Application Security Engineer

SpaceXAI seeks an Application Security Engineer in Austin, TX (onsite) to strengthen the security and integrity of payments and financial products across the software lifecycle.

Responsibilities

• Run in-depth code reviews and static analysis to find and remediate security vulnerabilities in financial applications
• Define and roll out secure coding guidelines and best practices for development teams
• Partner with engineering teams to embed security into the CI/CD pipeline (DevSecOps practices)
• Conduct threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces
• Develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits
• Own vulnerability tracking and remediation guidance for development teams
• Manage bug bounty program activities: intake, triage, researcher communication, and coordinated disclosure
• Support application security incident response efforts
• Monitor emerging threats targeting financial and cloud-native systems and continuously improve controls
• Secure the software supply chain, including producing and maintaining Software Bills of Materials (SBOMs)
• Design and implement agentic and LLM-based solutions to detect, investigate, or prevent security issues

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, or a related field
• 3–5 years of experience in application security, with a strong emphasis on code security practices
• Experience with payments, money transmission, digital wallets, or related financial platforms
• Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities such as OWASP Top 10
• Proficiency in Python or Rust with secure coding practices in these languages
• Experience securing CI/CD pipelines and implementing DevSecOps
• Familiarity with software supply chain security and SBOM generation tools
• Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis
• Experience securing payments, wallets, ledgers, and other high-value transaction systems, including controls for fraud, abuse, and integrity
• Experience designing and implementing agentic and LLM-based security solutions
• Excellent communication skills for explaining complex security topics to both technical and non-technical audiences

Technologies

• Python, Rust
• OWASP Top 10
• Burp Suite, OWASP ZAP
• Software Bills of Materials (SBOMs)
• DevSecOps, CI/CD pipelines, GitOps
• Agentic solutions, LLM-based solutions
• Infrastructure-as-code

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• Access to a 401(k) retirement plan
• Short & long-term disability insurance
• Life insurance
• Various other discounts and perks

Preferred Skills and Experience

• Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus
• Relevant security certifications (e.g., BSCP, OSCP, OSWE)
• Experience managing bug bounty programs
• Background in data privacy and compliance related to financial products and cloud-native applications
• Experience with GitOps and infrastructure-as-code security
• Experience building custom security tooling to enhance and automate security processes
• Contributions to open-source security projects or tools

Compensation and Benefits

• $100,000 - $258,000 USD
• Base salary is part of a total rewards package including equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks

ITAR Requirements

• To conform to U.S. Government export regulations, applicants must be: (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or eligible to obtain required authorizations from the U.S. Department of State