Senior Application Security Engineer

Role Description

As a Senior Application Security Engineer, you will focus on finding and responding to security vulnerabilities across the Brex platform. In this role, you will:

• Perform code reviews, design reviews, penetration testing, and vulnerability management.
• Develop and maintain tooling to perform static and dynamic testing of the Brex platform and tooling which supports secure developer workflows.
• Work closely with Security Operations, GRC, Product Security, Front End Platform, and IT Infrastructure teams.
• Identify attack vectors in AI-powered features and partner with product and engineering teams to build secure AI capabilities.

Qualifications

• 5+ years work experience in an Application Security or related role.
• Ability to find vulnerabilities in complex systems, demonstrating business impact through custom attack chains.
• Experience with a wide range of secure development activities including threat modeling, developer education, and incident response.
• Knowledge of Python, scripting languages, and AI/agentic workflows to automate tasks, build tools, and improve productivity.
• Collaborative mindset paired with strong written and verbal communication skills.

Requirements

• Proficiency with Kotlin, gRPC, GraphQL, Kubernetes.
• Previous experience as a software engineer.
• Consultancy experience performing web application security reviews.
• Experience with securing distributed systems in AWS and cloud environments.
• Experience with pentesting and securing agentic features and systems.
• Contributions to the wider technical community—open source, public research, mentorship, community organizing, blogging, CVEs, presentations, etc.
• Experience submitting to bug bounty programs or responsible disclosure programs.

Benefits

• The expected salary range for this role is $192,000 - $240,000.
• Starting base pay will depend on factors including location, skills, experience, market demands, and internal pay parity.
• Equity and other forms of compensation may be provided as part of a total compensation package.