Skip to content

AppSec

Senior Software Engineer | AI Security Engineering

NinjaOne logoNinjaOne$140,000–$230,000/yrRemote in Canada, Colombia, United StatesPosted 1w ago

At its midpoint, $185k/yr, this role pays less than the $212k/yr midpoint for Application & Product Security openings today (usual band $175k–$346k/yr).

The full posting

About us

NinjaOne unifies IT to simplify work for nearly 40,000 customers in 140+ countries

The NinjaOne Unified IT Operations Platform delivers endpoint management, autonomous patching, backup, and remote access in a single console to improve efficiency, increase resilience, and reduce spend. By automating IT and managing all endpoints, organizations give employees a great technology experience at work.

NinjaOne is obsessed with customer success and has retained a 98% customer satisfaction score for more than 5 years.

About the Role

NinjaOne’s Application Security Engineering team is looking for a Senior Software Engineer to assist in building an AI platform that discovers vulnerabilities in production code, validates findings against real attack paths, and proposes tested fixes. You will build and own the software that makes this work reliable at scale, partnering with Security Architecture and Product Engineering to turn security research into actionable improvements across our cloud platform and endpoint agents.

This is a hands-on software engineering role with ownership from design through production. You will solve problems in agent orchestration, durable execution, context management, evaluation, and cost control. Your work will help engineers find and fix meaningful vulnerabilities earlier, with evidence they can trust.

We are hiring four engineers across two focus areas: Vulnerability Discovery and Finding Validation, with two openings in each. We will discuss your preference during interviews. Discovery develops and tests vulnerability hypotheses; Validation independently challenges findings and develops evidence-backed fixes. Separate model families and independent ownership help each stage check the other’s conclusions.

Location - We are flexible on remote working from home, if you are located in the USA and reside in one of the following states - CA, CO, CT, FL, GA, *IL, KS, MA, MD, ME, NJ, NC, NY, OH, OR, TN, TX, VA, and WA. We have physical offices in Austin, TX and Tampa, FL, if you prefer a hybrid option.

*Onsite interviews may be required for this role.

We hire the best software engineers, but experience in our stack can’t hurt: NinjaOne is built on Java, Kotlin, C++, Golang and Postgres; supporting millions of user endpoints and running as a scalable cloud service in AWS. Knowing large-scale datastore bottlenecks, asynchronous application design and client-server architecture will help you.

What You’ll be Doing

  • Build and operate a production AI vulnerability platform with resumable workflows, bounded agent execution, model routing, and per-repository budgets across AWS Bedrock and OpenAI-compatible APIs.
  • Engineer repository context, threat models, and coverage tracking so agents can reason about entry points, trust boundaries, tenant isolation, and relevant code paths.
  • Build independent validation, stable finding identity, and deduplication. Ground reachability and exploitability of judgments in code, deployment evidence, and reproducible tests.
  • Develop patch and regression-test workflows that demonstrate a failing test before a fix and a passing test afterward, check for regressions, and require human review before merging.
  • Protect agent execution with sandboxing, least-privilege tool access, and controls for untrusted repository content, prompt injection, secrets, and sensitive data.
  • Partner with security and engineering teams to deliver findings through SARIF and existing workflows. Measure validated finding quality, coverage, reliability, and cost per validated finding; communicate results and share engineering practices.
  • Other duties as needed

About You

  • 8+ years of software engineering experience, including ownership of production services or automation platforms, and hands-on experience building LLM-backed applications or agent workflows.
  • Strong Python skills, including asynchronous concurrency, typing, testing, packaging, and profiling. You can design, ship, debug, and maintain production-quality software.
  • Experience building multi-step workflows with durable state, idempotent retries, task queues, termination conditions, observability, and resource limits. You can explain the failure modes and tradeoffs of systems you have shipped.
  • Hands-on experience with LLM APIs, tool calling, structured outputs, context management, and evaluation. You can assess when to use an agent framework and when simpler orchestration is more reliable.
  • Experience with AWS or comparable cloud infrastructure and distributed systems. Familiarity with model provider integrations, container isolation, and secure handling of code and credentials.
  • Working knowledge of application security, including authentication, authorization, common vulnerability classes, and trust boundaries. You can use evidence to distinguish a plausible hypothesis from an actionable finding.
  • Ability to work through ambiguity, collaborate with product and security engineers, and communicate technical decisions and results to engineering and leadership audiences.
  • Bachelor’s degree in Computer Science, Information Technology, or a related field, or equivalent practical experience.

