App Security Engineer II - Lead Assessments (Remote)

Trail of Bits; Northern (KY); Remote; USD 140,000 - 180,000; Full time

Benefits offered by this job

Health insurance

401(k) match

Remote-friendly

Learning stipend

Job summary

Trail of Bits seeks a Security Engineer II for our Application Security practice. You will conduct security assessments of client software, independently own substantial components or workstreams, identify vulnerabilities across the application and system levels, and develop custom tooling alongside the team.

You will own your analysis from discovery through client delivery and help clients understand and fix the issues you find. This role bridges vulnerability research and applied security.

Qualifications

• Typically 2+ years in application security or related area.
• Experience in vulnerability discovery and verification.
• Ability to analyze complex codebases and data flows.
• Experience building security tools and performing threat modeling.

Responsibilities

• Lead assessments of substantial components in client engagements.
• Find and validate vulnerabilities and establish exploitation paths.
• Design and build targeted security tooling and automation.
• Review architectures, identify attack surfaces, and recommend mitigations.
• Communicate findings clearly to client engineers and stakeholders.
• Review others' code and share techniques to improve the team.
• Contribute new methods, open-source tools, and security research.

Skills

Rust

Go

C/C++

Python

JavaScript/TypeScript

Security tooling

Tools

Kubernetes

Helm

Terraform

Ansible

Job description

Trail of Bits seeks a Security Engineer II for our Application Security practice. You will conduct security assessments of client software, independently own substantial components or workstreams, identify vulnerabilities across the application and system levels, and develop custom tooling alongside the team.

You will own your analysis from discovery through client delivery and help clients understand and fix the issues you find. This role bridges vulnerability research and applied security.