Apify is a full-stack web scraping and browser automation platform that lets you extract data from websites and automate workflows on the web. With Apify, you can turn any website into an API!
📋 Job Overview
Apify is the largest marketplace of trusted tools for AI that automate work on the web. Thousands of Actors get web data, generate leads, monitor social media, track competitors, and integrate with existing apps and agents. Actors are created by a global community of builders who earn from them, while Apify manages infrastructure, billing, and distribution. Learn more at apify.com.
Join us to help people put the web to work. Apify can find missing children, protect consumers from fake discounts across the EU, and feed data to AI chatbots.
To support this mission, Apify is looking for a Security Engineer who thinks like an attacker. You'll be the second member of the security team. The Apify platform runs code from a global community of builders and powers AI agents through MCP. That's a big attack surface, and we need someone in-house who finds the weak spots before anyone else does. You'll spend most of your time on offense: researching, testing, and hunting. The rest goes to defense: helping engineers fix what you find and improving detection and automation. Red team at heart, purple team in practice.
🏢 About Apify
Apify is the largest marketplace of trusted tools for AI that automate work on the web. Thousands of Actors get web data, generate leads, monitor social media, track competitors, and integrate with existing apps and agents. Actors are created by a global community of builders who earn from them, while Apify manages infrastructure, billing, and distribution.
🎯 The Role
You'll be the second member of the security team. The Apify platform runs code from a global community of builders and powers AI agents through MCP. That's a big attack surface, and we need someone in-house who finds the weak spots before anyone else does. You'll spend most of your time on offense: researching, testing, and hunting. The rest goes to defense: helping engineers fix what you find and improving detection and automation. Red team at heart, purple team in practice.
✅ Key Responsibilities
Offensive testing: Attack Apify the way a real attacker would: the platform (multi-tenant isolation, Actor sandboxing, Apify Proxy, API, Console), AI agents and MCP servers (prompt injection, tool poisoning, data exfiltration), our supply chain and CI/CD (dependencies, GitHub Actions, open-source projects like Crawlee), and AWS (IAM, network, logging).
AI-assisted security work: Use AI tools daily for pentesting, recon, code review, exploit development, and research.
Security research: Follow new vulnerabilities, attack techniques, and threat actor activity. Assess what they mean for Apify and act on them fast.
Threat modeling: Map realistic attack paths for new features and architectural changes before they ship.
Vulnerability management: Triage, reproduce, and rate reports from researchers, pentesters, scanners, and your own testing. Agree on fixes with engineering, make sure they land within SLAs, and help run Apify's vulnerability program.
Automation: Use scripting and AI to scale the program: triage pipelines, AI-assisted code review, advisory monitoring, and your own attack tooling.
Detection and response: Hunt for signs of compromise and platform abuse, turn findings from hunting and attacking into detections, and support incident response.
📌 Required Qualifications
Experience: 3+ years in offensive security, penetration testing, security research, AppSec, or a closely related field.
Attacker mindset: Hands-on experience finding and exploiting vulnerabilities in web applications and APIs, well beyond OWASP Top 10 checklists.
