AI-Driven AppSec Engineer

Collective Hub Inc.; San Francisco (CA); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid Work Model

Fresh Lunch Provided on in-office days

Commuter Support: $150 monthly

Health & Wellness: $200 quarterly

Flexible PTO and holidays

Medical, dental, vision coverage

Parental Leave: 16 weeks

401k + equity

Annual in-person summit

Job summary

Collective Hub Inc. in San Francisco is hiring a Product Security Engineer to design and operate an agentic appsec program.

You'll implement a CI/CD-integrated stack with SAST, DAST, and SCA, plus AI-driven triage and PR security reviews to accelerate feedback for engineering teams handling sensitive financial data. You will lead remediation across the platform, craft secure defaults, and drive threat modeling for new features, aiming for high-signal security with a living set of threat models

Qualifications

• 4+ years of security engineering with real depth in application security.
• Hands-on experience with SAST, DAST, and SCA tooling and CI/CD integration.
• Genuine enthusiasm for building with LLMs and AI agents.
• Enough software engineering skill to make confident, well-scoped changes in production codebase.
• Experience driving remediation through teams you don’t manage.
• Product empathy: security feedback that engineers act on.

Responsibilities

• Build and operate an agentic application security program: full testing stack integrated into CI/CD, with AI triage and automated PR review.
• Drive vulnerability remediation end to end: triage, rate findings, route fixes, and verify closure against SLAs.
• Eliminate vulnerability classes at the root: ship secure defaults and framework-level fixes.
• Lead threat modeling and security review for new features and platform changes.
• Tune and evolve the program's signal quality: better prompts, fewer false positives.
• Stay current on fintech vulnerability landscape and translate into program changes.

Skills

Security engineering

SAST

DAST

SCA

CI/CD integration

LLMs / AI agents

Python/Django coding

Tools

Semgrep

CodeQL

Bandit

OWASP ZAP

Burp Suite

Job description

Collective Hub Inc. in San Francisco is hiring a Product Security Engineer to design and operate an agentic appsec program.

You'll implement a CI/CD-integrated stack with SAST, DAST, and SCA, plus AI-driven triage and PR security reviews to accelerate feedback for engineering teams handling sensitive financial data. You will lead remediation across the platform, craft secure defaults, and drive threat modeling for new features, aiming for high-signal security with a living set of threat models