Information Security Engineer - Application Security (AI)

Location: Fully remote and global; work from anywhere

Annual total target cash: United States $119,900–$193,200; United Kingdom £75,300–£123,800; Singapore S$148,900–S$223,300. Compensation is location-based; other locations are hired via Remote.com.

Company

hirify.global provides an enterprise platform for orchestrating AI agents, people, and systems across complex business processes, with governance, auditability, and human oversight.

What you will do

• Triage findings from SCA, container and code scanning, external reports, and internal security testing; assess impact and coordinate remediation, mitigation, or acceptance through release.
• Run threat-modeling sessions and security design reviews for new features and architecture changes.
• Use and improve LLM-assisted tooling, agents, prompts, and reusable skills to review code, validate findings, and reproduce issues.
• Build and maintain the CVE registry and automation connecting scanners, engineering teams, and customer communications.
• Support engineers through security guidance, pull-request reviews, workshops, security advisories, customer questions, and audits.
• Participate in the InfoSec on-call rotation and investigate and resolve security incidents.

Requirements

• Around 3+ years in security or software engineering, including at least 2 years in application or product security; AppSec, product security, pentesting, and security-focused development experience count.
• Experience in a SaaS or software product company working closely with engineering teams shipping frequently through modern CI/CD and cloud environments.
• Hands-on vulnerability triage using Snyk, Trivy, Semgrep, CodeQL, or similar tools; ability to distinguish real issues from false positives and assess exploitability in context using CVSS, configuration, and related factors.
• Experience with threat modeling and design reviews on real systems, ideally web applications, APIs, or distributed services.
• Ability to read Java well enough to follow data flow and identify security bugs; ability to write scripts and small tools and contribute to an existing codebase through review.
• Daily experience building with AI coding agents such as Claude Code, Cursor, Copilot, or similar, with the judgment to validate their security-related output.
• Clear, friendly communication with engineers and the ability to explain risk to non-security specialists.

Nice to have

• Python and/or JavaScript experience or experience building internal tools.
• Willingness to learn and use hirify.global; prior BPMN or workflow experience.
• Security incident response or on-call experience.
• Security advisories, CVE disclosure, or bug bounty experience.
• Knowledge of AI/LLM security risks, including OWASP Top 10 for LLMs and agentic applications, prompt injection, and tool abuse.
• Experience securing Kubernetes or container-based workloads, or open-source and B2B software.

Culture & Benefits

• Transparent, practical security culture focused on risk-based decisions rather than compliance alone.
• Fully remote and globally distributed work with home-office budget, coworking support, and flexible time off.
• Locally tailored healthcare, global mental-wellbeing support, lifestyle spending benefits, and retirement, pension, life, and disability plans where applicable.
• Annual kickoff, team offsites, connection budgets, and local gatherings.
• Up to $/€/£1,000 per year for self-directed learning, including courses, certifications, and books.
• AI tools may be used during application screening and interviews.

Hiring process

• hirify.global may use AI tools to support application screening and the interview process.
• Applications must be submitted directly; unsolicited recruiting agency resumes are not accepted.