Application Security Engineer
The full posting
Why work at Higgsfield AI?
We're the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, and powering 390 of Fortune 500 brands. We’re building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn’t just moving fast, but rewriting what fast looks like.
About the role
Break new features before they ship: agentic systems, MCP servers, code-generating agents, user-deployed apps, generative models for image, video, and voice, and enterprise features (SSO, org and team management, roles). It's new ground, and you'll help define how we secure it. You go first.
What you'll do
- Pentest new features and products pre-release: web, APIs, admin surfaces.
- Work out the attack surface of each new feature yourself.
- Hunt authorization flaws across our multi-tenant APIs and retest fixes.
- Join design and code reviews early, so flaws die before they're built.
- Turn recurring findings into guardrails - paved-road standards and automated checks - so a bug class dies once instead of resurfacing every release.
- Bring a working repro to the team that owns the code and see the fix through.
Requirements
- A track record of finding real vulnerabilities in real systems - appsec work, bug bounty, or research.
- The ability to read modern codebases, trace a bug to root cause, and discuss the fix with the engineers who wrote it.
- A threat-modeling instinct for spotting the weak spots in a design or architecture before a line is written.
- Enough cloud and container fundamentals to follow a bug into the infrastructure it runs on.
- High agency.
- Working English.
Nice to have
- LLM/agent security research, public research or CVEs, OSWE/CWEE or equivalent hands-on certificates.
What we offer
- Competitive base salary in USD
- Equity: participation in the company’s stock option program, giving you the opportunity to share in the company’s long-term growth.
- On-site role in our Almaty office (we will relocate you from anywhere).
Text as Higgsfield AI published it; last compared with the original on 11 Nov 2026.
The application
Your details and CV, then 2 questions.
- 1.Telegram HandleShort answer
- 2.Are you open to relocating to Almaty, Kazakhstan?Yes or no
Taken from Higgsfield AI's application form as it stood on 11 Nov 2026.
The employer: Higgsfield AI
Higgsfield AI makes generative video and image tools for creators; its security engineers protect infrastructure, ML systems and the product from San Francisco and Almaty.
Pay and benefits: Full-time jobs split between the Bay Area and Almaty.
Let security teams come to you
Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.
Hear first when Higgsfield AI posts a security role
We read Higgsfield AI's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.