Security Software Engineer

Franklin Fitch; New York (NY); On-site; USD 140,000 - 210,000; Full time

Job summary

Franklin Fitch is recruiting a Security Software Engineer for a Manhattan, on-site role focused on offensive security for an AI fintech platform. You will break, then fix, by building tooling and engineering fixes to harden the product.

You’ll run continuous red-team testing across web apps, APIs, AI/ML pipelines, and cloud environments, and you’ll translate findings into code changes shipped in the same sprint. A hands-on coder who writes exploits and builds custom tooling will thrive.

Qualifications

• Hands-on penetration testing across web apps, APIs and cloud.
• Written real exploits beyond scanners.
• Experience building offensive tooling and integration into CI/CD.

Responsibilities

• Run continuous penetration testing and red-team assessments across applications, APIs, AI/ML pipelines and cloud environments.
• Build agentic security tooling to find, validate and patch vulnerabilities end to end.
• Develop offensive tooling, exploit chains and attack simulations tailored to an AI platform.
• Test AI-specific attack surfaces: prompt injection, data poisoning, tenant isolation.
• Lead purple-team exercises and coordinate with external pen-test firms through remediation.

Skills

Penetration testing

Web apps

APIs

Cloud security

Rust/Go/Java/C++

Python/Bash tooling

Threat modelling

Exploits development

Tools

Burp Suite

Nuclei

Semgrep

Custom fuzzing

Terraform

Kubernetes

Job description

Security Software Engineer | AI Fintech | Manhattan, on-site

A Series D AI company in New York is hiring a Security Software Engineer to be its in‑house offensive security capability. The company builds an AI platform used by analysts and dealmakers at many of the world’s leading investment banks, private equity firms and investment funds. It has strong product‑market fit, top‑tier venture backing, and a security team that is growing quickly.

The role

This is a hands‑on role for an engineer who breaks things, then builds the fix. You’ll attack the company’s AI platform, APIs and cloud infrastructure before adversaries do, and turn what you find into engineering changes that harden the product at its core.

You won’t be gatekeeping releases with manual reviews. Instead, you’ll build agentic tooling that scales offensive testing, and you’ll contribute directly to the codebase.

What you’ll do

• Run continuous penetration testing and red‑team assessments across the applications, APIs, AI/ML pipelines and cloud environments, not just during annual engagements.
• Build agentic security tooling that finds, validates and patches vulnerabilities end to end, across code review, dependencies and infrastructure as code.
• Develop custom offensive tooling, exploit chains and attack simulations tailored to an AI platform.
• Test AI‑specific attack surfaces, including prompt injection, model manipulation, data poisoning, agent workflows and tenant isolation.
• Hunt for the logic flaws, auth bypasses and chained exploits that scanners miss.
• Run threat‑modelling sessions with engineering, and get fixes shipped in the same sprint.
• Fix critical vulnerabilities yourself, harden authentication and authorisation flows, and build security primitives into the platform.
• Lead purple‑team exercises, and own the relationship with external pen‑test firms through to remediation.

What you’ll bring

• Professional penetration testing across web apps, APIs and cloud, ideally including AI/ML systems. You’ve written real exploits, not just run scanners.
• Development experience in a strongly typed language (Rust, Go, Java or C++), plus Python or Bash for tooling and exploit development.
• Fluency with Burp Suite, Nuclei, Semgrep and custom fuzzing, and the instinct to build your own tools when off‑the‑shelf ones fall short.
• Experience integrating SAST, DAST and SCA into CI/CD so developers get fast, actionable feedback.
• Comfort with Terraform and Kubernetes, and the ability to spot misconfigurations and attack paths in AWS and GCP.
• Working knowledge of threat modelling, cryptography fundamentals and frameworks such as SOC 2, ISO 27001/42001 and NIST CSF.

Bonus

• OSCP, OSWE, GXPN, GWAPT, CPTS or similar certifications
• Cloud pen testing in AWS or GCP: privilege escalation, cross‑account attacks, metadata abuse
• Kubernetes attack experience: RBAC abuse, container escapes, admission controller bypasses
• Testing multi‑tenant SaaS in regulated industries, especially financial services
• Bug bounty record, published CVEs or security research
• Customer‑facing pen‑test debriefs and security architecture reviews