Job Description Job Description We are looking for experienced and passionate people who have a background in vulnerability research, offensive security and reverse engineering on Apple platforms. The role: You'll join our team looking to identify vulnerabilities in Apple platforms using both static and dynamic analysis techniques. You'll develop Proof-of-Concepts for vulnerabilities identified. You'll use common VR toolsets such as fuzzers, LLMs and reverse engineering tools; as well as have access to custom tooling built in-house (along with developing your own!). You'll need to present your findings in a useful and accessible way to others. You'll have access to internal and external training and conferences to refine and hone your skillsets. The ideal candidate: Developed tools and proof of concepts in a modern programming language such as Python and Rust. Skills in debugging and hacking around with low level or other relevant languages such as C, Swift, C++, Objective C, etc. Ability to reverse engineer ARM64 binaries using common toolsets such as IDA, Binary Ninja and Frida. Interest and a passion in learning new things, taking them apart, and getting stuck into new problems and challenges. Desirable technical experience: Research on the low-level internals of Apple platforms, including topics such as runtime internals, platform security features and exploit mitigations. Reverse engineering and vulnerability research on userland components on Apple platforms including XPC protocols, private frameworks and userland system daemons. iOS application reverse engineering and bug hunting, looking for weaknesses, logic bugs and memory corruption issues. Kernel or system level software internals and vulnerability research, for example XNU code review or IOKit reverse engineering and exploitation. Salary: Packages are competitive and differ according to researcher experience. Full details can be discussed upon an invitation to interview. Perks and benefits: 25 days paid vacation + federal holidays Annual bonus based on company targets Matched 401k scheme up to 4% Healthcare, dental and vision cover Training and conference budgets Employee assistance program Company socials throughout the year The location: This is a remote role so the successful candidate can be based anywhere in the USA, or indeed the world! Interrupt Labs is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. We aim to respond to all candidates via email within a week of their application. Please note that emails may go to your spam or junk folder.
10/23/2026
Full time
Job Description Job Description We are looking for experienced and passionate people who have a background in vulnerability research, offensive security and reverse engineering on Apple platforms. The role: You'll join our team looking to identify vulnerabilities in Apple platforms using both static and dynamic analysis techniques. You'll develop Proof-of-Concepts for vulnerabilities identified. You'll use common VR toolsets such as fuzzers, LLMs and reverse engineering tools; as well as have access to custom tooling built in-house (along with developing your own!). You'll need to present your findings in a useful and accessible way to others. You'll have access to internal and external training and conferences to refine and hone your skillsets. The ideal candidate: Developed tools and proof of concepts in a modern programming language such as Python and Rust. Skills in debugging and hacking around with low level or other relevant languages such as C, Swift, C++, Objective C, etc. Ability to reverse engineer ARM64 binaries using common toolsets such as IDA, Binary Ninja and Frida. Interest and a passion in learning new things, taking them apart, and getting stuck into new problems and challenges. Desirable technical experience: Research on the low-level internals of Apple platforms, including topics such as runtime internals, platform security features and exploit mitigations. Reverse engineering and vulnerability research on userland components on Apple platforms including XPC protocols, private frameworks and userland system daemons. iOS application reverse engineering and bug hunting, looking for weaknesses, logic bugs and memory corruption issues. Kernel or system level software internals and vulnerability research, for example XNU code review or IOKit reverse engineering and exploitation. Salary: Packages are competitive and differ according to researcher experience. Full details can be discussed upon an invitation to interview. Perks and benefits: 25 days paid vacation + federal holidays Annual bonus based on company targets Matched 401k scheme up to 4% Healthcare, dental and vision cover Training and conference budgets Employee assistance program Company socials throughout the year The location: This is a remote role so the successful candidate can be based anywhere in the USA, or indeed the world! Interrupt Labs is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. We aim to respond to all candidates via email within a week of their application. Please note that emails may go to your spam or junk folder.
