Source Job

• Secure AI systems and use AI to scale security, conducting security reviews and threat modeling of AI-integrated product features.
• Deliver end-to-end application security reviews for high-risk features, working directly with engineering teams to surface and close risk.
• Advance CI/CD pipeline security by operating and evolving security scanning controls in GitLab pipelines.

Smartsheet empowers teams to manage work and scale solutions by uniting human teams with AI agents. They are a large company with over 20 years of experience, fostering a culture where ideas are heard and contributions have real impact.

• Partner with engineering, product, and DevOps teams to integrate security practices throughout the SDLC, focusing on cloud-native environments and automated pipelines.
• Design, implement, and maintain security tooling and gates within CI/CD pipelines covering SAST, DAST, SCA, secrets detection, and container scanning.
• Lead threat modeling, conduct application security assessments including code review and manual penetration testing, and triage bug bounty reports.

Hyland is the pioneer of the Content Innovation Cloud, delivering ubiquitous enterprise intelligence to organizations. With a team of nearly 4,000 employees, the company fosters an employee-centric culture focused on community impact and innovation.

• Contribute to secure-by-design practices and advance the S-SDLC program.
• Mentor engineers on secure coding and career growth.
• Evaluate and recommend AI-assisted security tooling.

Spring Health is a global mental health company eliminating every barrier to mental health. They reach more than 170 million people worldwide and are an AI-native company focused on expanding the reach, quality, and humanity of care.

• Lead threat modeling and security architecture reviews with engineering teams by translating security risks into concrete development actions.
• Architect, build, and maintain security tooling and integrations that make secure development the default in our CI/CD pipelines.
• Design and deploy automated security testing to identify vulnerabilities early in the development process.

Abnormal Security protects the humans behind the world's most critical organizations from AI-powered cybercrime. More than 4,500 enterprises trust its behavioral AI platform.

• Lead application and product security across Forward-built, third-party, and AI-built software.
• Evolve the pentest program and proactively build AI solutions within the appsec function.
• Own remediation workflows and partner with teams to build controls for external exposure.

Forward Financing is a financial technology company that unlocks capital for small businesses across America. They are a recognized Best Place to Work with a remote-first culture and team members across the US, Canada, and Dominican Republic.

• Perform hands-on security testing and code review across web applications and APIs.
• Conduct threat modeling and embed secure development practices into the SDLC.
• Build and tune security tooling, including SAST, DAST, and CI/CD automation.

Prolific builds human data infrastructure for AI development, connecting researchers with a global participant pool to collect high-quality, ethically sourced behavioral data. They are a mission-driven company trusted by world-leading research institutions and AI labs, with a remote-first culture.

• Own and manage the application vulnerability remediation program, prioritizing findings and guiding developers.
• Partner with engineering teams to validate fixes and implement long-term security improvements.
• Define and maintain secure SDLC processes, including security reviews and threat modeling.

The company develops internet-facing financial software, APIs, and cloud-based solutions. It operates with a remote-first culture and emphasizes security and compliance.

• Hunt for and close security vulnerabilities across Counterpart Assistant using custom tooling and AI-driven frameworks.
• Harden systems, services, and endpoints while establishing strong security monitoring and safeguarding PHI.
• Raise the security bar by reviewing critical pull requests, running training, and mentoring engineers on secure coding practices.

Counterpart Health, a subsidiary of Clover Health, builds an AI-enabled primary care tool called Counterpart Assistant that helps physicians diagnose and manage chronic conditions earlier. The company employs a remote-first culture with a diverse and inclusive team focused on transforming healthcare at scale.

• Lead threat modeling, architecture reviews, and code reviews for web applications, APIs, and microservices.
• Actively develop and commit code to fix security flaws in Python, Go, or JavaScript/TypeScript codebases.
• Implement and manage security testing tools within CI/CD pipelines to catch vulnerabilities early in the SDLC.

RunPod is the AI Developer Cloud, providing a platform for developers to experiment, train, fine-tune, deploy, and scale AI. We are a small, remote-first team that has processed over 20 billion inference requests and closed a $100M Series A in June 2026.

• Architect, design, and implement end-to-end security solutions including firewalls, intrusion detection, and cloud security controls.
• Collaborate with DevOps to integrate security into CI/CD pipelines and automate secure deployments.
• Conduct regular security assessments, threat modeling, and architecture reviews to identify risks and design mitigations.

Figure is transforming capital markets through blockchain, powering real products used by hundreds of thousands of consumers and institutions. With over 170 partners and $22 billion in home equity loans originated, Figure is the largest non-bank provider of home equity financing in the U.S., recognized as one of Forbes' Most Innovative Fintech Startups in 2025.

