Partner closely with engineering to refine architecture and drive security investment while prioritizing velocity.
Build secure 'paved roads' and tooling to eradicate entire vulnerability classes, not just fix bugs one by one.
Own cross-functional product security projects end to end, and amplify impact through automation and feedback loops.
Bugcrowd is a preemptive security platform that unifies exposure discovery and assessment, offensive testing, and AI-driven intelligence to help organizations avoid real-world risk. Founded in 2012 and based in San Francisco, Bugcrowd is a VC-backed company with a diverse, inclusive culture where people feel like family.
Define security architecture and set patterns for secure-by-default product design.
Lead threat modeling and vulnerability management across Flexport's product surface.
Own security tooling and mentor engineers as the technical authority on product security.
Flexport makes global commerce easy with innovative technology, moving over $19B of merchandise across 112 countries annually. They are a pivotal player in the supply chain crisis, backed by top investors, and focus on mission-driven solutions.
Manage vulnerability triage from SCA, container scanning, and external reports, collaborating with engineering on remediation.
Conduct threat modeling and security reviews with R&D teams, turning findings into prioritized actions.
Build internal security tooling, including a CVE registry and LLM-assisted code analysis workflows.
Camunda provides an enterprise platform for agentic orchestration, enabling organizations to coordinate AI agents, people, and systems across business processes. Trusted by over 700 organizations, including 9 of the top 10 US banks, Camunda is a fully remote, AI-first company named one of GP Bullhound's Top 100 Next Unicorns and a Great Place to Work.
Collaborate with Product Engineering teams throughout the SDLC to identify vulnerabilities through threat modeling, design reviews, and secure code reviews.
Develop and implement end-to-end security solutions to mitigate risks across the product suite.
Drive improvements across Product Security tooling, automation, and the bug bounty program while experimenting with AI-based tools.
Superhuman is an AI productivity platform that integrates with over 1 million apps, offering writing, docs, inbox, and AI assistant products. Founded in 2009, it powers over 40 million people and 50,000 organizations worldwide.
Partner with product teams to ensure security is embedded throughout the product development lifecycle.
Conduct threat modeling, architecture reviews, and source code analysis to identify and mitigate vulnerabilities.
Automate security processes and drive cross-team projects to closure.
Affirm exists to give people a clear, predictable way to pay over time with no hidden fees, building honest financial products. It is a remote-first company that values information security, transparency, and flexibility, with a strong culture of care.
Automate security controls by integrating SAST, DAST, and SCA tools into CI/CD pipelines to catch vulnerabilities before production.
Define and drive a developer-friendly Secure SDLC, including threat modeling frameworks like STRIDE and security champions network.
Manage the private bug bounty program, triage reports, lower mean time to mitigation, and conduct code reviews for Java and Python microservices.
VGS is the world's leader in payment tokenization, providing the trust infrastructure for modern commerce and agentic payments. Trusted by Fortune 500 companies and innovative fintechs, VGS stores over 9 billion tokens and processes 10 billion monthly interactions, with a remote-first culture that values curiosity, ownership, collaboration, and continuous learning.
Take end-to-end ownership of security across a platform serving 50 million users, spanning application security, GRC, and AI security.
Collaborate closely with engineering leadership and development teams to identify vulnerabilities, strengthen controls, and drive remediation.
Protect AI-powered systems against evolving threats like prompt injection, jailbreaks, and third-party provider vulnerabilities.
They are a rapidly growing AI-powered technology platform serving over 50 million users worldwide. As a scale-up with more than 50 employees, they foster a high-autonomy, execution-focused culture with direct access to leadership.
Operate and maintain application security scanning tools including SAST, SCA, secrets scanning, and container scanning throughout the SDLC.
Review and triage security findings, validate true positives, and collaborate with engineering teams to prioritize remediation activities.
Support onboarding of new repositories, maintain documentation, and assist with scripting and automation to improve security workflows.
This company is a partner organization with a collaborative security team focused on strengthening application security across a diverse portfolio of digital products and services. It fosters an inclusive, collaborative culture with employee communities and emphasizes learning and development.
Partner with engineering and product teams to review architecture, assess security risks, and drive secure-by-default practices.
Build and maintain security tooling, automate workflows, and strengthen application security across the SDLC.
Lead cross-functional security projects, promote security awareness, and support bug bounty and vulnerability research.
They are a remote-first security company that helps organizations identify and address vulnerabilities before they become serious threats. The team is collaborative and fast-paced, valuing initiative, continuous learning, and diverse perspectives.
Support application security programs including threat modeling and security reviews for web and AI/LLM systems.
Triage SCA/SAST/DAST/CSPM findings and coordinate remediation with engineering teams.
Develop automation scripts and tools to integrate security solutions and streamline vulnerability management.
G-P is a leading SaaS-based Global Employment Platform that enables companies to expand into over 180 countries without establishing local entities. With a diverse, remote-first culture, G-P empowers its Dream Team with flexibility and resources to foster innovation and growth.