Intelliforce-IT Solutions Group
Annapolis Junction, Maryland
Job Description Job Description Senior CNO Vulnerability Researcher Make an Impact Where It Matters Most At Intelliforce, we work on the kinds of security problems where deep technical skill directly supports mission success. In this role, you will join the team as a senior CNO Vulnerability Researcher, focused on finding software vulnerabilities, reverse engineering complex systems, and helping drive security research that matters in real operational environments. This is a strong fit for an engineer who likes hard targets, low-level problem solving, and technical work that pushes past the obvious. What Makes This Opportunity Stand Out This role gives you the chance to work at the sharp end of vulnerability research while also helping lead projects and mentor others. You will research vulnerabilities, reverse engineer software to bypass security mechanisms, support user land and kernel development efforts, and stay current on the tools and techniques shaping modern security research. The work is technical, mission-driven, and broad enough to keep the job interesting, especially for someone who enjoys both hands-on research and helping guide a team. At Intelliforce, your work is visible and your expertise matters. Because we support prime programs, our teams stay close to meaningful mission work with real momentum. Because we are a small business, leadership is accessible, communication is direct, and strong technical contributions get noticed. Add in long-term stability, strong benefits, and a people-first culture, and this becomes more than another vulnerability research role. It is a chance to do serious technical work with real mission impact. Here's What Your Day-to-Day Could Include Research and discover software vulnerabilities across mission-relevant targets Reverse engineer software to identify security mechanism bypasses and other weaknesses Lead projects when needed and help guide technical direction across the team Assist with the design, development, documentation, testing, and debugging of user land and kernel software and systems Stay current on tools, techniques, countermeasures, and trends in computer network vulnerabilities, static and dynamic program analysis, network security, and encryption Communicate status clearly to leadership and stakeholders Supervise and mentor subordinate project staff and collaborative technical teams Minimum Qualifications Clearance: Top Secret Clearance with Polygraph, must be active. We do not have the ability to sponsor clearances Citizenship: Must be a U.S. Citizen. We cannot sponsor visas Bachelor's degree and 12 or more years of experience Or High School diploma and 16 or more years of experience Or Associate's degree and 14 or more years of experience Or Master's degree and 10 or more years of experience Or PhD and 8 or more years of experience 7 years of position-specific relevant experience Experience in vulnerability research Current active TS/SCI with Polygraph required Required Skills Experience in vulnerability research Experience in reverse engineering and common security research tools such as IDA Pro, Ghidra, Radare, Binary Ninja, SysInternals, GDB, and WinDBG Proficiency in Python, C, C++, or Assembly for x86 or x64 CNO capability development experience Proficiency with low-level internals in one or more technology areas such as Windows, Linux, or Mobile Strong troubleshooting and debugging experience Ability to communicate clearly with leadership and technical teams Ability to mentor and supervise junior staff when needed Desired Skills Degree in Computer Science or a related technical field 9 years of position-specific relevant experience Experience leading technical security research efforts Strong background in low-level software analysis across multiple operating environments Why Intelliforce? Because you matter-your work, your growth, and your well-being. At Intelliforce, we don't just push the boundaries of technology-we partner with some of the most mission-driven teams in defense and beyond to solve challenges that truly matter. As a Systems Engineer here, you won't just contribute to projects-you'll help shape outcomes that make a real-world impact. We also know that great work starts with a great environment. That's why we invest in you: Ample PTO to rest and recharge-plus all federal holidays and your birthday off, just because. Multiple medical plan options, including ones with zero deductible or premium for employees. Generous 401(k) with immediate vesting-because your future matters now. Exciting bonus opportunities, from profit sharing to quarterly awards and President's Club recognition. A culture of collaboration, connection, and fun, with regular team activities that go beyond the work. Ready to grow with purpose? At Intelliforce, your career will flourish in a place where innovation thrives and people come first. Join us-and let's build something meaningful together. You can reach us at or schedule a call with our Director of Recruitment, just visit this link to view their calendar: -intelliforce-itsg/30min . Equal Opportunity Matters Intelliforce-IT Solutions Group, LLC is proud to be an Equal Opportunity/Affirmative Action Employer. U.S. Citizenship is required for most positions. Need accommodations during the application process? We're happy to help. Reach out to us at with your specific request. Powered by JazzHR 99PpWimUNB
10/23/2026
Full time
