Contract work for application security engineers. You build small apps with planted vulnerabilities or secure fixes around OWASP LLM risks, write deterministic tests and hidden answer keys, and help keep the security evaluation pipeline realistic. Your security knowledge is what counts; no prior AI work is needed.
What you will do
- Design and build small application fixtures with embedded vulnerabilities or secure solutions, aimed at OWASP LLM risks such as Sensitive Information Disclosure and Excessive Agency.
- Write deterministic test cases and security-context manifests that assess an application's security posture.
- Create detailed hidden answer keys so vulnerable and secure code can be scored accurately.
- Review and refine the pipeline so tasks and fixtures stay challenging but realistic.
- Document findings and methods clearly, review peer work, and contribute to agent-based security architecture.
Ideal background (all nice to have)
- Extensive experience, ideally 5+ years, in application security, secure software development or CyberSWE roles.
- Strong understanding of OSWE, LLM security, AI-powered static analysis (AI-SAST) and AppSec best practice.
- A track record designing or reviewing security architecture for traditional and agent-based applications.
- Skill in building, securing and testing codebases, including finding and fixing advanced vulnerabilities.
- Exceptional written and spoken communication.
- Experience with synthetic security fixtures and deterministic testing, which is highly desirable.
- Shown ability to give thoughtful insights and practical security recommendations while working remotely.
How pay works
The listed rate is $40-80 per hour, on a contractor basis.
Apply (opens in a new tab)