Security Engineer, Application Security

Location: Remote in the United States; must be a U.S. citizen

Company

hirify.global develops AI and robotics systems for maritime domain awareness and critical maritime infrastructure.

What you will do

• Lead threat modeling and secure design reviews for cloud services, APIs, data pipelines, and distributed edge-deployed applications.
• Perform secure code reviews and white-box, grey-box, and black-box application security assessments across web, API, cloud, and backend services.
• Build and integrate SAST, DAST, SCA, secret scanning, CodeQL, and other application security tooling into CI/CD pipelines.
• Triage vulnerabilities, prioritize remediation, and partner with engineering teams to address risk based on business impact.
• Develop secure-by-default automation, paved-road tooling, secure coding standards, and the secure software development lifecycle.
• Support vulnerability disclosure, bug bounty, software supply chain security, application-layer incident response, and developer security training.

Requirements

• 5–8 years of experience in application security, product security, or software engineering with a strong security focus.
• Software development experience in Python, Go, Java, JavaScript/TypeScript, Rust, or C/C++, with the ability to reason about production code.
• Experience with threat modeling, security design reviews, vulnerability assessment, SAST, DAST, SCA, CodeQL, and CI/CD integration.
• Strong knowledge of OWASP Top 10, CWE, common vulnerability classes, and secure coding practices.
• Experience securing microservices or SOA, REST/gRPC APIs, containers, and AWS, Azure, or GCP environments.
• Must be a U.S. citizen; an active U.S. security clearance or eligibility and willingness to obtain and maintain one is required. Bachelor’s degree in Computer Science, Cybersecurity, or equivalent hands-on experience.

Nice to have

• OSCP, OSWE, GWAPT, GWEB, CSSLP, or Burp Suite Certified Practitioner certification.
• Experience with secure-by-default frameworks, software supply chain security, SLSA, in-toto, Sigstore, artifact or commit signing, Terraform, or Kubernetes.
• Bug bounty contributions, published CVEs, security research, or open-source security tooling.
• Experience securing embedded, edge, robotics, or IoT software.
• Experience in defense, intelligence, critical infrastructure, or startup environments, including familiarity with NIST 800-171 or CMMC.

Culture & Benefits

• Flexible remote work with a mission-driven, fast-moving team.
• Significant autonomy to shape the secure SDLC, security tooling, and engineering standards.
• Competitive salary with comprehensive medical, dental, and vision benefits.
• Opportunity to work with AI and robotics systems in high-stakes maritime and national-security environments.
• Career growth within a rapidly scaling defense-tech company.