---
title: 'Security Engineer, Application Security at Mercor'
canonical: 'https://feeny.ai/job/security-engineer-application-security-mercor-san-francisco-5z2pbdwzrw0n'
type: 'job'
last_seen: '2026-09-05'
---

# Security Engineer, Application Security at Mercor

- **Company:** Mercor
- **Location:** San Francisco, CA
- **Compensation:** $130k–$400k
- **Employment:** full-time
- **Work type:** onsite
- **Posted:** 2026-09-04
- **Last confirmed live:** 2026-09-05
- **Apply:** https://jobs.ashbyhq.com/mercor/cf6fcf5a-6348-4d60-beb3-43333a2c2bb9/application

**Skills:** Application Security, Web Application Security, OWASP Top 10, Python, TypeScript, Go, SAST, DAST, Semgrep, CodeQL, Snyk, Burp, CI/CD, Vulnerability Management, Threat Modeling, Bug Bounty Management, Offensive Security, Penetration Testing, AI/ML Application Security, Supply Chain Security

> The Security Engineer will own application security at a company where the app layer is the highest-priority security surface. Responsibilities include embedding security into the development lifecycle, reviewing code for exploitable flaws, building security tooling into CI/CD, and driving vulnerability remediation...

## Job description

## ABOUT MERCOR

Mercor's mission is to organize human intelligence to power the AI economy. We're a leading AI data company, building the layer between human expertise and frontier models. Millions of domain experts on the platform are paid over $4 million per day to train frontier AI models. Mercor's APEX benchmark family measures AI's real-world impact on professional work. Mercor Enterprise brings this same infrastructure to Fortune 500 companies: helping companies capture how their best people actually work, translating that expertise directly back into agents.

Mercor is creating a new category of work where expertise powers AI advancement. Achieving this requires an ambitious, fast-paced and deeply committed team. You’ll work alongside researchers, operators, and AI companies at the forefront of shaping the systems that are redefining society. Mercor is a profitable Series C company valued at $10 billion. We work in-person five days a week in our San Francisco, NYC, or London offices.

You'll own application security at a company where the app layer is the highest-priority security surface. This is not a scan-and-triage role. You'll embed in the development lifecycle, review code for exploitable flaws, build security tooling into CI/CD, and drive vulnerability remediation across a platform serving 300K+ experts and enterprise clients processing sensitive AI training data.

We use AI heavily in our own security work. You should be comfortable building alongside AI code-gen tools, using LLMs to accelerate code review and threat modeling, and automating away the repetitive work that slows AppSec programs down. If you'd rather write a CodeQL query than file a Jira ticket, you'll fit in here.

We're in-person five days a week at our SF headquarters, with first Fridays remote.

## WHAT YOU'LL BUILD:

- Security review workflows embedded in the SDLC - PR-level analysis that catches auth bugs, injection flaws, and business logic errors before they ship
- SAST/DAST pipelines integrated into CI/CD - shifting security left without slowing down deploys
- Vulnerability management processes that prioritize by real exploitability, not CVSS score
- Secure coding standards and guardrails that make the safe path the easy path for 50+ engineers
- Threat models for new features and architecture changes - especially around AI data pipelines, payment flows, and multi-tenant boundaries
- Bug bounty program operations - triaging HackerOne reports, validating findings, and driving fixes to closure

## WHAT WE'RE LOOKING FOR

- You've found and fixed real vulnerabilities in production applications - not just run scanners
- Deep understanding of web application security: OWASP Top 10 is baseline, you think in terms of attack chains and business logic flaws
- Strong in at least one of Python, TypeScript, or Go - you can read a PR and spot the auth bypass
- Experience building or tuning SAST/DAST tooling (Semgrep, CodeQL, Snyk, Burp, or similar)
- You understand modern web frameworks, APIs, and authentication patterns well enough to threat model them
- Experience managing a vulnerability pipeline - from discovery through prioritization to verified remediation
- 5+ years of professional experience in application security, security engineering, or software engineering with a strong security focus

