Trail of BitsUnited StatesSecurity Engineer contributing to application security assessments, vulnerability discovery, and custom tooling development. Owns components of client engagements and drives findings from discovery through delivery.
Security Assessment Ownership - Lead security assessments for specific components, modules, or systems within larger client engagements. Identify vulnerabilities, trace root causes, and own your analysis from discovery through client delivery.
Vulnerability Discovery and Analysis - Find and validate real vulnerabilities in application code and systems. Explain exploitation paths, assess impact, and develop proof-of-concept code when needed.
Custom Security Tooling - Design and build security testing tools and automation for vulnerability detection. Own tool development from concept through deployment on client projects.
Architecture and Threat Modeling - Conduct threat modeling and architecture reviews of software systems. Identify attack surfaces, data flows, and security boundaries. Propose concrete mitigations.
Client Communication - Translate technical findings into clear, actionable recommendations for engineering teams. Own client relationships for your component of the work.
Research and Innovation - Contribute to security research initiatives. Build tools, document findings, and stay on the cutting edge of vulnerability research and application security.
You're 0–2 years into your security career, or you're coming from software engineering with a strong security foundation. You have proven ability to find vulnerabilities and understand how systems break. You're autonomous, you own your work, you drive your own analysis, and you don't need someone looking over your shoulder.
IAM Engineer responsible for implementing and improving identity and access management tooling (Okta, ConductorOne, Terraform) with RBAC/ABAC/JIT controls. Requires 2+ years experience in IAM infrastructure, scripting, and IGA platforms in a fast-paced crypto environment.
Enforce and maintain information security policies for CUI systems, ensuring NIST SP 800-171 compliance and CMMC 2.0 accreditation. Coordinate with ISSM, admins, and leadership on risk management, incident response, and continuous monitoring.
Conducts daily trade surveillance reviews for active trader clients using Nasdaq Trade Surveillance (NTS), detecting and investigating market manipulation in equities and listed options. Requires 3-5 years NTS experience and strong analytical skills in abusive trading patterns.
SecOps Engineer building automated response mechanisms, triaging alerts, hunting threats, and supporting incident response with AI and SOAR tools. Requires strong logging skills, Python, and Git experience in a security-focused environment.
Develop and optimize high-fidelity threat detections across SIEM/SOAR platforms using Python, SQL, and AI/ML techniques. Focus on LLM-assisted workflows, AI-specific threat detection, and infrastructure-as-code for scalable security operations.