Application Security Engineer

EvalLabs; San Francisco (CA); Remote; USD 91,000 - 129,000; Full time

Job summary

EvalLabs is seeking experienced application security engineers for remote contract work on your schedule. You will work on real-world security scenarios, review technical content, and write expert-level examples based on how work is actually done in the field.

This project-based work helps train and evaluate AI models on security, with no AI experience required. The role offers up to $80/hr and flexible hours (5–20 hrs/week), fully remote and asynchronous.

Qualifications

• 3+ years of professional experience in application security, web/API testing, or secure code review.
• Hands-on experience with Burp Suite, OWASP ZAP, Semgrep, sqlmap, Postman, or ffuf.
• Contract-based project work with remote, flexible scheduling.

Responsibilities

• Work on real-world security scenarios: attack paths, exploitation, detection, and analysis.
• Review technical security content for accuracy and catch what's wrong or missing.
• Write expert-level examples based on how work is actually done in the field.

Skills

Security testing

Threat modeling

Analytical thinking

Tools

Burp Suite

OWASP ZAP

Semgrep

sqlmap

Postman

ffuf

Job description

If you test web apps and APIs and know the OWASP Top 10 inside out, we want your expertise on real-world appsec scenarios. EvalLabs is hiring experienced application security engineers for remote contract work on your schedule.

What you'll do

• Work on real-world security scenarios: attack paths, exploitation, detection, and analysis
• Review technical security content for accuracy and catch what's wrong or missing
• Write expert-level examples based on how the work is actually done in the field

This is project-based work that helps train and evaluate AI models on security. No AI experience needed. We want your security judgment.

The deal

• Up to $80/hr, paid per hour worked
• Fully remote and async, with no meetings or set schedule
• 5–20 hrs a week, no minimum, so it fits next to a full-time job

You have

• 3+ years of professional experience in application security, web/API penetration testing, or secure code review
• Hands-on experience with tools like Burp Suite, OWASP ZAP, Semgrep, sqlmap, Postman, or ffuf
• Nice to have: OSCP, OSEP, OSWE, CPTS, GPEN, GXPN, or similar