Source Job

• Conduct application security reviews including threat modeling, code review, and risk assessment for new features.
• Perform and improve SAST/DAST operations, triage, validation, and remediation tracking in CI/CD pipelines.
• Apply and improve AI security review processes for LLM-integrated features and agentic attack surfaces.

Monarch is a powerful, all-in-one personal finance platform designed to simplify money management. They are a fully remote team of do-ers led by experienced entrepreneurs, passionate about building a product people love.

• Define security requirements and design application architectures following a secure-by-default approach.
• Conduct threat modeling, code reviews, and penetration testing on cloud-based web and mobile apps.
• Implement, manage, and automate SAST/DAST/SCA security controls and WAF rules to enforce protection at scale.

Prima is a motor insurance company that uses data and technology to provide a great experience for drivers. They are trusted by over 5 million drivers and have over 350 engineers in their Engineering department, fostering a culture of curiosity and collaboration.

• Contribute to secure-by-design practices and advance the S-SDLC program.
• Mentor engineers on secure coding and career growth.
• Evaluate and recommend AI-assisted security tooling.

Spring Health is a global mental health company eliminating every barrier to mental health. They reach more than 170 million people worldwide and are an AI-native company focused on expanding the reach, quality, and humanity of care.

• Secure AI systems and use AI to scale security, conducting security reviews and threat modeling of AI-integrated product features.
• Deliver end-to-end application security reviews for high-risk features, working directly with engineering teams to surface and close risk.
• Advance CI/CD pipeline security by operating and evolving security scanning controls in GitLab pipelines.

Smartsheet empowers teams to manage work and scale solutions by uniting human teams with AI agents. They are a large company with over 20 years of experience, fostering a culture where ideas are heard and contributions have real impact.

• Partner with engineering, product, and DevOps teams to integrate security practices throughout the SDLC, focusing on cloud-native environments and automated pipelines.
• Design, implement, and maintain security tooling and gates within CI/CD pipelines covering SAST, DAST, SCA, secrets detection, and container scanning.
• Lead threat modeling, conduct application security assessments including code review and manual penetration testing, and triage bug bounty reports.

Hyland is the pioneer of the Content Innovation Cloud, delivering ubiquitous enterprise intelligence to organizations. With a team of nearly 4,000 employees, the company fosters an employee-centric culture focused on community impact and innovation.

• Lead application security reviews, threat modeling, and secure code review for new features and significant product changes.
• Operate and improve SAST, DAST, and SCA tooling, triage findings, and partner with engineering teams to harden the codebase.
• Plan and execute internal penetration tests against web applications, APIs, and mobile clients, and own the vulnerability management lifecycle.

ButterflyMX empowers people to automate property access, operations, and security from a single platform, serving over 20,000 properties worldwide. As a distributed, primarily remote workforce, they seek intelligent, passionate, and collaborative individuals driven by a shared commitment to excellence and innovation.

• Partner with product and engineering teams to identify risks early and build security into new features.
• Lead threat modeling and secure design reviews for new products and architecture changes.
• Perform security-focused code reviews and maintain application security tooling integrated into CI/CD.

Jump builds AI-powered tools that help financial advisors automate meeting prep, notes, and follow-up. It is a small startup with a culture that prioritizes security and trust, and security is core to the product.

• Own key security domains such as vulnerability management, application security, API security, and supply chain security.
• Partner with engineering teams to integrate security into design reviews, threat modeling, CI/CD pipelines, and developer workflows.
• Develop and improve security tooling and automation to reduce manual effort and leverage AI for triage and detection.

NinjaTrader is an industry-leading trading platform and futures broker that empowers traders with award-winning software and brokerage services. Since 2003, the company has grown to over 2 million users and is the number one rated futures brokerage worldwide, fostering a dynamic culture focused on social connection, professional development, and employee recognition.

• Lead penetration testing engagements on applications with complex technology stacks, working independently and collaboratively.
• Contextualize vulnerabilities and assess realistic impact to clients, ensuring quality reports and services are delivered efficiently.
• Maintain strong depth of knowledge in application security and mentor teammates while collaborating with project managers and delivery teams.

Coalfire is a cybersecurity firm that helps clients navigate complex security challenges through advisory, assessment, and automation services. The company is headquartered in Chicago with offices across the U.S. and U.K., and supports clients worldwide with a team of passionate cybersecurity experts.

• Architect, design, and implement end-to-end security solutions including firewalls, intrusion detection, and cloud security controls.
• Collaborate with DevOps to integrate security into CI/CD pipelines and automate secure deployments.
• Conduct regular security assessments, threat modeling, and architecture reviews to identify risks and design mitigations.