Job Description Job Description Senior CNO Vulnerability Researcher Make an Impact Where It Matters Most At Intelliforce, we work on the kinds of security problems where deep technical skill directly supports mission success. In this role, you will join the team as a senior CNO Vulnerability Researcher, focused on finding software vulnerabilities, reverse engineering complex systems, and helping drive security research that matters in real operational environments. This is a strong fit for an engineer who likes hard targets, low-level problem solving, and technical work that pushes past the obvious. What Makes This Opportunity Stand Out This role gives you the chance to work at the sharp end of vulnerability research while also helping lead projects and mentor others. You will research vulnerabilities, reverse engineer software to bypass security mechanisms, support user land and kernel development efforts, and stay current on the tools and techniques shaping modern security research. The work is technical, mission-driven, and broad enough to keep the job interesting, especially for someone who enjoys both hands-on research and helping guide a team. At Intelliforce, your work is visible and your expertise matters. Because we support prime programs, our teams stay close to meaningful mission work with real momentum. Because we are a small business, leadership is accessible, communication is direct, and strong technical contributions get noticed. Add in long-term stability, strong benefits, and a people-first culture, and this becomes more than another vulnerability research role. It is a chance to do serious technical work with real mission impact. Here's What Your Day-to-Day Could Include Research and discover software vulnerabilities across mission-relevant targets Reverse engineer software to identify security mechanism bypasses and other weaknesses Lead projects when needed and help guide technical direction across the team Assist with the design, development, documentation, testing, and debugging of user land and kernel software and systems Stay current on tools, techniques, countermeasures, and trends in computer network vulnerabilities, static and dynamic program analysis, network security, and encryption Communicate status clearly to leadership and stakeholders Supervise and mentor subordinate project staff and collaborative technical teams Minimum Qualifications Clearance: Top Secret Clearance with Polygraph, must be active. We do not have the ability to sponsor clearances Citizenship: Must be a U.S. Citizen. We cannot sponsor visas Bachelor's degree and 12 or more years of experience Or High School diploma and 16 or more years of experience Or Associate's degree and 14 or more years of experience Or Master's degree and 10 or more years of experience Or PhD and 8 or more years of experience 7 years of position-specific relevant experience Experience in vulnerability research Current active TS/SCI with Polygraph required Required Skills Experience in vulnerability research Experience in reverse engineering and common security research tools such as IDA Pro, Ghidra, Radare, Binary Ninja, SysInternals, GDB, and WinDBG Proficiency in Python, C, C++, or Assembly for x86 or x64 CNO capability development experience Proficiency with low-level internals in one or more technology areas such as Windows, Linux, or Mobile Strong troubleshooting and debugging experience Ability to communicate clearly with leadership and technical teams Ability to mentor and supervise junior staff when needed Desired Skills Degree in Computer Science or a related technical field 9 years of position-specific relevant experience Experience leading technical security research efforts Strong background in low-level software analysis across multiple operating environments Why Intelliforce? Because you matter-your work, your growth, and your well-being. At Intelliforce, we don't just push the boundaries of technology-we partner with some of the most mission-driven teams in defense and beyond to solve challenges that truly matter. As a Systems Engineer here, you won't just contribute to projects-you'll help shape outcomes that make a real-world impact. We also know that great work starts with a great environment. That's why we invest in you: Ample PTO to rest and recharge-plus all federal holidays and your birthday off, just because. Multiple medical plan options, including ones with zero deductible or premium for employees. Generous 401(k) with immediate vesting-because your future matters now. Exciting bonus opportunities, from profit sharing to quarterly awards and President's Club recognition. A culture of collaboration, connection, and fun, with regular team activities that go beyond the work. Ready to grow with purpose? At Intelliforce, your career will flourish in a place where innovation thrives and people come first. Join us-and let's build something meaningful together. You can reach us at or schedule a call with our Director of Recruitment, just visit this link to view their calendar: -intelliforce-itsg/30min . Equal Opportunity Matters Intelliforce-IT Solutions Group, LLC is proud to be an Equal Opportunity/Affirmative Action Employer. U.S. Citizenship is required for most positions. Need accommodations during the application process? We're happy to help. Reach out to us at with your specific request. Powered by JazzHR 99PpWimUNB
Job Description Job Description SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: We are seeking a skilled and innovative Application Security Engineer to join Money. In this role, you will protect the security and integrity of our payments and financial products throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and systems that move and hold customer funds. Experience securing fintech, payments, digital wallet, ledger, or similar high-value platforms, where fraud, abuse, and unauthorized transfers are a constant concern, is strongly preferred. RESPONSIBILITIES: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits Manage vulnerability tracking and remediation efforts, providing guidance to development teams Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure Support incident response activities related to application security Stay current on emerging threats against financial and cloud-native systems, and continuously strengthen our controls Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Design and implement agentic and