Application Security Engineer
Theori
Application Security Engineer
Theori
Offensive security consulting, training, and STaaS
We're looking for a hands-on Cyber Security Engineer to sit at the intersection of AI-driven tooling and real-world security research. In this role, you'll own the end-to-end triage and validation lifecycle for vulnerability reports generated by our AI-powered static analysis platform, separating true positives from noise, writing proof-of-concept exploits, and reporting vulnerabilities upstream to the appropriate vendor.
This is a deeply technical role built for someone who thinks like an attacker, thrives in ambiguous environments, and has a track record of finding and exploiting vulnerabilities.
Triage and validate vulnerability reports produced by our AI static analysis tool, verifying severity, exploitability, and business impact
Write proof-of-concept exploits for critical vulnerabilities to confirm true positives
Analyze false positives to identify patterns and provide structured feedback to engineering
Author detailed vulnerability reports that will be submitted to upstream vendors and open source projects
Experience in a security engineering, vulnerability research, or penetration testing role
Demonstrated CTF experience through participation in competitive CTFs (e.g. DEFCON, PlaidCTF) with writeups
Hands-on real-world vulnerability research and exploitation experience is preferred
Proficiency reading and auditing code across multiple programming languages
Prior bug bounty participation is preferred
Based in US or Canada
Theori is a cybersecurity firm that uses an attacker’s perspective to identify and fix threats for government and commercial clients. Its offerings include AI-powered application security testing (Xint), AI-model security (αprism), and real-world hacking simulations via Dreamhack, along with consulting services such as penetration testing, code audits, and APT simulations, plus Security Team as a Service that embeds experts in a client’s operations. The company also streams threat intelligence and tooling like Fermium-252, PatchDay, and ChainLight to provide proactive testing, threat data, and security audits. Theori differentiates itself through a CMU hacker pedigree with a track record in competitions and by combining hands-on testing, threat intelligence, and embedded security talent into a single, repeatable security program with ongoing coverage. The goal is to help clients stay ahead of digital threats by delivering practical testing, insights, and continuous security support.
Explore more opportunities at Theori