Job Overview
Job description
- Salary:
- USD 500 per day
- Location:
- Almaty, Kazakhstan
- Work arrangement:
- On-site
Role Summary
Break new features before they ship: agentic systems, MCP servers, code-generating agents, user-deployed apps, generative models for image, video, and voice, and enterprise features (SSO, org and team management, roles). It's new ground, and you'll help define how we secure it. You go first.
Responsibilities
- Pentest new features and products pre-release: web, APIs, admin surfaces.
- Work out the attack surface of each new feature yourself.
- Hunt authorization flaws across our multi-tenant APIs and retest fixes.
- Join design and code reviews early, so flaws die before they're built.
- Turn recurring findings into guardrails — paved-road standards and automated checks — so a bug class dies once instead of resurfacing every release.
- Bring a working repro to the team that owns the code and see the fix through.
Requirements
- A track record of finding real vulnerabilities in real systems — appsec work, bug bounty, or research.
- The ability to read modern codebases, trace a bug to root cause, and discuss the fix with the engineers who wrote it.
- A threat-modeling instinct for spotting the weak spots in a design or architecture before a line is written.
- Enough cloud and container fundamentals to follow a bug into the infrastructure it runs on.
- High agency.
- Working English.
Nice to have
- LLM/agent security research, public research or CVEs, OSWE/CWEE or equivalent hands-on certificates.
Benefits
- Competitive base salary in USD
- Equity: participation in the company’s stock option program, giving you the opportunity to share in the company’s long-term growth.
- On-site role in our Almaty office (we will relocate you from anywhere).
About the Company
WHY WORK AT HIGGSFIELD AI?
We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like.
- Role:
- Application Security Engineer
- Job Type:
- FullTime
Company profile
higgsfieldai
higgsfield.aiHiggsfield AI is an AI-native creative suite that lets creators, brands, marketing agencies and filmmakers generate images, videos and voice content from text prompts or references. Its platform offers 30+ models and 40+ creative AI tools, including face swap, virtual try-on and a cinema studio, along with editing, upscaling and an AI agent that automates creative workflows on web and mobile. The San Francisco company is backed by Accel, Menlo Ventures, GFT Ventures and AI Capital Partners at a valuation of over $1.3 billion and reports 25M+ users worldwide.
- Headquarters
- San Francisco, California, United States
- Founded
- 2023
- Founders
- Alex Mashrabov
- Key Investors
- Accel, Menlo Ventures, GFT Ventures, AI Capital Partners
