Apify is the largest marketplace of trusted tools for AI that automate work on the web. Thousands of Actors get web data, generate leads, monitor social media, track competitors, and integrate with existing apps and agents. Actors are created by a global community of builders who earn from them, while Apify manages infrastructure, billing, and distribution. Learn more at apify.com.

Join us to help people put the web to work. Apify can find missing children, protect consumers from fake discounts across the EU, and feed data to AI chatbots.

To support this mission, Apify is looking for a Security Engineer who thinks like an attacker. You'll be the second member of the security team. The Apify platform runs code from a global community of builders and powers AI agents through MCP. That's a big attack surface, and we need someone in-house who finds the weak spots before anyone else does. You'll spend most of your time on offense: researching, testing, and hunting. The rest goes to defense: helping engineers fix what you find and improving detection and automation. Red team at heart, purple team in practice.

What you’ll be working on

Offensive testing: Attack Apify the way a real attacker would: the platform (multi-tenant isolation, Actor sandboxing, Apify Proxy, API, Console), AI agents and MCP servers (prompt injection, tool poisoning, data exfiltration), our supply chain and CI/CD (dependencies, GitHub Actions, open-source projects like Crawlee), and AWS (IAM, network, logging).

AI-assisted security work: Use AI tools daily for pentesting, recon, code review, exploit development, and research.

Security research: Follow new vulnerabilities, attack techniques, and threat actor activity. Assess what they mean for Apify and act on them fast.

Threat modeling: Map realistic attack paths for new features and architectural changes before they ship.

Vulnerability management: Triage, reproduce, and rate reports from researchers, pentesters, scanners, and your own testing. Agree on fixes with engineering, make sure they land within SLAs, and help run Apify's vulnerability program.

Automation: Use scripting and AI to scale the program: triage pipelines, AI-assisted code review, advisory monitoring, and your own attack tooling.

Detection and response: Hunt for signs of compromise and platform abuse, turn findings from hunting and attacking into detections, and support incident response.

Who we’re looking for

Experience: 3+ years in offensive security, penetration testing, security research, AppSec, or a closely related field.

Attacker mindset: Hands-on experience finding and exploiting vulnerabilities in web applications and APIs, well beyond OWASP Top 10 checklists.

Cloud: Hands-on experience securing and breaking AWS environments (IAM, CloudTrail, GuardDuty).

Scripting or programming: You write your own tools and automation in Python, Go, Bash, or similar. Proficiency in Node.js/TypeScript is a plus.

Tooling: Experience with Burp Suite or similar, vulnerability scanners, SAST/DAST, and GitHub's security features.

AI: You use AI tools in your daily work and understand how LLMs and AI agents can be attacked.

Curiosity: You follow the security community, read new research when it drops, and can't leave an interesting bug alone.

Communication: You explain technical risks clearly to developers and leadership, and you work with engineers, not against them.

Self-starter mentality: You find work on your own instead of waiting for tickets.

Compliance (nice to have): Familiarity with frameworks like SOC 2 or ISO 27001.

Our tech stack

Security: AISLE, Claude Mythos, GitHub Advanced Security, in-house security Actors (the Apify platform scanning itself)

Frontend: React.js, styled-components, Storybook, Chromatic, Cypress, Playwright

Backend: TypeScript/Node.js, Nest.js, Next.js, Docusaurus, Vitest

Infra: AWS Compute (Kubernetes (EKS), EC2, Lambda), Helm, Terraform, CloudFormation, MongoDB, Redis, DynamoDB, S3, GitHub Actions

Monitoring: Grafana, Prometheus, OpenTelemetry, Mezmo, Sentry, PagerDuty