Member of Technical Staff, Product Security (AI)

Location: Hybrid in the San Francisco Bay Area, USA; work from the San Francisco office three full days per week and remotely on the remaining days, with sufficient overlap with the relevant team’s time zone.

Base salary: $200,000–$300,000 annually, depending on experience, skills, scope, and location. The role is bonus eligible and includes equity.

Company

hirify.global develops AI-powered video creation products and next-generation creative tools used by consumers and enterprise brands.

What you will do

• Conduct hands-on penetration testing of web applications, APIs, administrative interfaces, AI-powered applications, MCP servers, agentic systems, and code-generating agents.
• Map attack surfaces and identify authentication, authorization, multi-tenant isolation, architectural, cloud, container, and infrastructure vulnerabilities.
• Develop proof-of-concept exploits, validate findings, retest remediation, and own vulnerabilities from discovery through lasting resolution.
• Partner with Product and Engineering on threat modeling, architecture reviews, secure design, code reviews, and pre-release security.
• Translate recurring vulnerabilities into secure development standards, reusable controls, automated security checks, and CI/CD tooling.
• Prioritize risks by exploitability, business impact, and real-world risk while defining security practices for emerging AI technologies.

Requirements

• 5+ years of hands-on experience in product security, application security, penetration testing, or vulnerability research.
• Proven experience independently discovering and exploiting real vulnerabilities through application security work, bug bounty programs, or security research.
• Deep understanding of web application and API security, including authentication, authorization, and multi-tenant isolation.
• Strong ability to read and analyze modern codebases, identify root causes, and collaborate with engineers on remediation.
• Experience conducting threat modeling, secure design reviews, and hands-on penetration testing.
• Proficiency in scripting or programming languages such as Python, JavaScript, TypeScript, or Go.
• Familiarity with cloud infrastructure, containers, and modern application architectures.
• Ability to translate security findings into scalable engineering controls and automated checks.
• Strong technical judgment, independent problem-solving skills, and a proactive approach to identifying security risks.

Culture & Benefits

• Hybrid work with three full days per week in the San Francisco office and remaining days remote.
• Medical, dental, and vision insurance.
• Competitive 401(k) retirement plan with company matching.
• Annual bonus eligibility and participation in the company stock option program.
• Work on ambitious AI products with an experienced, fast-moving, international team, with significant ownership and professional growth opportunities.