Figure is transforming capital markets through blockchain, powering real products used by hundreds of thousands of consumers and institutions. With over 170 partners and $22 billion in home equity loans originated, Figure is the largest non-bank provider of home equity financing in the U.S., recognized as one of Forbes' Most Innovative Fintech Startups in 2025.

• Lead implementation and optimization of AppSec tools such as SAST, DAST, and SCA across client environments.
• Conduct manual application and API security assessments, identifying vulnerabilities and recommending remediation strategies.
• Advise clients on secure SDLC practices and integrate security tools into CI/CD pipelines.

The company is a cybersecurity consulting firm that helps organizations design and operationalize application security programs. It operates with a remote-first culture and a collaborative, client-facing team.

• Partner with engineering teams to perform security reviews, threat modeling, and risk assessments for product features and APIs.
• Develop and maintain scalable security tools and automation pipelines for vulnerability detection across the SDLC.
• Contribute to security architecture reviews and support bug bounty programs and incident response.

Lime is a global leader in micromobility on a mission to make transportation shared, affordable, and carbon-free. A Time Magazine 100 Most Influential Company, Lime has powered over a billion rides in 30 countries and is a fast-paced, lean, remote-first team.

• Lead threat modeling, architecture reviews, and code reviews for web applications, APIs, and microservices.
• Actively develop and commit code to fix security flaws in Python, Go, or JavaScript/TypeScript codebases.
• Implement and manage security testing tools within CI/CD pipelines to catch vulnerabilities early in the SDLC.

RunPod is the AI Developer Cloud, providing a platform for developers to experiment, train, fine-tune, deploy, and scale AI. We are a small, remote-first team that has processed over 20 billion inference requests and closed a $100M Series A in June 2026.

• Lead application and product security across Forward-built, third-party, and AI-built software.
• Evolve the pentest program to aggressively test and remediate vulnerabilities in existing and new software.
• Build and integrate AI solutions within the appsec function.

Forward Financing is a financial technology company that unlocks capital for small businesses across America. Recognized as a Best Place to Work, it invests in employees, technology, and customer experience with a long-term focus.

• Build production-grade security applications and services using Python.
• Develop internal security platforms and tooling from scratch.
• Design and enforce secure cloud architectures (AWS) and implement policy enforcement for IAM least-privilege models.

Binance is a leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. They are trusted by 300+ million people in 100+ countries and have a diverse workforce.

• Design and ship scalable security solutions to bridge the gap between security and engineering teams.
• Build cooperative partnerships with product and engineering teams to integrate robust security capabilities at scale.
• Drive security risk reduction through technical leadership, security reviews, and mentorship across engineering teams.

Twilio is a communications platform that delivers innovative solutions to hundreds of thousands of businesses and empowers millions of developers worldwide to craft personalized customer experiences. The company has a remote-first work culture with a strong focus on connection, global inclusion, and diverse experiences, making a global impact each day.

• Lead application and product security across Forward-built, third-party, and AI-built software.
• Evolve the pentest program and proactively build AI solutions within the appsec function.
• Own remediation workflows and partner with teams to build controls for external exposure.

Forward Financing is a financial technology company that unlocks capital for small businesses across America. They are a recognized Best Place to Work with a remote-first culture and team members across the US, Canada, and Dominican Republic.

• Partner with product and engineering teams to identify security risks and implement secure solutions throughout the product lifecycle.
• Lead threat modeling activities, secure design reviews, and security-focused code reviews to improve development practices.
• Build, maintain, and improve application security tooling and participate in incident response activities.

The partner company is a fast-moving engineering organization focused on protecting modern software products and the sensitive data they manage. The team values innovation, inclusion, and continuous improvement, and offers a collaborative culture with high ownership.

• Deliver Application Security services including threat modeling, architecture reviews, and program assessments.
• Author comprehensive reports tailored to technical and managerial audiences with remediation strategies.
• Contribute to practice development and mentor team members while embracing emerging technologies.

GuidePoint Security provides trusted cybersecurity expertise, solutions, and services to help organizations minimize risk. With over 1,200 employees, the company fosters a collaborative culture focused on mentorship and knowledge sharing.

• Build into the product by writing investigation flows, building integrations with security tools, and fixing bugs.
• Evolve the investigation logic and pipelines to handle new classes of security alerts, balancing accuracy, performance, and maintainability.
• Contribute directly to the Python codebase while influencing architectural decisions and long-term product strategy.

Dropzone AI scales cybersecurity beyond human limits by augmenting security engineers with AI specialists. The venture-backed company is disrupting the $200B+ cybersecurity market and has a team with deep experience in cybersecurity, AI/ML, and SaaS.