Staff Security Engineer - Application Security in United

Job Description

Staff Security Engineer - Application Security

Colossus Technologies Group is working with a high-tech fintech company to hire a Staff Security Engineer focused on building the next of its Application Security program.

This isn't a traditional AppSec role centered around running scanners, reviewing findings and acting as a security gate for engineering.

We're looking for a security engineer who builds.

The team is working on engineering problems around:

• Building AI-powered security agents that can review architecture and code, identify vulnerabilities and help automate security reviews
• Developing the next of SAST and DAST capabilities, combining traditional security analysis with AI to find vulnerabilities that existing tooling misses
• Building automated systems that can move from vulnerability discovery into validation, prioritization and eventually remediation
• Creating security tooling that gives developers useful feedback directly inside their existing development and CI/CD workflows
• Automating threat modeling and secure design reviews so Product Security can scale alongside a fast-moving engineering organization
• Securing AI and agentic applications against emerging attack paths including prompt injection, tool abuse, excessive permissions, data leakage and unsafe agent behavior
• Building controls around software supply chain, dependencies and the path from source code through production
• Performing deep technical security research against applications, APIs and cloud- systems, then turning what is learned into repeatable tooling and engineering controls

We're interested in engineers who have built things like security scanners, static or dynamic analysis systems, vulnerability research platforms, automated threat-modeling systems, AppSec developer tooling, security agents or other security products.

Strong software engineering ability is important. Python, Go or similar backgrounds are relevant, along with the ability to read and reason about production code across different and architectures.

The ideal person has enough offensive and Application Security depth to find difficult vulnerabilities themselves, but would rather solve the problem at scale by building a system that can find the next thousand.

Remote - United States

Staff Level

Full-time

Competitive base + bonus + equity