application security engineer for generative AI

Higgsfield AI is a generative AI company developing AI-powered video creation and next-generation creative tools for millions of users and enterprise brands.

• Pentest new web features, APIs, and admin surfaces before release;
• Identify the attack surface of each new feature;
• Hunt authorization flaws across multi-tenant APIs and retest fixes;
• Join design and code reviews early to identify flaws before implementation;
• Turn recurring findings into paved-road standards and automated checks;
• Provide working reproductions to code owners and follow fixes through.

• Proven track record of finding real vulnerabilities in real systems through application security work, bug bounty, or research;
• Ability to read modern codebases, trace bugs to root cause, and discuss fixes with engineers;
• Threat-modeling instinct for identifying weaknesses in designs and architectures before implementation;
• Cloud and container fundamentals sufficient to follow bugs into their infrastructure;
• High agency;
• Working English;
• Nice to have: LLM/agent security research, public research or CVEs, OSWE/CWEE or equivalent hands-on certificates.

• Competitive base salary in USD;
• Equity through participation in the company’s stock option program;
• Relocation from anywhere is provided.