Altruist is seeking a Senior Application Security Engineer (Red Team) to join its Security team. This role follows a hybrid schedule, with three days per week on-site in our San Francisco FiDi or Culver City offices. You will conduct pentesting across web applications, APIs, infrastructure, and mobile apps (Android and iOS) and continuously break security controls to strengthen defenses. You will perform focused authorization and exploitability assessments on high-risk paths, conduct cloud pentests and identity-focused offensive testing, and run purple-team exercises with Detection & Response to help build detections. You will develop and maintain offensive tooling and repeatable testing playbooks, and contribute to phishing and social-engineering assessments. You will document findings with reproducible proofs-of-concept, clear risk ratings, and actionable remediation guidance.

What you’ll bring - 4+ years of experience as an Application Security Engineer; pentesting across web, API, and mobile targets; extensive experience with security assessments; experience with Burp Suite; ability to work independently. - Education: Bachelor's degree in Computer Science or Computer Engineering or Information Security, or equivalent experience. - Technical aptitude: comfortable with modern tech stacks (Java, Spring, Terraform, Kubernetes, etc.). - Personal attributes: ownership, superb communication, resilience, assurance, and creative problem solving.

Bonus points if you bring - Experience in regulated environments (fintech/financial services) - Mobile application pentesting (OWASP

Altruist is seeking a Senior Application Security Engineer (Red Team) to join its Security team. This role follows a hybrid schedule, with three days per week on-site in our San Francisco FiDi or Culver City offices. You will conduct pentesting across web applications, APIs, infrastructure, and mobile apps (Android and iOS) and continuously break security controls to strengthen defenses. You will perform focused authorization and exploitability assessments on high-risk paths, conduct cloud pentests and identity-focused offensive testing, and run purple-team exercises with Detection & Response to help build detections. You will develop and maintain offensive tooling and repeatable testing playbooks, and contribute to phishing and social-engineering assessments. You will document findings with reproducible proofs-of-concept, clear risk ratings, and actionable remediation guidance.

What you’ll bring - 4+ years of experience as an Application Security Engineer; pentesting across web, API, and mobile targets; extensive experience with security assessments; experience with Burp Suite; ability to work independently. - Education: Bachelor's degree in Computer Science or Computer Engineering or Information Security, or equivalent experience. - Technical aptitude: comfortable with modern tech stacks (Java, Spring, Terraform, Kubernetes, etc.). - Personal attributes: ownership, superb communication, resilience, assurance, and creative problem solving.

Bonus points if you bring - Experience in regulated environments (fintech/financial services) - Mobile application pentesting (OWASP