Senior Security Engineer

Apify is the largest marketplace of trusted tools for AI that automate work on the web. Thousands of Actors get web data, generate leads, monitor social media, track competitors, and integrate with existing apps and agents. Actors are created by a global community of builders who earn from them, while Apify manages infrastructure, billing, and distribution. Learn more at apify.com http://apify.com.

Join us to help people put the web to work. Apify can find missing children https://blog.apify.com/fighting-child-traffickers-with-technology/, protect consumers from fake discounts across the EU https://blog.apify.com/how-web-scraping-ai-and-the-eu-have-come-together-to-sweep-away-fake-discounts-in-europe/, and feed data to AI chatbots https://blog.apify.com/intercom-customer-support-ai-chatbot-web-scraping/.

To support this mission, Apify is looking for a Security Engineer who thinks like an attacker. You'll be the second member of the security team. The Apify platform runs code from a global community of builders and powers AI agents through MCP. That's a big attack surface, and we need someone in-house who finds the weak spots before anyone else does. You'll spend most of your time on offense: researching, testing, and hunting. The rest goes to defense: helping engineers fix what you find and improving detection and automation. Red team at heart, purple team in practice.

• Offensive testing: Attack Apify the way a real attacker would: the platform (multi-tenant isolation, Actor sandboxing, Apify Proxy, API, Console), AI agents and MCP servers (prompt injection, tool poisoning, data exfiltration), our supply chain and CI/CD (dependencies, GitHub Actions, open-source projects like Crawlee), and AWS (IAM, network, logging).
• AI-assisted security work: Use AI tools daily for pentesting, recon, code review, exploit development, and research.
• Security research: Follow new vulnerabilities, attack techniques, and threat actor activity. Assess what they mean for Apify and act on them fast.
• Threat modeling: Map realistic attack paths for new features and architectural changes before they ship.
• Vulnerability management: Triage, reproduce, and rate reports from researchers, pentesters, scanners, and your own testing. Agree on fixes with engineering, make sure they land within SLAs, and help run Apify's vulnerability program.
• Automation: Use scripting and AI to scale the program: triage pipelines, AI-assisted code review, advisory monitoring, and your own attack tooling.
• Detection and response: Hunt for signs of compromise and platform abuse, turn findings from hunting and attacking into detections, and support incident response.

• Experience: 3+ years in offensive security, penetration testing, security research, AppSec, or a closely related field.
• Attacker mindset: Hands-on experience finding and exploiting vulnerabilities in web applications and APIs, well beyond OWASP Top 10 checklists.
• Cloud: Hands-on experience securing and breaking AWS environments (IAM, CloudTrail, GuardDuty).
• Scripting or programming: You write your own tools and automation in Python, Go, Bash, or similar. Proficiency in Node.js/TypeScript is a plus.
• Tooling: Experience with Burp Suite or similar, vulnerability scanners, SAST/DAST, and GitHub's security features.
• AI: You use AI tools in your daily work and understand how LLMs and AI agents can be attacked.
• Curiosity: You follow the security community, read new research when it drops, and can't leave an interesting bug alone.
• Communication: You explain technical risks clearly to developers and leadership, and you work with engineers, not against them.
• Self-starter mentality: You find work on your own instead of waiting for tickets.
• Compliance (nice to have): Familiarity with frameworks like SOC 2 or ISO 27001.

Our tech stack

• Security: AISLE, Claude Mythos, GitHub Advanced Security, in-house security Actors (the Apify platform scanning itself)
• Frontend: React.js, styled-components, Storybook, Chromatic, Cypress, Playwright
• Backend: TypeScript/Node.js, Nest.js, Next.js, Docusaurus, Vitest
• Infra: AWS Compute (Kubernetes (EKS), EC2, Lambda), Helm, Terraform, CloudFormation, MongoDB, Redis, DynamoDB, S3, GitHub Actions
• Monitoring: Grafana, Prometheus, OpenTelemetry, Mezmo, Sentry, PagerDuty
• Tools: GitHub, Notion, Google Workspace, Slack
• OS, code editor, and AI assistant of your choice (Claude premium with unlimited tokens, GH Copilot, Cursor, Gemini, or JetBrains AI)
• Process: two-week sprints, code reviews, tests, automating whatever we can, and deploying multiple times per day.

WHY SHOULD YOU WORK AT APIFY?

• Space, support, and autonomy for personal growth, with a direct impact on our success
• Full-time position in our amazing offices in Prague (100Yards) or Brno (Titanium) 🏰
• Option to work fully remotely 🛋️
• Flexible working hours (perfect for both night owls 🦉 and early birds 🐥)
• Nobody counts holidays as long as the work gets done 💪