• Lead application and product security across Forward-built, third-party, and AI-built software.
• Evolve the pentest program to aggressively test and remediate vulnerabilities in existing and new software.
• Build and integrate AI solutions within the appsec function.

Forward Financing is a financial technology company that unlocks capital for small businesses across America. Recognized as a Best Place to Work, it invests in employees, technology, and customer experience with a long-term focus.

• Drive application security initiatives across the SDLC, partnering with engineering teams to promote secure coding and security-by-design.
• Integrate security testing tools into CI/CD pipelines and automate security processes using modern AppSec and DevSecOps tools.
• Perform vulnerability analysis, source code review, and support threat modeling and secure design reviews.

Devoteam Cyber Trust is the cybersecurity arm of the Devoteam Group, offering end-to-end cyber resilience and managed security services. With 800+ experts across EMEA, they are ISO 27001 certified and serve clients in over 20 countries.

• Own the Application Security product strategy and roadmap, from tooling to governance.
• Drive delivery of security solutions with engineering and cross-functional teams.
• Lead tool procurement, risk prioritization, and executive communication.

Zeta Global is an AI-powered marketing cloud that helps marketers acquire and retain customers using advanced AI and consumer data. Founded in 2007, the company is headquartered in New York City with offices worldwide, employing a diverse team focused on innovation and inclusion.

• Lead secure design reviews, threat modeling, and risk assessments for AI-driven products and APIs.
• Embed security practices throughout the software and AI development lifecycle.
• Architect and enforce security controls for AI/ML systems and cloud-native infrastructure.

AlphaSense provides AI-driven market intelligence and search platform trusted by over 6,000 enterprise customers. Founded in 2011, the company has more than 2,000 employees globally with offices in multiple countries.

• Define and lead the enterprise security strategy for AI-powered systems and Azure cloud environments.
• Establish security controls and threat modeling for agentic AI workflows and cloud workloads.
• Mentor engineering teams on secure AI adoption and cloud security best practices.

Banner Bank is a community bank with over 135 years of history, serving Washington, Oregon, Idaho, and California with $16 billion in assets and 135 branches. They prioritize core values like teamwork and integrity, and have been Great Place to Work Certified, emphasizing employee volunteerism and community support.

• Assist with source code review and secure coding improvements.
• Use SAST, DAST, and SCA tools to identify and validate vulnerabilities.
• Collaborate with teams to integrate security into CI/CD and SDLC processes.

This company is a technology-driven healthcare organization integrating security into software development. It fosters a collaborative remote culture and supports professional growth in cybersecurity.

• Lead Application Security initiatives across HighLevel's products and engineering teams.
• Conduct architecture reviews, threat modeling, and security assessments for web, mobile, and API applications.
• Drive DevSecOps practices by automating security in CI/CD pipelines and managing security tooling.

HighLevel is an AI-powered, all-in-one white-label sales and marketing platform that empowers agencies and businesses to grow their digital presence. With over 1,500 team members across 15+ countries, we operate in a global, remote-first environment with a culture rooted in creativity, collaboration, and impact.

• Partner with product and engineering teams to identify security risks and implement secure solutions throughout the product lifecycle.
• Lead threat modeling activities, secure design reviews, and security-focused code reviews to improve development practices.
• Build, maintain, and improve application security tooling and participate in incident response activities.

The partner company is a fast-moving engineering organization focused on protecting modern software products and the sensitive data they manage. The team values innovation, inclusion, and continuous improvement, and offers a collaborative culture with high ownership.

• Design, build, and operate an AI-augmented red teaming harness using advanced LLM APIs for autonomous vulnerability discovery.
• Conduct adversarial testing across external, internal, and privileged perspectives, chaining and validating vulnerabilities.
• Collaborate with DevSecOps, SOC, and engineering teams to improve security automation and detection workflows.

This company provides a cloud-based platform for highly security-conscious organizations. It fosters a remote-first culture focused on innovation, ownership, and continuous learning.

• Define security requirements and design application architectures following a secure-by-default approach.
• Conduct threat modeling, code reviews, and penetration testing on cloud-based web and mobile apps.
• Implement, manage, and automate SAST/DAST/SCA security controls and WAF rules to enforce protection at scale.

Prima is a motor insurance company that uses data and technology to provide a great experience for drivers. They are trusted by over 5 million drivers and have over 350 engineers in their Engineering department, fostering a culture of curiosity and collaboration.