Staff Application Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead the technical vision and strategic roadmap for the Application Security team, ensuring alignment of security goals with Brex's enterprise growth and fast-paced engineering metrics.

• Set technical standards and secure defaults throughout the engineering organization, promoting a culture of collaborative security excellence while connecting product platforms, infrastructure, and trust.

• Design and secure innovative AI/ML and agentic workflows, employing advanced practices to mitigate risks such as prompt injection, model manipulation, and data poisoning.

• Mentor and coach engineers both within the team and the wider organization, fostering technical development, enhancing individual security expertise, and accelerating team delivery.

• Lead proactive vulnerability discovery and offensive security testing initiatives, executing sophisticated attack chains to illustrate business impact and prioritize cross-functional remediation.

• Collaborate with Product Platform, Cloud Infrastructure, and Data engineering teams to guarantee that core primitives, APIs, and microservices are secure by default from the design phase to deployment.

⛳️ Requirements

• 8+ years of experience in Application Security, Product Security, or software engineering with a primary emphasis on offensive and defensive application security.

• Demonstrated history of technical leadership and team mentorship on intricate, multi-quarter security engineering projects in a dynamic environment.

• Extensive proficiency and technical expertise in AI security, including practical experience securing agentic architectures, LLM gateways, and assessing adversarial AI threats.

• Strong systems-thinking abilities with significant experience in defining secure product development lifecycles, threat modeling complex topologies, and cloud-native container security (AWS, Kubernetes).

• Proficient in Python, Go, or similar languages for architecting internal tools, automating pipelines, and developing advanced detection/scanning engines.

• Outstanding written and verbal communication abilities, with a proven track record of navigating ambiguity, influencing technical leaders, and effectively managing relationships across EPD organizations.

• Familiarity with Kotlin, gRPC, GraphQL, and Kubernetes.

• Previous experience in building and scaling security teams.

• Experience securing distributed systems in AWS and cloud environments.

• Contributions to the broader technical community, including open source, public research, CTF participation, blogging, CVEs, or presentations.

• Experience submitting to bug bounty or responsible disclosure programs.

• Published research in AI security or contributions to AI security frameworks.

🏝️ Benefits

• Equity and other forms of compensation may be provided as part of a total compensation package.

• Tools, resources, and support to foster your career growth.

• A diverse and inclusive culture.