Senior Application Security Engineer (Red Team)

Join Altruist, a fast-growing company in the fintech industry, as a Senior Application Security Engineer. In this role, you will be responsible for continuously attacking our products to ensure their security. You will conduct pentests on various platforms, perform focused assessments on high-risk attack paths, and run purple-team exercises. You will also develop and maintain offensive tooling and testing playbooks, document findings, and provide actionable remediation guidance. Altruist offers competitive compensation, health benefits, and a commitment to inclusivity.

• Conduct penetration testing on various platforms, including web applications, APIs, infrastructure, and mobile applications, to identify vulnerabilities and security weaknesses.
• Develop and maintain offensive security tools and testing playbooks, and contribute to phishing and social-engineering assessments.
• Document findings with reproducible proofs-of-concept, clear risk ratings, and actionable remediation guidance, and run purple-team exercises with Detection & Response.

• We're looking for exceptional talent to help us achieve our mission of making financial advice better, more affordable, and accessible to all. If you're passionate about challenging the status quo and want to do the most important work of your life, we'd love to meet you!
• Ownership - The pride you put into every aspect of your work is unparalleled and undeniable
• Superb communication - Intentional dialogue is a superpower. You listen as well as you share your perspective with others
• Education - A B.A. / B.S. degree in relevant fields such as Computer Science or Computer Engineering or Information Security or relevant experience
• Creative problem solving - Identifying the problem is simply not enough. You’re instinctually creative with your approach in finding solutions to roadblocks
• Experience with tools such as Burp Suite
• Technical aptitude - You’re technologically savvy and can easily get up to speed on modern tech stacks (i.e., Java, Spring, Terraform, Kubernetes, etc.)
• Assurance - Your confidence is brilliant, yet ego-less. You possess a strong knowledge base, the ability to discover the unknown, and are open to differing perspectives
• Extensive experience with security assessments
• Experience - 4+ years of experience working as an Application/Product Security Engineer:
• Experience as a pentester across web, API, and mobile targets
• Resilience - We’re inspired by your unwavering determination to achieve success, no matter the adversity you face along the way
• Strong ability to work independently
• Don’t meet every single requirement? Studies have shown that women and people of color are less likely to apply to jobs unless they meet every single qualification
• Mobile application pentesting (OWASP MASVS) and cloud/red-team / adversary emulation experience
• Relevant certifications (e.g., OSCP, OSWE, GXPN)
• Experience working in regulated environments (fintech / financial services)