Job Description
Job DescriptionAI-Driven Application Security Triage Engineer
Location: Remote
Hours: 8-hour workday with flexible start times
Pay Rate: $90/hr on W2
Type of Hire: 1-year contract to start; potential extension based on performance
What a Day Looks Like
You start your morning scanning the latest SCA, SAST, and DAST findings. Critical and high-risk items are quickly validated, false positives are filtered out, and you document clear remediation guidance. When a PatchNow Critical event lands, you lead the scope analysis, route owners, and drive mitigation steps through to verified closure. If a threat intelligence escalation appears, you coordinate a fast, structured response.
By midday, you’re drafting concise briefs on newly disclosed and frontier-model-influenced vulnerabilities, translating technical details into action plans for development teams. In the afternoon, you’re hands-on with AI-enabled security tooling—testing frontier-model capabilities for code reasoning, triage acceleration, and remediation recommendations while ensuring auditability, secure use controls, and human-in-the-loop review.
Before you wrap, you reinforce our software supply chain security—from dependency hygiene (SBOM visibility, malicious package detection, policy enforcement) to safeguarding developer IDEs, plugins/extensions, code-assist tools, package managers, and CI integrations against compromised components and unsafe configurations.
Core Responsibilities
- Deliver unified triage across SCA/SAST/DAST findings: validate severity, assess exploitability, analyze false positives, and provide actionable fixes and escalations for production and business-critical apps.
- Coordinate responses to threat intelligence escalations and PatchNow Critical events, including scoping, owner routing, mitigation guidance, tracking, and closure verification.
- Monitor and analyze newly disclosed and novel vulnerabilities—especially those accelerated by frontier-model research—and produce actionable remediation briefs.
- Engineer, test, and implement AI-assisted security tooling leveraging frontier models for vulnerability identification, code reasoning, triage acceleration, and analyst workflow automation with appropriate guardrails.
- Support evaluation and onboarding of new AI capabilities: proof-of-value execution, security testing, control validation, data handling review, model output evaluation, success metrics, and governance documentation.
- Strengthen software supply chain security: secure open-source dependency intake, SBOM and component visibility, malicious package detection, dependency health assessment, and policy enforcement across dev, pipeline, and artifact workflows.
- Improve developer environment security: harden IDEs, plugins/extensions, package managers, code-assist tools, and CI integrations against malicious code and compromised components.
Must-Have Experience
- 3+ years of code scanning
- 3+ years of open-source scanning
- 3+ years of dynamic and static scanning
Qualifications
- Proven track record triaging SCA/SAST/DAST findings and driving high-severity escalations (threat intel and critical patch events) to remediation and closure.
- Engineering background in scripting, automation, APIs, CI/CD workflows, developer tooling, or security platform integrations.
- Hands-on familiarity with AI-enabled security tools, frontier models, coding assistants, prompt/tool orchestration, model evaluation, or AI governance.
- Experience securing the software supply chain and developer tooling (IDEs, plugins/extensions, package managers, CI/CD integrations) from compromise and malicious code.
- Ability to convert technical vulnerabilities into clear remediation steps, risk summaries, and prioritized recommendations for dev and security stakeholders.
Proficiencies
- Code Scanning
- DAST
- Open-source scanning
- SAST
- SCA
- Dynamic and static scanning
Tools & Technologies
- CI/CD
- Artificial Intelligence