Overview
Models are great at spotting the textbook SQL injection and blind to the flaw that only shows up in your architecture: the trust boundary drawn in the wrong place, the deserialization no scanner flags, the IAM policy that quietly grants the world. Someone has to threat-model the whole system, and that someone is you.
As an Application Security Engineer you'll evaluate how models reason about secure design and vulnerabilities, catch the flaws they miss, and write the guidance a strong AppSec reviewer would give.
What you’ll actually do
- Probe secure-design reasoning across code review, threat modeling, and cloud configuration, and see what the model overlooks.
- Hunt the real vulnerabilities: broken access control, injection, unsafe deserialization, and over-permissive IAM the scanner never flags.
- Write the secure design when the model falls short, with the threat model and the fix laid out clearly.
Roles this fits
Common backgrounds: Application Security Engineer, Cloud Security Engineer, Vulnerability Researcher.
What we look for
- Professional experience in application or cloud security: code review, threat modeling, or vulnerability research.
- Comfort reading real code and cloud configs for security flaws.
- Clear written English: your explanations are the training signal.
- No degree required. We care about what you can do, not where you learned it.