What You’ll Love

We are a collaborative, kind, and curious community. We honor your flexibility needs with full-time work that is hybrid remote. We have you covered with our comprehensive benefits package, which includes medical, dental, and vision insurance. We help you prepare for your financial future with our 401(k) plan. We prioritize your work-life balance with our unlimited PTO. We reward your work with opportunity for growth and advancement.

Additional Information

This position is NOT eligible for Visa sponsorship. Due to federal government security requirements associated with our FedRAMP-authorized environment, candidates must be U.S. citizens or lawful permanent residents.

*Due to operational policies, NinjaOne is unable to hire for this role within the city limits of Chicago. We will consider all qualified candidates who reside outside of the city proper or are willing to self-relocate.

#LI-MM1 #LI-REMOTE

Starting pay for the successful applicant depends on a variety of job-related factors, including but not limited to location, market demands, experience, job-related knowledge, and skills. The benefits available for this position include medical, dental, vision, 401(k) plan, life insurance coverage and PTO. This position may also be eligible for bonus, commission, equity, or other incentive compensation, as applicable.

Base salary hiring range for roles based in California, Colorado, Maryland, New Jersey, or Washington

$140,000 - $230,000 USD

Starting pay for the successful applicant depends on a variety of job-related factors, including but not limited to location, market demands, experience, job-related knowledge, and skills. The benefits available for this position include medical, dental, vision, 401(k) plan, life insurance coverage and PTO. This position may also be eligible for bonus, commission, equity, or other incentive compensation, as applicable.

Base salary hiring rang for roles based in New York

$140,000 - $230,000 USD

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, marital status, veteran status, or any other status protected by applicable law. We are committed to providing an inclusive and diverse work environment.

Candidate Privacy

When you apply, NinjaOne collects and uses your personal information to review your application and manage the hiring process. To learn how we use, store, and protect your data, and what your rights are, please read our Candidate Privacy Policy at https://www.ninjaone.com/candidate-privacy-policy .

Where you can be based

This position is 100% remote and open to applicants based in Canada, Colombia and United States.

Text as NinjaOne published it; last compared with the original on 12 Nov 2026.

The application

Your details and CV, then 10 questions.

Keep these to handCVCover letter (optional)LinkedIn (optional)
  1. 1.
    Current StateChoose one (52 choices)
  2. 2.
    Current CountryChoose one (250 choices)
  3. 3.
    Have you ever worked at NinjaOne as an employee, contractor, or intern?Choose one: Yes - Former Employee · Yes - Former Contractor · Yes - Former Intern · No - Never employed by NinjaOne
  4. 4.
    What is your expected yearly salary?Short answer
  5. 5.
    Are you legally allowed to work in the country where this job is located?Yes or no
  6. 6.
    Now or in the future, will you need an employer to sponsor your visa or work permit so you can work in the country where this job is located?Choose one: Yes, I need visa sponsorship now. · Yes, I will need visa sponsorship in the future. · No, I do not need visa sponsorship now or in the future.
  7. 7.
    Can you work in the location and workplace type (remote, hybrid, or onsite) listed in the job posting? If the role is fully remote and you can work from where you live right now, select “Yes, I can work this way now."Choose one
  8. 8.
    Can you perform the essential functions of this job, either on your own or with the help of a reasonable accommodation from the company?Yes or no
  9. 9.
    Do you have any agreement with a current or past employer that limits the companies, industries, or locations where you can work? For example, this would include a non-compete or a non-solicitation agreement.Yes or no
  10. 10.
    Can NinjaOne text you updates about your application?Yes or no

Taken from NinjaOne's application form as it stood on 12 Nov 2026.

The employer: NinjaOne

Gives IT teams one console to manage, patch and back up devices; four of its five security openings are remote, mostly across US states.

Pay and benefits: Staff roles, most of them remote in the US, plus one SOC post remote in Germany or the UK.

Other security roles worth a look

A few links on CyberJobs.cc are referral links: when one leads to a hire, a sign-up or a purchase (a lab, a course or a tool marked Partner), the company behind it may pay CyberJobs.cc a fee. You pay nothing extra, and it never changes the salary an employer offers you or which roles the board lists. Roles from partners who pay us a fee rank a little higher in this list.

Let security teams come to you

Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.

Create my profile

Hear first when NinjaOne posts a security role

We read NinjaOne's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.