Security Engineer I

About The Company Founded in 2012 by three expert hackers with no initial investment capital, Trail of Bits has established itself as a leading authority in cybersecurity. Our mission is to advance security through innovative research and practical solutions, helping some of the world's most targeted organizations protect their systems and data. We combine cutting-edge research with real-world applications to reduce security risks associated with emerging technologies. Our efforts drive industry standards and enhance public understanding of the underlying security principles that safeguard our digital environment. As a pioneer in the field, Trail of Bits recognizes that cybersecurity is a constantly evolving landscape. We stay at the forefront by providing tailored, proactive security measures that keep our clients ahead of potential threats. Our commitment to democratizing security information is reflected in our ongoing initiatives—blogs, whitepapers, newsletters, meetups, and open-source tools—aimed at elevating community knowledge and fostering a collective defense against cyber threats. About The Role Trail of Bits is seeking a Security Engineer I to join our Application Security practice. This position offers an exciting opportunity for early-career professionals to engage in hands-on security assessments, vulnerability research, and tool development. As a Security Engineer I, you will collaborate with experienced engineers to analyze client software, identify vulnerabilities across application and system levels, and deliver clear, actionable findings. You will own specific segments of client engagements, from discovery to remediation, and contribute to the development of custom security testing tools. This role uniquely combines vulnerability research with applied security engineering. It involves analyzing complex codebases, building automation tools, conducting threat modeling, and communicating technical findings effectively to client engineering teams. While this is an early-career position, it requires demonstrable experience in code-level security work, whether through professional roles, internships, open-source contributions, or independent projects. You will work under the guidance of project leads but are expected to independently investigate and resolve well-scoped security issues. Qualifications At least 1 year of relevant experience in application security, vulnerability research, or security-focused software engineeringProven ability to discover and validate security vulnerabilitiesStrong code analysis skills, including reading unfamiliar code and tracing execution/data flowHands-on proficiency in at least two programming languages such as Python, C, C++, Rust, Go, JavaScript, or TypeScriptKnowledge of memory corruption vulnerabilities and mitigations (buffer overflows, ASLR, NX/DEP, etc.)Understanding of operating system concepts, IPC, privilege boundaries, and system internalsAbility to independently investigate problems, debug, document findings, and deliver work with reviewExcellent written and verbal communication skills for technical and non-technical audiences Responsibilities Lead security assessments of specific components or modules within client projectsIdentify, validate, and explain vulnerabilities in application code and systemsDevelop proof-of-concept exploits when necessary to demonstrate impactDesign and implement custom security testing tools and automation scriptsReview software architecture, identify attack surfaces, and recommend mitigationsTranslate technical security findings into clear, actionable guidance for engineering teamsContribute to security research, open-source tools, and internal documentationEngage in threat modeling exercises to assess risks and suggest improvements Benefits Competitive salary with performance-based bonusesFully paid health, dental, vision, disability, and life insurance401(k) plan with a 5% company match20 days of paid vacation, with flexibility for additional daysFour months of parental leave to support new family membersRelocation assistance of $10,000 for those moving to NYCHome office stipend of $1,000 to enhance remote work setupAnnual learning and development stipend of $750Company-sponsored team events, including travel and accommodationsPhilanthropic matching contributions up to $2,000 annually Equal Opportunity Trail of Bits is an equal‑opportunity employer. We consider all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, veteran status, disability, or any other characteristic protected by law. We are committed to fostering an inclusive environment and providing reasonable accommodations throughout the hiring process to ensure equal access for all candidates.