Hark is looking for a hands-on Application Security Engineer (Member of Technical Staff) to help own the security of the software Hark ships. This onsite role in San Jose, CA focuses on practical application security work across backend services, mobile apps, and integrations, including emerging LLM and agent security guardrails.
Role focus
- Own security for new features and services through threat modeling, with emphasis on agent and LLM attack surfaces such as prompt injection, tool misuse, data exfiltration, and cross-tenant access.
- Review code and designs across Hark backend services (primarily Go), APIs, and mobile apps, and fix vulnerabilities directly when it is faster than filing a ticket.
- Secure authentication, authorization, and session handling across the consumer product, including OAuth integrations with third-party platforms.
- Build and tune SAST, dependency, and secrets scanning in CI to ensure findings are high-signal and actionable for developers.
- Triages and remediate findings from pentests and Hark’s vulnerability disclosure program.
- Partner with engineering to embed security into the development lifecycle using secure defaults, paved roads, and reusable libraries.
What you bring
- 4–8 years of hands-on application or product security engineering experience.
- Strong software engineering fundamentals, with ability to read, write, and ship production code. Go is strongly preferred, with Python, TypeScript, Swift, or Kotlin also valuable.
- Deep understanding of web and API vulnerability classes and root-cause remediation, including OWASP Top 10, SSRF, IDOR/BOLA, authorization flaws, and injection.
- Hands-on experience securing OAuth 2.0 / OIDC, session management, and multi-tenant systems.
- Experience running secure code review and threat modeling in a fast-moving engineering environment.
- Ability to turn scanner and runtime findings into fixes using tools such as Wiz Code, Wiz Cloud, and Datadog SIEM (or equivalent SAST/SCA, CNAPP, and SIEM tools).
- Genuine curiosity about LLM and agent security, with motivation to explore new defensive approaches.
Technologies
Go, Python, TypeScript, Swift, Kotlin, OAuth 2.0, OIDC, SAST, dependency scanning, secrets scanning, Wiz Code, Wiz Cloud, Datadog SIEM, OWASP Top 10, SSRF, IDOR/BOLA, CNAPP, SIEM.
Bonus qualifications
- Experience at a security-forward product company (Stripe, Coinbase, Discord, Roblox, Netflix) or an offensive security consultancy (Trail of Bits, Bishop Fox, NCC Group).
- Mobile application security experience (iOS/Android).
- Prior work on LLM/agent threat modeling, prompt injection defenses, or AI red teaming.
- Bug bounty, CVE, or open source security contributions.
Compensation
- US base salary range (full-time): $150,000 - $300,000 per year.
- Pay may vary based on job-related knowledge, skills, and experience.
- Total compensation may include additional components and benefits depending on the specific role.
