Staff Application Security Engineer

Engineering at Brex Engineering at Brex is about building systems that scale with speed and intention. Our teams span Software, Data, Security, and IT, and operate with high autonomy and deep collaboration. We tackle hard technical problems, own our outcomes, and push for excellence at every level — from architecture to deployment. It’s an environment where engineering is a craft, and builders become leaders. What you’ll do As a Staff Application Security Engineer, you will define the technical vision and long-term security architecture for the Brex platform. You will serve as the technical leader for the Application Security team, driving the strategic direction of our secure product lifecycle and vulnerability management programs. This role is highly cross-functional, requiring you to establish deep, collaborative connections across the broader engineering organization to embed security seamlessly into high-velocity development pipelines. We're looking for individuals with a solid foundation in penetration testing and a curiosity for finding vulnerabilities in complex systems. You should have experience identifying and documenting vulnerabilities across common vulnerability classes and be able to communicate their risk clearly to engineering and product teams. Brex is pioneering the next wave of AI-driven financial services for dynamic, high-impact companies like Coinbase, Robinhood, and Anthropic. As we integrate AI across our product suite, you will be at the forefront of securing our novel AI implementations, identifying emerging attack vectors in agentic-powered features, and hardening distributed LLM architectures. You will mentor team members, raise the technical bar for the organization, and partner with product and engineering leaders to build AI capabilities our customers can trust with their critical financial operations. Where you’ll work This role will be based in our San Francisco office. We are a hybrid environment that combines the energy and connections of being in the office with the benefits and flexibility of working from home. We currently require 3 days per week in the office - Monday, Wednesday and Thursday. As a perk, we also have up to four weeks per year of fully remote work! Responsibilities: Lead the technical vision and strategic roadmap for the Application Security team, aligning security objectives with Brex's enterprise growth and high-velocity engineering metrics. Establish technical standards and secure defaults across the entire engineering organization, fostering a culture of collaborative security excellence and bridging product platforms, infra, and trust. Architect and secure novel AI/ML and agentic workflows, applying cutting-edge practices to mitigate risks such as prompt injection, model manipulation, and data poisoning. Mentor and coach engineers within the team and across the broader organization, guiding technical growth, helping individuals level up their security expertise, and accelerating team delivery. Drive proactive vulnerability discovery and offensive security testing strategies, executing complex attack chains to demonstrate business impact and prioritize cross-functional remediation. Partner with Product Platform, Cloud Infrastructure, and Data engineering teams to ensure core primitives, APIs, and microservices are secure by default from design to deployment. Requirements: 8+ years of experience in Application Security, Product Security, or software engineering with a primary focus on offensive and defensive application security. Proven track record of technical leadership and team mentorship on complex, multi-quarter security engineering initiatives in a fast-paced environment. Deep proficiency and technical expertise in AI security, including hands-on experience securing agentic architectures, LLM gateways, and evaluating adversarial AI vectors. Strong systems-thinking capabilities with extensive experience defining secure product development lifecycles, threat modeling complex topologies, and cloud-native container security (AWS, Kubernetes). Proficiency in Python, Go, or similar languages to architect internal tooling, pipeline automation, and advanced detection/scanning engines. Exceptional written and verbal communication skills, with a demonstrated ability to navigate ambiguity, influence technical leaders, and manage up and out across EPD organizations. Bonus Points: Experience with Kotlin, gRPC, GraphQL, Kubernetes Previous experience in building and scaling security teams Experience with securing distributed systems in AWS and cloud environments Contributions to the wider technical community — open source, public research, CTF participation, blogging, CVEs, or presentations Experience submitting to bug bounty or responsible disclosure programs Published AI security research or contributions to AI security frameworks Compensation: The expected salary range for this role is $240,000 USD - $300,000 USD. However, the starting base pay will depend on a number of factors including the candidate’s location, skills, experience, market demands, and internal pay parity. Depending on the position offered, equity and other forms of compensation may be provided as part of a total compensation package.

Lead the technical vision and strategic roadmap for the Application Security team, aligning security objectives with Brex's enterprise growth. Drive proactive vulnerability discovery and offensive security testing strategies while mentoring team members.

Candidates should have 8+ years of experience in Application Security or related fields, with a strong focus on offensive and defensive security. Deep proficiency in AI security and experience with cloud-native security practices are essential.

Identified from the job description. Confirm important requirements above.

• Application Security
• Product Security
• Software Engineering
• Technical Leadership
• Team Mentorship
• AI Security
• Threat Modeling
• Cloud Security
• Python
• Go
• Vulnerability Management
• Penetration Testing
• Collaboration
• Communication
• Offensive Security
• Distributed Systems

• Technology
• Engineering
• Security & Safety

Minimum experience

10+ years

Posting language

English

Working hours

40 hours per week

Office presence

3 days per week

Application method

Direct apply is available