Senior Application Security Engineer

Sola's security team is looking for a Senior Security Engineer to own product and application security end to end, from threat modeling and secure design through deep code review, our private bug bounty program, and the security of our AI and agentic systems. Sola builds an AI platform that security teams point at their own stack, which means researchers look at us closely and customers ask hard questions.

The role is broad, and that is the appeal. One moment you are working through a bug with the developers, the next you are analyzing an incident, and the following morning you are in a design review advising on what matters for security. We are looking for someone with wide knowledge who is comfortable wearing several hats: real depth in one area, and the curiosity to get up to speed quickly on the rest.

You will work as part of Sola's security team, with the opportunity to take on wider responsibilities than a narrowly defined role would allow. We are looking for someone who collaborates easily, with the team and with R&D, and who can carry a mission end to end on their own expertise, from the first design conversation through to the fix in production.

What you'll do

• Lead threat modeling, secure design reviews, and penetration testing for Sola products and services, from the app to cloud services, APIs, and internal platforms.
• Perform deep code review and manual testing on high-risk systems, using AI-assisted review processes and covering the areas automated tooling cannot fully reach.
• Build and operate security automation. Use and extend AI-assisted tooling for continuous code review, finding triage, and automated penetration testing, and step in where human judgment is required.
• Secure Sola's AI and agentic systems. Assess AI-native products, LLM integrations, and agent workflows for the risks specific to them.
• Partner with engineering teams to drive remediation, turning recurring findings into guardrails, secure defaults, and paved paths.
• Run our private bug bounty program, from triage and severity through to a landed fix with R&D.
• Own WAF rule design and tuning, balancing coverage against false positives on live traffic.
• Investigate and respond to application security incidents, including root cause analysis and durable corrective action.
• Contribute to Sola's secure development lifecycle and to our compliance work.

Requirements

What you have

• At least 5 years of hands-on experience in application security, product security, security engineering, DevSecOps, or a closely related field.
• Strong command of secure coding and common vulnerability classes, across the OWASP Top 10 and well beyond it.
• Hands-on secure development experience across several languages.
• Practical penetration testing, security assessment, and vulnerability management experience with standard tooling and manual techniques alike.