1 month ago
Base Salary
$130k - $400k/yr
Responsibilities
- Embed security review workflows and PR-level analysis into the software development lifecycle.
- Build and tune SAST/DAST pipelines integrated into CI/CD.
- Create vulnerability management processes based on exploitability and drive findings through verified remediation.
- Develop secure coding standards and guardrails for more than 50 engineers.
- Create threat models for new features and architecture changes, including AI data pipelines, payment flows, and multi-tenant boundaries.
- Operate the bug bounty program by triaging HackerOne reports, validating findings, and driving fixes to closure.
- Use AI tools to accelerate code review, threat modeling, vulnerability analysis, and security automation.
Requirements
- Find and fix real vulnerabilities in production applications rather than only running scanners.
- Have deep web application security knowledge, including OWASP Top 10, attack chains, and business logic flaws.
- Be strong in at least one of Python, TypeScript, or Go.
- Have experience building or tuning SAST/DAST tooling such as Semgrep, CodeQL, Snyk, or Burp.
- Understand modern web frameworks, APIs, and authentication patterns well enough to threat model them.
- Have experience managing vulnerability pipelines from discovery through prioritization and verified remediation.
- Have at least 5 years of professional experience in application security, security engineering, or software engineering with a strong security focus.
- Bonus qualifications include bug bounty operations with HackerOne or Bugcrowd, penetration testing, AI/ML application security, supply chain security, custom security tooling, open source security contributions, or published vulnerability research.
Benefits
- Bi-annual performance bonus structure.
- Generous equity grant vested over four years.
- Up to $15,000 relocation bonus.
- $10,000 housing bonus for employees living within 0.5 miles of the office.
- $1,500 monthly meal stipend.
- Free Equinox membership.
- $200 monthly laundry reimbursement.
- $200 monthly personal wellness reimbursement.
- Health, dental, and vision insurance.
- In-person work five days per week in San Francisco, New York City, or London, with first Fridays remote.
Tech Stack
Categories
About Mercor
Mercor builds an expert-powered platform that trains, evaluates, and deploys AI systems for AI labs and enterprises. It operates APEX to assess model performance on economically valuable tasks, and provides services such as custom AI agents and teams of vetted domain experts who encode organizational knowledge into AI. Founded in 2023 and headquartered in San Francisco, it is privately held and works with frontier AI labs and enterprise clients requiring strict data isolation.