Remote Security Engineer II - App Security & Tooling

Trail of Bits; United States; Remote; USD 140,000 - 180,000; Full time

Benefits offered by this job

Health insurance

Fully company-paid insurance packages

401(k) with 5% match

20 days PTO

Parental leave (4 months)

Relocation assistance to NYC ($10,000)

Working-from-Home stipend ($1,000)

Learning & Development stipend ($750)

Team celebrations with travel

Philanthropic matching

Job summary

Trail of Bits is seeking a Security Engineer II for its Application Security practice. You will conduct security assessments of client software, own substantial components, identify vulnerabilities, and develop tooling alongside the team.

This hands-on, autonomous role bridges vulnerability research with applied security and involves communicating findings to clients. You will collaborate with a project lead and other security engineers, delivering clear findings with limited day-to-day

Qualifications

• Typically 2+ years of directly relevant experience in application security, vulnerability research, security-focused software engineering, or related area.
• Proven vulnerability-discovery experience and ability to discuss exploitation paths and impact.
• Strong code-analysis skills across unfamiliar and complex codebases.
• Proficiency in at least two languages such as Rust, Go, C, C++, Python, JavaScript or TypeScript.
• Working knowledge of memory-corruption vulnerabilities and mitigations.
• Strong systems knowledge including OS, IPC, privilege boundaries, and how apps interact with the platform.
• Ability to independently scope and execute a code-level security-assessment workstream.
• Clear written and verbal communication, including presenting to software engineers or clients.

Responsibilities

• Lead assessments of substantial components, modules, or systems from scoping to delivery.
• Find and validate vulnerabilities, establish root causes and exploitation paths.
• Design and build targeted tools to expand assessment coverage.
• Review architectures, map data flows, identify attack surfaces and mitigations.
• Communicate findings clearly to client engineers and defend evidence.
• Review peers' code and techniques to improve the team’s approach.
• Contribute to research, open-source tools, and technical writing.

Skills

Vulnerability discovery

Code analysis

Rust

Go

C/C++

Python/JavaScript/TypeScript

Memory corruption concepts

Systems knowledge

Communication

Tools

Kubernetes

Terraform

Ansible

Job description

Trail of Bits is seeking a Security Engineer II for its Application Security practice. You will conduct security assessments of client software, own substantial components, identify vulnerabilities, and develop tooling alongside the team.

This hands-on, autonomous role bridges vulnerability research with applied security and involves communicating findings to clients. You will collaborate with a project lead and other security engineers, delivering clear findings with limited day-to-day