Own application and product security, including threat modeling, secure code review, and access-control and secrets-exposure flaws.
Design and implement security architecture for an agentic AI software development lifecycle with out-of-band controls.
Secure AWS environment, manage non-human identities, and enforce security tooling across GitHub and SaaS estate.
Oshi Health is a fully remote, cloud-native healthcare platform dedicated to helping people manage chronic GI conditions. It is a growing company with a small cross-functional team, emphasizing a remote-first culture and equity-based compensation.
Partner with engineering to identify and mitigate security risks before launch, building secure frameworks and libraries that make control adoption easy.
Own identity and secrets management, including credential issuance, rotation, and workload authentication across cloud and Kubernetes environments.
Harden cloud security controls and build security models for AI agents with permission boundaries and tenant isolation.
Fieldguide builds software that automates assurance and audit work for cybersecurity, privacy, and financial audits, helping businesses enable trust. They are a remote-first company backed by top investors and trusted by over 50 of the top 100 accounting and consulting firms, with a values-driven culture.
Conduct threat modeling and risk assessments across product features, AI agents, cloud infrastructure, and data systems to identify vulnerabilities.
Partner with engineering, IT, and data teams to embed security into development processes through design reviews and secure coding guidance.
Run vulnerability management, bug bounty coordination, incident readiness, and SOC 2 compliance support to build scalable security practices.
n8n is an open workflow orchestration platform for AI-powered automation, combining code freedom with no-code speed. Since 2019, it has grown to 260+ employees across Europe and the US, backed by top investors and a 650,000-developer community.
Shape and execute application security and cloud security posture, driving secure-by-design practices and threat modeling across services and infrastructure.
Partner with product engineering to embed security throughout the SDLC and integrate developer-friendly security tooling into CI/CD pipelines.
Establish cloud security controls, automate threat detection, and build a security champion network to scale secure practices.
Clutch is a vertical SaaS company, backed by Andreessen Horowitz, that helps credit unions become FinTech lenders and improve members' financial well-being. It is a fast-paced fintech startup building a security-first engineering culture and leveraging AI to amplify innovation.
Own application security across cloud services, APIs, data pipelines, and edge-deployed systems.
Lead threat modeling, secure design reviews, and in-depth code reviews to identify and fix vulnerabilities.
Build and integrate security tooling like SAST, DAST, SCA, and CodeQL into CI/CD and mature the secure SDLC.
Quartermaster AI leverages cutting-edge AI and robotics to make the ocean a safe and sustainably managed resource. It is a fast-moving, rapidly scaling defense-tech startup with a mission-driven culture and significant autonomy for engineers.
Identify risks through security reviews, code audits, and penetration tests across applications, APIs, and integrations.
Secure our AI layer against prompt injection, excessive permissions, and unauthorized data access.
Define and update secure development practices, and support customer security calls.
Euler is an AI-native partner relationship management (PRM) platform that powers go-to-market partnerships, which drive 30-50% of company revenue. We grew 600% last year, are profitable, and have a culture of ownership and no ego.
Own and run bug bounty programs and external audit engagements, triaging and validating fixes.
Secure code and software supply chain, including CI/CD defenses, dependency controls, and signing.
Build anti-scam, anti-abuse, and security tooling with static/dynamic analysis and LLM-driven agents.
Mysten Labs builds foundational blockchain infrastructure and products, including Sui and Move, to advance the internet and enable the agent economy. It is a remote-first, world-class team backed by a $300M Series B from leading venture funds.
Contribute production-grade code across Node.js/React applications and Python/Terraform infrastructure, shipping security fixes directly.
Drive secure SDLC, CI/CD security automation, and threat modeling across new and existing systems.
Work AI-natively to secure AI-powered features, own the bug bounty program, and perform hands-on penetration testing.
BioRender builds tools that accelerate scientific communication, helping researchers create and share clear scientific visuals. Backed by Y Combinator and used by millions in 200+ countries, the company is remote-first with a mission-driven, collaborative culture.
Triage and remediate security vulnerabilities across Ruby, Python, and .NET applications using Snyk.
Work embedded with engineering teams to fix dependency, code, container, and infrastructure issues.
Prioritize findings, write clear pull requests, and keep Jira and Snyk projects up to date.
Blue Coding specializes in hiring developers and professionals from Latin America to help US and Canadian companies build development teams and products. With over 150 employees across more than 10 countries, the company is fully remote, culturally diverse, and values honesty, fairness, respect, efficiency, hard work, and cooperation.
Serve as mentor to other Security Engineers and lead application security reviews and threat modeling.
Drive automated security testing and bug bounty program to position 6sense as an industry leader.
Collaborate with engineering teams to reproduce, triage, and address application security vulnerabilities.
6sense's mission is to multiply growth, retention, and efficiency for companies. They have a growth mindset culture with values like Win as One Team and Stay Curious, and offer numerous learning and development initiatives.