LLM-based solutions that help detect, investigate, or prevent security problems BASIC QUALIFICATIONS: Bachelor's degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Experience in payments, money transmission, digital wallets, or related financial platforms Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues Experience designing and implementing agentic and LLM-based solutions for security problems Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences PREFERRED SKILLS AND EXPERIENCE: Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus Relevant security certifications (e.g., BSCP, OSCP, OSWE) Experience managing bug bounty programs Background in data privacy and compliance relevant to financial products and cloud-native applications Experience with GitOps and infrastructure-as-code security Experience building custom security tooling to enhance and automate security processes Contributions to open-source security projects or tools COMPENSATION AND BENEFITS: $100,000 - $258,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. ITAR REQUIREMENTS: To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. 1157, or (iv) Asylee under 8 U.S.C. 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here. SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.
10/20/2026
Full time
Job Description Job Description SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: We are seeking a skilled and innovative Application Security Engineer to join Money. In this role, you will protect the security and integrity of our payments and financial products throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and systems that move and hold customer funds. Experience securing fintech, payments, digital wallet, ledger, or similar high-value platforms, where fraud, abuse, and unauthorized transfers are a constant concern, is strongly preferred. RESPONSIBILITIES: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits Manage vulnerability tracking and remediation efforts, providing guidance to development teams Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure Support incident response activities related to application security Stay current on emerging threats against financial and cloud-native systems, and continuously strengthen our controls Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Design and implement agentic and LLM-based solutions that help detect, investigate, or prevent security problems BASIC QUALIFICATIONS: Bachelor's degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Experience in payments, money transmission, digital wallets, or related financial platforms Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues Experience designing and implementing agentic and LLM-based solutions for security problems Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences PREFERRED SKILLS AND EXPERIENCE: Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus Relevant security certifications (e.g., BSCP, OSCP, OSWE) Experience managing bug bounty programs Background in data privacy and compliance relevant to financial products and cloud-native applications Experience with GitOps and infrastructure-as-code security Experience building custom security tooling to enhance and automate security processes Contributions to open-source security projects or tools COMPENSATION AND BENEFITS: $100,000 - $258,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. ITAR REQUIREMENTS: To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. 1157, or (iv) Asylee under 8 U.S.C. 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here. SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.
Job Description Job Description SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: We are seeking a skilled and innovative Application Security Engineer to join Money. In this role, you will protect the security and integrity of our payments and financial products throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and systems that move and hold customer funds. Experience securing fintech, payments, digital wallet, ledger, or similar high-value platforms, where fraud, abuse, and unauthorized transfers are a constant concern, is strongly preferred. RESPONSIBILITIES: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits Manage vulnerability tracking and remediation efforts, providing guidance to development teams Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure Support incident response activities related to application security Stay current on emerging threats against financial and cloud-native systems, and continuously strengthen our controls Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Design and implement agentic and LLM-based solutions that help detect, investigate, or prevent security problems BASIC QUALIFICATIONS: Bachelor's degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Experience in payments, money transmission, digital wallets, or related financial platforms Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues Experience designing and implementing agentic and LLM-based solutions for security problems Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences PREFERRED SKILLS AND EXPERIENCE: Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus Relevant security certifications (e.g., BSCP, OSCP, OSWE) Experience managing bug bounty programs Background in data privacy and compliance relevant to financial products and cloud-native applications Experience with GitOps and infrastructure-as-code security Experience building custom security tooling to enhance and automate security processes Contributions to open-source security projects or tools COMPENSATION AND BENEFITS: $100,000 - $258,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. ITAR REQUIREMENTS: To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. 1157, or (iv) Asylee under 8 U.S.C. 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here. SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.
