Staff Application Security Engineer
Lead technical vision and architecture for Brex's Application Security team. Drive AI/ML security strategy, offensive testing, and secure product lifecycle across engineering orgs. Requires 8+ years in appsec with AI security expertise.
About the job
Responsibilities
- Lead the technical vision and strategic roadmap for the Application Security team, aligning security objectives with Brex's enterprise growth and high-velocity engineering metrics.
- Establish technical standards and secure defaults across the entire engineering organization, fostering a culture of collaborative security excellence and bridging product platforms, infra, and trust.
- Architect and secure novel AI/ML and agentic workflows, applying cutting-edge practices to mitigate risks such as prompt injection, model manipulation, and data poisoning.
- Mentor and coach engineers within the team and across the broader organization, guiding technical growth, helping individuals level up their security expertise, and accelerating team delivery.
- Drive proactive vulnerability discovery and offensive security testing strategies, executing complex attack chains to demonstrate business impact and prioritize cross-functional remediation.
- Partner with Product Platform, Cloud Infrastructure, and Data engineering teams to ensure core primitives, APIs, and microservices are secure by default from design to deployment.
Requirements
- 8+ years of experience in Application Security, Product Security, or software engineering with a primary focus on offensive and defensive application security.
- Proven track record of technical leadership and team mentorship on complex, multi-quarter security engineering initiatives in a fast-paced environment.
- Deep proficiency and technical expertise in AI security, including hands-on experience securing agentic architectures, LLM gateways, and evaluating adversarial AI vectors.
- Strong systems-thinking capabilities with extensive experience defining secure product development lifecycles, threat modeling complex topologies, and cloud-native container security (AWS, Kubernetes).
- Proficiency in Python, Go, or similar languages to architect internal tooling, pipeline automation, and advanced detection/scanning engines.
- Exceptional written and verbal communication skills, with a demonstrated ability to navigate ambiguity, influence technical leaders, and manage up and out across EPD organizations.
Nice-to-Haves
- Experience with Kotlin, gRPC, GraphQL, Kubernetes
- Previous experience in building and scaling security teams
- Experience with securing distributed systems in AWS and cloud environments
- Contributions to the wider technical community — open source, public research, CTF participation, blogging, CVEs, or presentations
- Experience submitting to bug bounty or responsible disclosure programs
- Published AI security research or contributions to AI security frameworks
Compensation
- Expected salary range: $240,000 - $300,000 USD
- Equity and other forms of compensation may be provided as part of a total compensation package.
Skills
Application Security, Penetration Testing, Ai Security, Llm Security, Threat Modeling, AWS, Kubernetes, Python, Go, Vulnerability Management
Similar jobs
Security Engineering jobs
Gusto
San Francisco, CA
Own and scale IT general controls, access governance, segregation of duties, and audit readiness across enterprise applications. The role combines SOX expertise with AI-enabled continuous controls monitoring and requires 10+ years of controls, audit, or enterprise governance experience.
Harvey
San Francisco, CA
Staff Security Software Engineer leading identity and access strategy, architecture, and hands-on platform development across customer, employee, contractor, and agentic identities. Requires 10+ years of production software experience and deep expertise in identity and authorization systems.
United States
Design and operate distributed, low-latency infrastructure that protects Reddit from DDoS attacks, bots, scraping, and other network threats. The role requires 7+ years of distributed-systems experience plus expertise in security, networking, and production operations.
Upside
Washington, DCStaff-level AppSec engineer building secure coding practices and vulnerability management for a commerce platform. Requires 6+ years in application security with deep AWS and Python experience.
Lob
United States
Own the technical security function across cloud infrastructure, detection and response, application security, incident response, and automation. The role requires 8+ years of security engineering experience, deep AWS expertise, and the ability to lead security improvements across engineering teams.