AI-Driven AppSec Engineer — Ownership, Equity, Relocation

Fairweather, LLC; New York (NY); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Relocation bonus

Housing stipend

Meal stipend

Equinox membership

Laundry reimbursement

Wellness reimbursement

Health insurance

Dental insurance

Vision insurance

Job summary

Mercor is seeking a Security Engineer to own application security across the development lifecycle. You will review code for exploitable flaws, embed security tooling into CI/CD, and drive remediation for a platform serving 300K+ experts and enterprise clients handling sensitive AI training data.

You’ll work in-person five days a week in our NYC or SF offices, collaborating with researchers, operators, and AI companies at the forefront of AI security.

Qualifications

• You've found and fixed real vulnerabilities in production applications - not just run scanners.
• Deep understanding of web application security: OWASP Top 10 is baseline, you think in terms of attack chains and business logic flaws.
• Strong in at least one of Python, TypeScript, or Go - you can read a PR and spot the auth bypass.
• Experience building or tuning SAST/DAST tooling (Semgrep, CodeQL, Snyk, Burp, or similar).
• You understand modern web frameworks, APIs, and authentication patterns well enough to threat model them.
• Experience managing a vulnerability pipeline - from discovery through prioritization to verified remediation.
• 5+ years of professional experience in application security, security engineering, or software engineering with a strong security focus.

Responsibilities

• Embed security review workflows in the SDLC with PR-level analysis.
• Develop and integrate SAST/DAST pipelines into CI/CD.
• Drive vulnerability remediation prioritization and closure.
• Create threat models for new features and architectures, especially AI data pipelines and multi-tenant boundaries.
• Operate a bug bounty program workflow, triaging reports and guiding fixes.

Skills

Web app security

Python/TypeScript/Go

SAST/DAST tooling

CI/CD security

Threat modeling

Vulnerability remediation

Tools

Semgrep

CodeQL

Snyk

Burp Suite

Job description

Mercor is seeking a Security Engineer to own application security across the development lifecycle. You will review code for exploitable flaws, embed security tooling into CI/CD, and drive remediation for a platform serving 300K+ experts and enterprise clients handling sensitive AI training data.

You’ll work in-person five days a week in our NYC or SF offices, collaborating with researchers, operators, and AI companies at the forefront of AI security.