10/20/2026
Full time
Job Description Job Description SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: We are seeking a skilled and innovative Application Security Engineer to join Money. In this role, you will protect the security and integrity of our payments and financial products throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and systems that move and hold customer funds. Experience securing fintech, payments, digital wallet, ledger, or similar high-value platforms, where fraud, abuse, and unauthorized transfers are a constant concern, is strongly preferred. RESPONSIBILITIES: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits Manage vulnerability tracking and remediation efforts, providing guidance to development teams Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure Support incident response activities related to application security Stay current on emerging threats against financial and cloud-native systems, and continuously strengthen our controls Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Design and implement agentic and LLM-based solutions that help detect, investigate, or prevent security problems BASIC QUALIFICATIONS: Bachelor's degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Experience in payments, money transmission, digital wallets, or related financial platforms Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues Experience designing and implementing agentic and LLM-based solutions for security problems Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences PREFERRED SKILLS AND EXPERIENCE: Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus Relevant security certifications (e.g., BSCP, OSCP, OSWE) Experience managing bug bounty programs Background in data privacy and compliance relevant to financial products and cloud-native applications Experience with GitOps and infrastructure-as-code security Experience building custom security tooling to enhance and automate security processes Contributions to open-source security projects or tools COMPENSATION AND BENEFITS: $100,000 - $258,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. ITAR REQUIREMENTS: To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. 1157, or (iv) Asylee under 8 U.S.C. 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here. SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.
Job Description Job Description SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: We are seeking a skilled and innovative Application Security Engineer to join Money. In this role, you will protect the security and integrity of our payments and financial products throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and systems that move and hold customer funds. Experience securing fintech, payments, digital wallet, ledger, or similar high-value platforms, where fraud, abuse, and unauthorized transfers are a constant concern, is strongly preferred. RESPONSIBILITIES: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits Manage vulnerability tracking and remediation efforts, providing guidance to development teams Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure Support incident response activities related to application security Stay current on emerging threats against financial and cloud-native systems, and continuously strengthen our controls Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Design and implement agentic and LLM-based solutions that help detect, investigate, or prevent security problems BASIC QUALIFICATIONS: Bachelor's degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Experience in payments, money transmission, digital wallets, or related financial platforms Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues Experience designing and implementing agentic and LLM-based solutions for security problems Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences PREFERRED SKILLS AND EXPERIENCE: Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus Relevant security certifications (e.g., BSCP, OSCP, OSWE) Experience managing bug bounty programs Background in data privacy and compliance relevant to financial products and cloud-native applications Experience with GitOps and infrastructure-as-code security Experience building custom security tooling to enhance and automate security processes Contributions to open-source security projects or tools COMPENSATION AND BENEFITS: $100,000 - $258,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. ITAR REQUIREMENTS: To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. 1157, or (iv) Asylee under 8 U.S.C. 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here. SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.
10/20/2026
Full time
Job Description Job Description SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: We are seeking a skilled and innovative Application Security Engineer to join Money. In this role, you will protect the security and integrity of our payments and financial products throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and systems that move and hold customer funds. Experience securing fintech, payments, digital wallet, ledger, or similar high-value platforms, where fraud, abuse, and unauthorized transfers are a constant concern, is strongly preferred. RESPONSIBILITIES: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits Manage vulnerability tracking and remediation efforts, providing guidance to development teams Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure Support incident response activities related to application security Stay current on emerging threats against financial and cloud-native systems, and continuously strengthen our controls Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Design and implement agentic and LLM-based solutions that help detect, investigate, or prevent security problems BASIC QUALIFICATIONS: Bachelor's degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Experience in payments, money transmission, digital wallets, or related financial platforms Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues Experience designing and implementing agentic and LLM-based solutions for security problems Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences PREFERRED SKILLS AND EXPERIENCE: Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus Relevant security certifications (e.g., BSCP, OSCP, OSWE) Experience managing bug bounty programs Background in data privacy and compliance relevant to financial products and cloud-native applications Experience with GitOps and infrastructure-as-code security Experience building custom security tooling to enhance and automate security processes Contributions to open-source security projects or tools COMPENSATION AND BENEFITS: $100,000 - $258,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. ITAR REQUIREMENTS: To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. 1157, or (iv) Asylee under 8 U.S.C. 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here. SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.