## BONUS POINTS

- Experience running or triaging a bug bounty program (HackerOne, Bugcrowd)
- Offensive security skills - you've done penetration testing and can think like an attacker
- Experience securing AI/ML applications - model serving APIs, training data pipelines, prompt injection defense
- Familiarity with supply chain security - dependency scanning, registry firewalls (Socket, Snyk)
- You've built custom security tooling that a team still uses
- Contributions to open source security projects or published vulnerability research

## WHY MERCOR

- The problem is real. Application security at scale is hard - you'll build defenses that matter across a fast-moving platform.
- AI-native AppSec. You'll use frontier AI tools daily - for code review, vulnerability analysis, and anything that benefits from an AI co-pilot.
- Ownership from day one. You'll own the entire application security domain - from code review processes to CI/CD security to bug bounty operations.
- See the future early. Working alongside AI labs means you'll understand frontier model capabilities months before the market.

## Benefits

- Bi-annual performance bonus structure
- Generous equity grant vested over 4 years
- Up to $15k Relocation bonus
- $10K housing bonus (if you live within 0.5 miles of our office)
- $1.5K monthly stipend for meals
- Free Equinox membership
- $200 monthly laundry reimbursement
- $200 monthly personal wellness reimbursement
- Health, Dental, Vision insurance

## About Mercor

## Company Overview
- **One-liner**: Mercor organizes human intelligence to power the AI economy by connecting domain experts with frontier AI labs and enterprises for model training, evaluation, and deployment.
- **Entity Type**: Private (Series C)
- **Headquarters**: San Francisco, California, USA (with offices in New York City and London)
- **Founded**: 2023
- **Founders**: Brendan Foody & Adarsh Hiremath (Co-founders & Co-CEOs)

## Core Business
- Primary industry: AI Data & Infrastructure, Human-in-the-Loop AI, Enterprise AI
- Target customers: Frontier AI labs (OpenAI, Anthropic, etc.), Fortune 500 enterprises deploying AI in production, and domain experts seeking high-value AI work
- Mission: Organizing human intelligence to power the AI economy — building the layer between human expertise and frontier models.

## Products & Services
- **Mercor Platform**: A global network of millions of domain experts across 300+ professional fields, paid over $3 million per day to train frontier AI models. Experts are found and vetted using dynamic, role-specific AI interviews.
- **APEX Benchmark**: A benchmark family that measures AI's real-world impact on professional work, setting a standard for whether AI can perform economically valuable work.
- **Mercor Enterprise**: Brings Mercor's expert network and evaluation infrastructure to Fortune 500 companies, deploying custom AI agents, staffing teams with vetted domain experts, and helping organizations encode their own knowledge into AI systems.

## Market Standing
- **Valuation**: $10 billion valuation (as of Series C)
- **Key Metric**: Total Funding — $350 million Series C (recently raised); company is profitable
- **Notable Investors/Partners**: Not explicitly named in provided sources, but the company works with leading AI labs and Fortune 500 enterprises
- **Growth Signals**: 
  - Named to Bloomberg's "2026 24 AI Startups to Watch"
  - Forbes AI 50 (2025)
  - Forbes Cloud 100 (2025)
  - LinkedIn Top Startup (2025)
  - Described as "the fastest-growing company in the world"
  - Tens of thousands of skilled professionals earning an average of more than $95/hour on the platform

## Competitive Advantages
- **Massive, vetted expert network**: Millions of domain experts across 300+ fields, found and vetted via AI-driven interviews — a hard-to-replicate moat.
- **Direct frontier model exposure**: Every team works directly with frontier models, training them and building around them — most companies haven't imagined this level of integration.
- **Profitability at scale**: Profitable at Series C with a $10B valuation, indicating strong unit economics.
- **End-to-end AI infrastructure**: From expert sourcing and vetting to model evaluation (APEX) to enterprise deployment — a vertically integrated stack.

