Application Security Engineer

The role

You will pentest new features and products including web, APIs, and admin surfaces. You will work out attack surfaces, hunt authorization flaws, and join design and code reviews.

What you will do

• Pentest new features and products pre-release including web, APIs, and admin surfaces
• Work out the attack surface of each new feature
• Hunt authorization flaws across multi-tenant APIs and retest fixes
• Join design and code reviews early
• Turn recurring findings into guardrails, paved-road standards and automated checks
• Bring a working repro to the team that owns the code and see the fix through

Required qualifications

• A track record of finding real vulnerabilities in real systems
• The ability to read modern codebases, trace a bug to root cause, and discuss the fix with engineers
• A threat-modeling instinct for spotting weak spots in design or architecture
• Cloud and container fundamentals
• High agency
• Working English

Nice to have

• LLM/agent security research
• Public research or CVEs
• OSWE/CWEE or equivalent hands-on certificates

Benefits

• Competitive base salary in USD
• Equity participation in the company's stock option program
• Relocation from anywhere

About the company

Higgsfield AI is a generative AI company building AI-powered video creation and next-generation creative tools.