Job Description Job Description SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: We are seeking a skilled and innovative Application Security Engineer to join Money. In this role, you will protect the security and integrity of our payments and financial products throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and systems that move and hold customer funds. Experience securing fintech, payments, digital wallet, ledger, or similar high-value platforms, where fraud, abuse, and unauthorized transfers are a constant concern, is strongly preferred. RESPONSIBILITIES: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits Manage vulnerability tracking and remediation efforts, providing guidance to development teams Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure Support incident response activities related to application security Stay current on emerging threats against financial and cloud-native systems, and continuously strengthen our controls Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Design and implement agentic and LLM-based solutions that help detect, investigate, or prevent security problems BASIC QUALIFICATIONS: Bachelor's degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Experience in payments, money transmission, digital wallets, or related financial platforms Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues Experience designing and implementing agentic and LLM-based solutions for security problems Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences PREFERRED SKILLS AND EXPERIENCE: Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus Relevant security certifications (e.g., BSCP, OSCP, OSWE) Experience managing bug bounty programs Background in data privacy and compliance relevant to financial products and cloud-native applications Experience with GitOps and infrastructure-as-code security Experience building custom security tooling to enhance and automate security processes Contributions to open-source security projects or tools COMPENSATION AND BENEFITS: $100,000 - $258,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. ITAR REQUIREMENTS: To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. 1157, or (iv) Asylee under 8 U.S.C. 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here. SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.
10/19/2026
Full time
Job Description Job Description SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. ABOUT THE ROLE: We are seeking a skilled and innovative Application Security Engineer to join Money. In this role, you will protect the security and integrity of our payments and financial products throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and systems that move and hold customer funds. Experience securing fintech, payments, digital wallet, ledger, or similar high-value platforms, where fraud, abuse, and unauthorized transfers are a constant concern, is strongly preferred. RESPONSIBILITIES: Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications Design and implement secure coding guidelines and best practices for development teams Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline Perform threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits Manage vulnerability tracking and remediation efforts, providing guidance to development teams Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure Support incident response activities related to application security Stay current on emerging threats against financial and cloud-native systems, and continuously strengthen our controls Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs) Design and implement agentic and LLM-based solutions that help detect, investigate, or prevent security problems BASIC QUALIFICATIONS: Bachelor's degree in Computer Science, Cybersecurity, or a related field 3-5 years of experience in application security, with a strong focus on code security practices Experience in payments, money transmission, digital wallets, or related financial platforms Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10) Proficiency in Python or Rust and experience with secure coding practices in these languages Experience securing CI/CD pipelines and implementing DevSecOps practices Familiarity with software supply chain security and SBOM generation tools Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues Experience designing and implementing agentic and LLM-based solutions for security problems Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences PREFERRED SKILLS AND EXPERIENCE: Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus Relevant security certifications (e.g., BSCP, OSCP, OSWE) Experience managing bug bounty programs Background in data privacy and compliance relevant to financial products and cloud-native applications Experience with GitOps and infrastructure-as-code security Experience building custom security tooling to enhance and automate security processes Contributions to open-source security projects or tools COMPENSATION AND BENEFITS: $100,000 - $258,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. ITAR REQUIREMENTS: To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. 1157, or (iv) Asylee under 8 U.S.C. 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here. SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice.
