Security Engineer (Application Security)

Join Trail of Bits, a leading cybersecurity firm, as a Security Engineer I in our Application Security practice. In this role, you will conduct security assessments of client software, identify vulnerabilities, and drive your own vulnerability analysis. You will work hands-on with complex code, build custom tooling, conduct threat modeling, and own your findings through client delivery. This is an early-career role for candidates with relevant experience in application security, vulnerability research, or security-focused software engineering.

• Contribuer aux évaluations de sécurité des logiciels des clients, identifier les vulnérabilités et posséder des parties clairement définies des engagements clients.
• Diriger votre propre analyse de vulnérabilité, développer des outils en collaboration avec l'équipe et aider les clients à comprendre et à corriger les problèmes que vous trouvez.
• Posséder l'analyse d'un composant, d'un module ou d'un système spécifique dans le cadre d'un engagement client plus large, tracer les causes profondes et posséder votre analyse de la découverte à la livraison au client.

• At least 1 year of combined relevant experience in application security, vulnerability research, security-focused software engineering, or a closely related area. This experience may come from employment, internships, advanced coursework, independent research, open-source contributions, CTFs, or substantial personal or academic projects
• Working knowledge of memory-corruption vulnerabilities and common mitigations, such as buffer overflows, use-after-free, stack cookies, ASLR, NX/DEP, CFI, or MTE, including the ability to reason about exploit primitives at an appropriate early-career level
• Ability to independently investigate a well-scoped problem, debug issues, document evidence, ask focused questions when blocked, and deliver work with review from a project lead
• Familiarity with operating-system concepts, IPC, privilege boundaries, and the ways applications interact with system internals
• Strong code-analysis skills. You can read unfamiliar code, trace execution and data flow, identify logic or implementation flaws, and distinguish a tool signal from a validated vulnerability
• Clear written and verbal communication, including the ability to explain technical findings and remediation guidance to software engineers and work productively on a distributed team
• Demonstrable vulnerability-discovery capability. You can talk through a vulnerability or security weakness you personally found or validated, including how you identified it, established its impact, and reached your conclusion. Evidence may come from professional work, coursework, projects, CTFs, CVEs, bug bounties, responsible disclosure, open source, or comparable research
• Hands-on coding proficiency in at least two relevant languages, such as Rust, Go, C, C++, Python, JavaScript, TypeScript, or similar languages used in security analysis and tool development
• These are not day-one requirements, but areas where the role can grow
• Active or recent CTF participation, competition results, or comparable hands-on security challenges
• Published vulnerability research, CVEs, responsible disclosures, bug bounty findings, or security writeups
• Contributions to open-source security tools, libraries, or research
• Experience with mobile application security, mobile system internals, or binary analysis on mobile platforms
• Experience assessing cloud platforms or infrastructure and working with tools such as Kubernetes, Helm, Terraform, or Ansible
• Experience with kernel code, drivers, reverse engineering, fuzzing, or other low-level systems work
• Published technical writing, conference talks, or substantial technical documentation