Senior Application Security Engineer

📋 Job Overview

Application

About Chamelio
Chamelio is revolutionizing legal tech with an AI-powered Legal Intelligence Platform trusted by some of the world's fastest-growing companies including Wiz, Socure, and Monday. We integrate seamlessly with Salesforce and other systems to help in-house legal teams accelerate negotiations, reduce risk, and unlock institutional knowledge through automated workflows. We're solving complex problems at the intersection of AI and legal operations. Join us as we scale our impact globally

About the Role
We're looking for a Senior Application Security Engineer to dive deep into our codebase, infrastructure, and AI systems at Chamelio. We handle some of the most sensitive documents our customers have, and our buyers' security teams scrutinize us accordingly. You'll be our core hands-on security authority: conducting technical vulnerability assessments, performing manual code reviews, leading internal penetration testing, and implementing robust security controls directly across our platform. This is a deeply technical, hands-on role - if you thrive on auditing code, breaking application logic, finding zero-days, and writing security code to patch vulnerabilities, we want to hear from you

🏢 About Chamelio

Chamelio is revolutionizing legal tech with an AI-powered Legal Intelligence Platform trusted by some of the world's fastest-growing companies including Wiz, Socure, and Monday. We integrate seamlessly with Salesforce and other systems to help in-house legal teams accelerate negotiations, reduce risk, and unlock institutional knowledge through automated workflows. We're solving complex problems at the intersection of AI and legal operations. Join us as we scale our impact globally

🎯 The Role

We're looking for a Senior Application Security Engineer to dive deep into our codebase, infrastructure, and AI systems at Chamelio. We handle some of the most sensitive documents our customers have, and our buyers' security teams scrutinize us accordingly. You'll be our core hands-on security authority: conducting technical vulnerability assessments, performing manual code reviews, leading internal penetration testing, and implementing robust security controls directly across our platform. This is a deeply technical, hands-on role - if you thrive on auditing code, breaking application logic, finding zero-days, and writing security code to patch vulnerabilities, we want to hear from you

✅ Key Responsibilities

• Perform hands-on application security reviews, manual code audits, and static/dynamic analysis (SAST/DAST) on our product codebase
• Conduct regular internal penetration testing, threat modeling, and security assessments across web application endpoints, cloud APIs, and microservices
• Build automated security testing tools and integrate vulnerability scanning directly into our CI/CD pipelines
• Identify, triage, and directly assist engineering teams in remediating complex application vulnerabilities and architectural flaws
• Set security standards and best practices across R&D and product as the internal authority on the subject
• Perform hands-on AI application security evaluations, testing LLMs and agentic workflows for prompt injection, data leakage, and access control bypasses
• Partner directly with developers to write secure libraries, harden authentication/authorization layers, and conduct incident response
• Manage third-party external penetration tests and vulnerability disclosure programs

📌 Required Qualifications

• Passion to own and deliver - you take full responsibility for security outcomes and drive initiatives from idea to production
• Curiosity and adoption of AI tools - you actively use tools like Cursor or Claude Code and are excited about how AI is transforming both software development and the threat landscape
• 5+ years of hands-on technical security experience focusing on application security, penetration testing, and vulnerability research
• Demonstrated proficiency in manual code auditing (Python, TypeScript) and web penetration testing methodologies (OWASP Top 10, SANS)
• Strong command of cloud security (AWS/GCP/Azure), web application security, and secure architecture design
• Experience with security and compliance standards such as SOC 1, SOC 2, ISO 27001, or NIST frameworks
• Relevant technical security certifications (OSCP, OSEP, OSWE, GWAPT, or equivalent practical credentials)
• A builder's mindset - comfortable establishing process and structure where none exists
• Ability to thrive in a fast-paced environment, balancing deep technical execution with high-level strategic and client conversations
• Strong communication skills, effective in a fast-paced startup environment

⭐ Desirable Experience

• Experience hands-on exploiting or securing LLM-powered applications, agentic systems, or AI infrastructure (OWASP Top 10 for LLMs)
• Background working with legal, financial, or other high-stakes documentheavy domains
• Strong development/coding capability in Python, Node.js/TypeScript, or Go for tooling and exploit POC creation
• Experience building a security function from scratch, especially as a founding or first security hire
• Familiarity with Kubernetes, infrastructure-as-code, and cloud-native architectures

🎁 Benefits

Chamelio might be a good fit if you:

Are relentlessly resourceful: You find creative solutions and don't let obstacles slow you down
Have a strong sense of urgency: You have a bias towards doing things today, rather than tomorrow
Thrive in startup environments: Fast-paced, high-impact work energizes you (preferred but not required)
Are excited about the adventure: Building a company from the ground up excites you!

🛂 Visa & Eligibility