Job Description Job Description You will be the most senior hands-on application security engineer at Cleo, owning both how security is built into our products from design through release and the security posture of the products we ship, both on-premise and SaaS, as our customers experience them. This is a Staff-level individual contributor role with real program ownership: you set the standards, build the guardrails, and work directly with engineers in the code. You report to the CISO and partner daily with Engineering, and our Cloud Security team. You are not a one-person department: security engineers and consulting partners execute under your direction. Your job is to set direction, make the hard technical calls, and build leverage through automation and partners rather than carry every task yourself. Essential Duties & Responsibilities Secure development lifecycle and guardrails Own and mature Cleo's SSDLC: security requirements, threat modeling, and design reviews for high-risk product changes, APIs, and integrations. Run and tune SAST, SCA, secrets detection, container, and IaC scanning. Build reusable secure patterns, reference implementations, and policy-as-code controls that make the secure path the default path. Own developer security enablement: Security Champions meeting, deliver the engineering security training campaigns, grow a named champion in every squad, and give developers practical remediation guidance, office hours, and self-service security capabilities. Product vulnerability management Run risk-based triage, remediation, and verification for application and product vulnerabilities, including remediation SLAs, escalation, and exceptions. Reproduce externally reported vulnerabilities against running product instances and validate patches before release. Own the penetration testing program: scope and coordinate third-party engagements, perform targeted testing yourself, and validate findings through retesting. Run our Vulnerability Disclosure Program, including researcher communications and coordinated disclosure. Coordinate the CVE lifecycle for Cleo products and support product-security incident response. Own the application and product-security controls in Cleo's NIST CSF 2.0 program: track maturity, close gaps, and produce the evidence our audits rely on. Product security Own the security posture of the products Cleo ships, across SaaS and customer-hosted deployment models: secure defaults, authentication and session controls, RBAC and tenant isolation, admin data access, security-relevant configuration, and hardening guidance for customers. Own the Product Security Roadmap: partner with Product Management, the CTO, and Architecture to get security features prioritized and shipped, including SSO/SAML upgrades, the in-app RBAC redesign, endpoint-level access control, and customer-requested controls, and represent security in RTE Sync and Boundary Review. Be the technical owner for customer-facing product security: triage customer vulnerability-scan findings and penetration-test reports against Cleo products, answer security RFIs and enhancement requests, and author customer-facing advisories, security release notes, and hardening documentation. AI Fluency Competencies Own threat modeling and security review for LLM-enabled product features, AI agents, and AI-assisted development workflows. Build controls and secure patterns for prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risk. Apply and operationalize the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework across product and engineering. Prerequisites 6+ years in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams. Strong object-oriented developer: Strong proficiency in an object-oriented programming language is required, with Java preferred given Cleo's core products are Java-based. You should be able to read, debug, and write production-quality code and be comfortable working across languages such as TypeScript, Python, or Go. Deep knowledge of application attack surfaces: authentication, authorization, API security, business-logic flaws, and modern service architectures. Hands-on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines. Hands-on exploit reproduction and patch validation: you can take a researcher's report of a pre-authentication vulnerability, reproduce it against a running Java web application, confirm the fix, and write up what the researcher and the customer each need to hear. Coordinated disclosure experience with external security researchers and customers, including holding an embargo timeline and driving a CVE to publication. Product security experience on shipped software with an installed base: secure defaults and hardening guidance, customer-facing advisories and security release notes, and turning a customer's scan report or RFI into a fix-or-explain response. Experience running threat modeling, design reviews, and manual security testing, and working directly with developers through remediation. Clear communicator who can turn technical risk into engineering guidance for both developers and executives, and who can hold a release-gating decision with Engineering leadership when the risk warrants it. Nice to Have Securing LLM applications, AI agents, or AI-assisted development tools. SBOM (CycloneDX/SPDX), VEX, artifact signing, and SLSA. AWS, Kubernetes/EKS, Terraform, Jenkins. Snyk, GitHub Advanced Security, Semgrep, Burp Suite. NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF; supporting SOC 2 or ISO 27001 audits. CSSLP, OSWE, GWAPT, AWS Security, or comparable certifications.
