Senior Application Security Engineer - Red Team (Hybrid/Remote)

Altruist; San Francisco (CA); Hybrid; USD 200,000 - 240,000; Full time

Benefits offered by this job

Office locations: SF & Culver City

Competitive total compensation

Premium health/dental/vision insurance

401k with 4% match

Parental leave (16 weeks)

Learning & development budget

Employee mobility program

Work-from-anywhere policy

Job summary

Altruist is seeking a Senior Application Security Engineer to join our security team for hybrid work in San Francisco or Culver City. You will continuously test our web, API, mobile, and cloud environments, acting as a real adversary to improve defenses.

You will deliver actionable findings, develop offensive tooling, and collaborate with Detection & Response. The role requires 4+ years in application security and a strong independent work ethic.

Qualifications

• 4+ years of experience as an Application/Security Engineer with pentesting across web, API, and mobile targets
• Extensive experience with security assessments
• Experience with Burp Suite
• Strong ability to work independently

Responsibilities

• Pentest the Altruist web application, APIs, infrastructure, Android and iOS apps
• Break security controls and document findings with risk ratings
• Perform focused authorization and exploitability assessments on high-risk paths
• Conduct cloud pentests and identity-focused testing
• Run purple-team exercises with Detection & Response and develop detections
• Develop offensive tooling and repeatable testing playbooks; contribute to phishing and social-engineering assessments
• Document findings with reproducible proofs-of-concept and remediation guidance

Skills

Web pentesting

API pentesting

Mobile pentesting

Security assessments

Burp Suite

Education

B.S. in CS/CE/InfoSec

Tools

Java

Spring

Terraform

Kubernetes

Job description

Altruist is seeking a Senior Application Security Engineer to join our security team for hybrid work in San Francisco or Culver City. You will continuously test our web, API, mobile, and cloud environments, acting as a real adversary to improve defenses.

You will deliver actionable findings, develop offensive tooling, and collaborate with Detection & Response. The role requires 4+ years in application security and a strong independent work ethic.