(470) 443-4800Get a demo
All roles

Security

AI and Application Security Engineer

Full-timeRemoteMultiple openingsReports to: Product Security Manager

Keep our AI agents, our product and our clients’ accounts safe, hands on, from the code to every agent run.

Apply

About SpareBrains

SpareBrains helps small and medium-sized businesses run better. A team of people and AI agents does real work for them. It finds where they’re losing customers online, fixes it, and keeps it running week after week. Our agents work inside our clients’ own accounts and tools, always with the owner’s approval. That makes trust the heart of what we sell.

The role

You’ll be a hands-on engineer on our security team, working with the Product Security Manager. Our agents act inside clients’ real accounts, so this work matters every day. You’ll make sure each agent can do only what it should, and that every action is logged. You’ll also stop attacks hidden in the pages and messages agents read.

What you’ll do

Agent security

  • Build the controls on what each agent may do: scoped permissions, approval steps and limits.
  • Isolate agent runs in sandboxes, and monitor them for anything unusual.
  • Defend against prompt injection and tool misuse, and red-team our agents before each release.

Credentials and access

  • Build how agents get scoped, time-limited, auditable access to client accounts.
  • Manage secrets, review access for people and agents alike, and remove it promptly.

Application security

  • Threat-model new features with engineers, and review designs and code.
  • Run security scanning in our build pipeline, and build safe defaults into shared code.
  • Find and fix weaknesses across our web app, APIs and cloud setup.

Response and trust

  • Handle vulnerability reports, and help run incident response.
  • Help answer client security questionnaires, and gather evidence for SOC 2 when we pursue it.

What you’ll bring

  • 5+ years in software or security engineering, with at least 2 in application or product security.
  • Strong coding in Python, Go or TypeScript.
  • Solid application security: the OWASP Top 10, secure code review and threat modelling.
  • Cloud security, and identity and access management.
  • Working knowledge of how large-language-model apps fail, including prompt injection.
  • Clear explanations of risk for engineers, executives and business owners.

You don’t need every item on this list. If the work excites you, apply anyway.

Nice to have

  • Red teaming of AI systems, or published research, CVEs or bug-bounty credits.
  • Securing OAuth flows, tokens and access for non-human identities.
  • Having helped a startup through SOC 2.

What we offer

A competitive base salary, equity, and the chance to build SpareBrains from its first day.

How to apply

Send your name, your email and your resume, with links to your work if you like. No cover letter needed.

Apply

Interview process

  1. Intro call. 30 minutes with our founder on the role, your work and your questions.
  2. Role interview. A deeper conversation about how you’d do the job, and the work you’ve done.
  3. Working session. We work through a real problem together, with any tools you like, AI included.
  4. References and offer. We speak to people you’ve worked with, then send the offer in writing.