applications.
 </p>
 <p>
  Candidate is expected to have experience in assessing
  <strong>
   Python-based AI development and Azure AI / Azure OpenAI / Microsoft Foundry-hosted model endpoints
  </strong>
  .
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Key Responsibilities
  </strong>
 </p>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   AI / LLM penetration Testing &amp; Red Teaming
  </strong>
 </p>
 <ul>
  <li>
   Plan and execute AI penetration tests for LLM/GenAI and ML solutions across the bank (AI apps, AI gateways, model endpoints, orchestration layers, RAG pipelines, plugins/tools).
  </li>
  <li>
   Design test cases aligned to OWASP Top 10 for LLM Applications (e.g., prompt injection, insecure output handling, sensitive info disclosure, supply-chain risks).
  </li>
  <li>
   Perform adversarial testing using threat-informed techniques and references such as MITRE ATLAS (adversary tactics/techniques for AI systems).
  </li>
  <li>
   Validate security of agentic workflows (tool invocation, function calling, permissions, memory, connectors) and verify least privilege + authorization boundaries.
  </li>
 </ul>
 <p>
  <strong>
   Automation &amp; Tooling
  </strong>
 </p>
 <ul>
  <li>
   Build Python-based test harnesses for repeatable AI security testing (fuzzing prompts, jailbreak suites, regression tests, evaluation scoring).
  </li>
  <li>
   Use and extend PyRIT (Python Risk Identification Tool) or equivalent frameworks to probe for jailbreaks/harms and automate adversarial scanning.
  </li>
  <li>
   Where applicable, leverage Microsoft Foundry capabilities such as the AI Red Teaming Agent (preview) that integrates PyRIT red teaming features.
  </li>
 </ul>
 <p>
  <strong>
   Secure code review &amp; AppSec
  </strong>
 </p>
 <ul>
  <li>
   Conduct secure code review (particularly Python) for AI application layers: prompt templates, RAG retrieval logic, output post-processing, input validation, secrets handling, authZ checks, and logging.
  </li>
  <li>
   Identify and help fix design flaws enabling data leakage, prompt manipulation, unsafe tool usage, or insecure output flows.
  </li>
 </ul>
 <p>
  <strong>
   Traditional PT
  </strong>
 </p>
 <ul>
  <li>
   Perform web/API/cloud penetration testing for AI-enabled applications (auth, session, API abuse, SSRF, injection, misconfigurations, secrets).
  </li>
  <li>
   Run vulnerability assessments, triage findings, define severity, and validate remediation (re-test).
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  <strong>
   Education and Qualification
  </strong>
 </p>
 <ul>
  <li>
   Bachelor&rsquo;s degree in computer science, Cybersecurity, Software Engineering, or related discipline.
  </li>
  <li>
   3&ndash;7 years in penetration testing / application security / red teaming.
  </li>
  <li>
   Demonstrated experience testing LLM/GenAI systems (prompt injection, jailbreaks, data exfiltration patterns, agent/tool abuse).
  </li>
  <li>
   Strong hands-on Python for security automation and test harness development.
  </li>
  <li>
   Practical experience with Azure security concepts (identity, networking, secrets, logging) and exposure to Azure AI / Azure OpenAI / Foundry style deployments.
  </li>
  <li>
   Strong report writing, clear communication, ability to work with developers on remediation.
  </li>
 </ul>
 <p>
  <strong>
   A Must Certificates (at least one)
  </strong>
 </p>
 <ul>
  <li>
   OffSec OSCP / OSCP+
  </li>
  <li>
   GIAC GPEN
  </li>
  <li>
   Microsoft Certified: Azure Security Engineer Associate (AZ-500)
  </li>
  <li>
   ISC2 CCSP
  </li>
 </ul>
 <p>
  <strong>
   Strongly Preferred
  </strong>
 </p>
 <ul>
  <li>
   OffSec OSWE (advanced web exploitation / white-box testing)
  </li>
  <li>
   Burp Suite Certified Practitioner (BSCP)
  </li>
  <li>
   Microsoft Certified: Azure AI Engineer Associate (AI-102) (helps align with Azure AI implementation patterns).
  </li>
 </ul>
 <p>
  <strong>
   Tools &amp; Technologies Skills
  </strong>
 </p>
 <ul>
  <li>
   Python, Git, CI/CD integration
  </li>
  <li>
   Burp Suite, common PT toolchains (Kali, scanners, API tooling)
  </li>
  <li>
   Azure security controls (identity, key management, logging/monitoring)
  </li>
  <li>
   AI red teaming tooling (e.g., PyRIT / Foundry scans)
  </li>
 </ul>
 <p>
 </p>
</div>


AI Penetration Testing Specialist

Search 10000+ Application security engineer jobs near you this May. New roles added regularly across leading industries. Apply today.

10000 application security engineer jobs Near Me

Application Security Engineer

Application Security Engineer

Application Security Engineer

Security Trainee

Senior Security Engineer (Remote, Full-Time) [AS219] PK

Application Engineer II - Protection

AI Penetration Testing Specialist