Jobs at Trail of Bits

Conduct application security assessments, discover and validate vulnerabilities, analyze complex codebases, build custom security tooling, perform threat modeling and architecture reviews, and deliver actionable findings to clients. Independently own assessment workstreams, develop proof-of-concept exploits, communicate technical conclusions, review team work, and contribute to security research, open-source tools, and technical writing.

Conduct application security assessments, discover and validate vulnerabilities, analyze code and architectures, perform threat modeling, build security tooling, and develop proof-of-concept exploits. Own scoped assessment components from discovery through client delivery, communicate findings and remediation guidance, and contribute to security research, open-source tools, and technical documentation. The role requires hands-on coding, vulnerability research, memory-corruption knowledge, operating-system familiarity, and independent technical investigation.

Lead cryptographic security assessments of protocols, libraries, applications, and high-assurance systems. Analyze advanced cryptographic constructions, identify design and implementation weaknesses, validate exploitability, and recommend remediation. Build testing and analysis tools, manage client delivery, write precise technical reports, mentor engineers, contribute to methodologies and services, and support open-source research and technical publications.

Own technical strategy for strategic cybersecurity accounts after engagements. Lead findings readouts, technical continuity, security roadmaps, business reviews, expansion planning, program design, complex pre-sales, scoping, pricing, and service development. Partner with account executives, sales engineers, PMO, and engineering leaders to translate client security needs into multi-year programs and deliverable engagements. The role is client-facing, technical, and requires hands-on security delivery experience plus practical agentic tooling expertise.

Leads a 12-person application security practice conducting code audits, vulnerability research, and secure design reviews. Oversees technical delivery, client relationships, project staffing, utilization, profitability, recruiting, and team development. Provides hands-on technical direction across source-code security work, determines investments in tooling and methodologies, and integrates AI-assisted auditing and research into team workflows. The role also owns practice P&L and supports engineers’ conference, publication, and open-source contributions.

Own developer-facing outreach for Trail of Bits: grow community relationships, support and onboard maintainers, convert research into usable tools and docs, publish deep technical content, run workshops and conference presence, and attract upstream contributions while routing practitioner feedback into product and research priorities.