Staff Application Security Engineer

Requirements: 8+ years of experience in Application Security, Product Security, or software engineering with a primary focus on offensive and defensive application security. Proven track record of technical leadership and team mentorship on complex, multi-quarter security engineering initiatives in a fast-paced environment. Deep proficiency and technical expertise in AI security, including hands-on experience securing agentic architectures, LLM gateways, and evaluating adversarial AI vectors. Strong systems-thinking capabilities with extensive experience defining secure product development lifecycles, threat modeling complex topologies, and cloud-native container security (AWS, Kubernetes). Proficiency in Python, Go, or similar languages to architect internal tooling, pipeline automation, and advanced detection/scanning engines. Exceptional written and verbal communication skills, with a demonstrated ability to navigate ambiguity, influence technical leaders, and manage up and out across EPD organizations. Bonus Points: Experience with Kotlin, gRPC, GraphQL, Kubernetes Previous experience in building and scaling security teams Experience with securing distributed systems in AWS and cloud environments Contributions to the wider technical community — open source, public research, CTF participation, blogging, CVEs, or presentations Experience submitting to bug bounty or responsible disclosure programs Published AI security research or contributions to AI security frameworks Compensation: The expected salary range for this role is $240,000 USD - $300,000 USD. However, the starting base pay will depend on a number of factors including the candidate’s location, skills, experience, market demands, and internal pay parity. Depending on the position offered, equity and other forms of compensation may be provided as part of a total compensation package. Please be aware, job-seekers may be at risk of targeting by malicious actors looking for personal data. Brex recruiters will only reach out via LinkedIn or email with a brex.com domain. Any outreach claiming to be from Brex via other sources should be ignored.