Note: The job is a remote job and is open to candidates in USA. Beast Industries is a multifaceted media and entertainment company founded by Jimmy Donaldson, popularly known as MrBeast. They are seeking a Senior Application Security & DevSecOps Engineer to own the security of web and mobile applications, manage vulnerabilities, and integrate security into CI/CD pipelines.
Responsibilities
- Lead secure code review and threat modeling for web, mobile, and API surfaces, and drive secure-by-design practices with engineering teams
- Own the application vulnerability lifecycle — discovery, triage, severity, remediation guidance, and verification — and partner with engineers on durable fixes, not just findings
- Build internal AppSec tooling and lightweight security libraries that make the secure path the easy path for developers
- Own security for our iOS and Android apps: secure local storage (Keychain / Keystore), certificate pinning, jailbreak/root and tampering detection, anti-reverse-engineering, and secure app-to-API communication
- Assess apps against OWASP MASVS / MASTG, and review third-party SDKs and dependencies for risk
- Perform mobile-focused testing with tooling such as Frida, objection, MobSF, Burp Suite, and static/dynamic RE tools
- Run internal penetration tests and red-team-style assessments against our apps, APIs, and supporting services
- Validate and weaponize findings to demonstrate real impact, then drive them to resolution
- Pressure-test authentication, authorization, session handling, and business-logic flows (OAuth/OIDC, GraphQL/REST, IDOR, privilege escalation)
- Own and operate our bug bounty program (e.g., HackerOne / Bugcrowd): scope definition, researcher communication, triage, deduplication, severity, and payout coordination
- Close the loop by feeding bounty findings back into secure code review, threat models, and CI/CD checks so the same class of bug doesn't recur
- Track program health and report on trends, top vulnerability classes, and time-to-fix
- Own the security posture of our CI/CD pipelines and deployment toolchain, including the custom DSL that translates to Kubernetes and Terraform
- Integrate and tune SAST, DAST, and dependency/SCA scanning (e.g., Semgrep, CodeQL) as meaningful, low-noise gates in GitHub Actions
- Implement secrets scanning, build/release integrity, artifact signing, and supply-chain controls (SBOMs, provenance)
- Drive a security-focused cleanup of existing pipelines and automate the manual, one-off deployment steps that exist today
Skills
- 8+ years focused on Application Security and/or offensive security (penetration testing, exploit development)
- Strong software-development skills — you can read, write, and review production code rather than just operating tools. Experience with Kotlin and Gradle (and/or Swift/Android for mobile) is highly relevant to our stack; Python for automation and custom tooling
- Deep mobile application security expertise across iOS and Android: OWASP MASVS/MASTG, cert pinning, secure storage, anti-tampering/RE, and mobile testing tooling (Frida, objection, MobSF, Burp)
- Hands-on penetration testing of web apps, mobile apps, and APIs, with the ability to demonstrate real exploitability
- API security depth — OAuth/OIDC, REST and GraphQL, authn/authz and business-logic flaws
- CI/CD security experience with GitHub Actions, including SAST/DAST/SCA integration, secrets scanning, and securing the build/release pipeline
- Strong security fundamentals, including applied cryptography — a clear command of certificates and PKI, encryption vs. key management, and where HSMs fit
- Experience running or scaling a bug bounty / VDP program (HackerOne, Bugcrowd, or similar)
- Offensive security certifications (OSCP, OSWE, GMOB, or equivalent demonstrated skill)
- Experience securing consumer fintech/Gaming/Reels apps and the regulatory expectations that come with handling user funds and data for teens and their subscriptions
- Software-supply-chain security experience (SBOMs, artifact signing, provenance)
- Reverse engineering / binary analysis (Ghidra, Hopper, IDA)
Benefits
- Competitive Salary
- Generous Medical (Blue Cross Blue Shield), Dental, Vision and company-paid Life Insurance
- Company contributions to employee Health Savings Accounts (HSA)
- 401k Plan with Safe Harbor company-matching
- Flexible vacation policy and paid company holidays
- Company-provided technology package
- Relocation assistance where applicable, including travel and company-provided housing for the first 90 days
Company Overview