10/19/2026
Full time
Job Description Job Description You will be the most senior hands-on application security engineer at Cleo, owning both how security is built into our products from design through release and the security posture of the products we ship, both on-premise and SaaS, as our customers experience them. This is a Staff-level individual contributor role with real program ownership: you set the standards, build the guardrails, and work directly with engineers in the code. You report to the CISO and partner daily with Engineering, and our Cloud Security team. You are not a one-person department: security engineers and consulting partners execute under your direction. Your job is to set direction, make the hard technical calls, and build leverage through automation and partners rather than carry every task yourself. Essential Duties & Responsibilities Secure development lifecycle and guardrails Own and mature Cleo's SSDLC: security requirements, threat modeling, and design reviews for high-risk product changes, APIs, and integrations. Run and tune SAST, SCA, secrets detection, container, and IaC scanning. Build reusable secure patterns, reference implementations, and policy-as-code controls that make the secure path the default path. Own developer security enablement: Security Champions meeting, deliver the engineering security training campaigns, grow a named champion in every squad, and give developers practical remediation guidance, office hours, and self-service security capabilities. Product vulnerability management Run risk-based triage, remediation, and verification for application and product vulnerabilities, including remediation SLAs, escalation, and exceptions. Reproduce externally reported vulnerabilities against running product instances and validate patches before release. Own the penetration testing program: scope and coordinate third-party engagements, perform targeted testing yourself, and validate findings through retesting. Run our Vulnerability Disclosure Program, including researcher communications and coordinated disclosure. Coordinate the CVE lifecycle for Cleo products and support product-security incident response. Own the application and product-security controls in Cleo's NIST CSF 2.0 program: track maturity, close gaps, and produce the evidence our audits rely on. Product security Own the security posture of the products Cleo ships, across SaaS and customer-hosted deployment models: secure defaults, authentication and session controls, RBAC and tenant isolation, admin data access, security-relevant configuration, and hardening guidance for customers. Own the Product Security Roadmap: partner with Product Management, the CTO, and Architecture to get security features prioritized and shipped, including SSO/SAML upgrades, the in-app RBAC redesign, endpoint-level access control, and customer-requested controls, and represent security in RTE Sync and Boundary Review. Be the technical owner for customer-facing product security: triage customer vulnerability-scan findings and penetration-test reports against Cleo products, answer security RFIs and enhancement requests, and author customer-facing advisories, security release notes, and hardening documentation. AI Fluency Competencies Own threat modeling and security review for LLM-enabled product features, AI agents, and AI-assisted development workflows. Build controls and secure patterns for prompt injection, sensitive data exposure, insecure output handling, excessive agency, insecure tool integrations, and AI supply-chain risk. Apply and operationalize the OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework across product and engineering. Prerequisites 6+ years in application security, product security, or secure software engineering, including experience building or maturing an AppSec program across multiple engineering teams. Strong object-oriented developer: Strong proficiency in an object-oriented programming language is required, with Java preferred given Cleo's core products are Java-based. You should be able to read, debug, and write production-quality code and be comfortable working across languages such as TypeScript, Python, or Go. Deep knowledge of application attack surfaces: authentication, authorization, API security, business-logic flaws, and modern service architectures. Hands-on experience integrating and tuning SAST, SCA, and secrets scanning in GitHub and CI/CD pipelines. Hands-on exploit reproduction and patch validation: you can take a researcher's report of a pre-authentication vulnerability, reproduce it against a running Java web application, confirm the fix, and write up what the researcher and the customer each need to hear. Coordinated disclosure experience with external security researchers and customers, including holding an embargo timeline and driving a CVE to publication. Product security experience on shipped software with an installed base: secure defaults and hardening guidance, customer-facing advisories and security release notes, and turning a customer's scan report or RFI into a fix-or-explain response. Experience running threat modeling, design reviews, and manual security testing, and working directly with developers through remediation. Clear communicator who can turn technical risk into engineering guidance for both developers and executives, and who can hold a release-gating decision with Engineering leadership when the risk warrants it. Nice to Have Securing LLM applications, AI agents, or AI-assisted development tools. SBOM (CycloneDX/SPDX), VEX, artifact signing, and SLSA. AWS, Kubernetes/EKS, Terraform, Jenkins. Snyk, GitHub Advanced Security, Semgrep, Burp Suite. NIST CSF 2.0, OWASP SAMM/ASVS, NIST SSDF; supporting SOC 2 or ISO 27001 audits. CSSLP, OSWE, GWAPT, AWS Security, or comparable certifications.