## Strategic Focus
- **Scaling the expert network**: Continuing to onboard millions of domain experts globally to meet the insatiable demand for high-quality human training data.
- **Enterprise AI deployment**: Expanding Mercor Enterprise to help Fortune 500 companies encode organizational knowledge into AI systems and deploy custom agents.
- **Benchmarking AI's economic impact**: Growing the APEX benchmark as the standard for measuring whether AI can perform economically valuable work.
- **Preparing for AGI**: The company's founding thesis is about answering what role humans will play in the economy as AGI approaches.

## Why Work Here
- **Culture**: "Built for people who thrive in high-velocity environments." Values include Intensity, Simplicity, User Obsession, High Standards, Can-Do Attitude, and Time Travelers (thinking ahead).
- **Work model**: In-person collaboration from offices in San Francisco, New York City, and London. No remote option — the company believes in-person collaboration helps move faster and solve harder problems.
- **Engineering culture**: Direct exposure to frontier AI research, labs, and startups. Every team works with frontier models daily. Described as "the fastest-growing company in the world."
- **Compensation**: Generous equity grants, competitive salaries (ranges from $100K–$500K depending on role), and a "proximity bonus" (generous annual housing support).
- **Benefits**: 
  - Unlimited paid vacation and sick days
  - Free Equinox membership (premium fitness access)
  - Monthly wellness stipend and free mental health services
  - Monthly food stipend
  - 401k with employer match
  - Parental leave for both birthing and non-birthing parents
- **Team**: "A team of ambitious, diverse people who want to work on what matters most." Open roles across Engineering (31 roles), Operations (15 roles), Enterprise (5 roles), Finance (4 roles), and more.

## Sources
1. [mercor.com](https://www.mercor.com/)
2. [mercor.com/careers](https://www.mercor.com/careers/)
3. [mercor.com/mission](https://www.mercor.com/mission/)
4. [jobs.ashbyhq.com/mercor](https://jobs.ashbyhq.com/mercor)
5. [linkedin.com/company/mercor-ai](https://www.linkedin.com/company/mercor-ai)

## Other roles at Mercor

- [Infrastructure Engineer](https://feeny.ai/job/infrastructure-engineer-mercor-san-francisco-1t8t2mejenj2) — San Francisco, CA
- [Technology Operations Specialist (L3)](https://feeny.ai/job/technology-operations-specialist-l3-mercor-san-francisco-evpqqw1fmc47) — San Francisco, CA
- [Cloud Platform Engineer (SF)](https://feeny.ai/job/cloud-platform-engineer-sf-mercor-san-francisco-0c9b2zbpmk8g) — San Francisco, CA
- [Software Engineer, Applied AI](https://feeny.ai/job/software-engineer-applied-ai-mercor-new-york-29sf9gcj7j2s) — New York, NY
- [Software Engineer, Platform](https://feeny.ai/job/software-engineer-platform-mercor-new-york-8rn1qgb4yxmm) — New York, NY
- [GTM Recruiter](https://feeny.ai/job/gtm-recruiter-mercor-mercor-hq-69mmwz3epxe8) — Mercor Hq, 181 Fremont Street
- [Recruiter](https://feeny.ai/job/recruiter-mercor-san-francisco-n76yb0v38rbp) — San Francisco, CA
- [Revenue Operations](https://feeny.ai/job/revenue-operations-mercor-san-francisco-jgq6v727w1n0) — San Francisco, CA
- [Member of Technical Staff, Agentic Systems](https://feeny.ai/job/member-of-technical-staff-agentic-systems-mercor-san-francisco-et81vk2eeq51) — San Francisco, CA
- [Product Engineer, Talent Experience](https://feeny.ai/job/product-engineer-talent-experience-mercor-san-francisco-jn4gweqrxb7v) — San Francisco, CA