Security job openings for Kingsley - compiled 2026-07-27

Curated, verified where possible, for AppSec / Security Researcher / Vuln Researcher / Product Security / AI-ML Security. Remote-worldwide or Canada preferred, ~100k+ USD (or CAD equiv). You are Canadian in Calgary, so Canada + Canada-remote roles are work-auth-clean; US-only-remote roles may need visa (flagged).

HOW TO READ THIS (honesty key - important)

CONFIRMED-LIVE = a research agent actually fetched the posting URL and read an open, apply-able page today. Highest confidence.
UNVERIFIED (open it yourself) = a real company + real role surfaced in search, but the ATS page (Ashby / Greenhouse / Workable / Coinbase / github.careers) is JavaScript-rendered or bot-blocked, so live-open status could NOT be machine-confirmed. Strong leads - open in a browser before investing. NOT invented.
DEAD = verified closed/removed. Listed at the bottom so you do not waste time.
No links here were invented. Anything not machine-confirmable is labeled UNVERIFIED.

Your receipts to lead with: File Browser CVE-2026-55667 (HIGH 8.2) = flagship self-hosted-web-app CVE; OpenBao CVE-2026-63131 = secrets/Vault-adjacent (Go); Gitea CVE-2026-27761 = git-forge-adjacent (Go); the coordinated IBM MCP advisory + the MCP/AI-agent SSRF/credential-forwarding/auth-boundary body of work = your AI-security angle; dYdX/Polymarket + Immunefi-cleared = smart-contract audit angle; the autonomous multi-agent vuln-research pipeline = your standout differentiator.

TOP 5 TO HIT FIRST (best blend of confirmed-live + geo/pay fit + topical match)

Mozilla - Senior Product Security Engineer (CONFIRMED-LIVE, Remote CANADA, CAD ~104-139k). Cleanest fit: Canada-remote, pay-in-band, and it is add-on/self-hosted-app security = lead with File Browser CVE 8.2 + your incomplete-fix/variant method. Apply: www.mozilla.org/en-US/careers/position/gh/7583

Runlayer - Member of Technical Staff, Security (CONFIRMED-LIVE, Remote US-timezones). Almost bespoke to you: they build MCP-server/agent scanning + shadow-MCP detection. Lead with the MCP/AI-agent angle. Stretch on their "8+ yrs" ask, but your MCP depth offsets. Apply: jobs.ashbyhq.com/runlayer/42c0ccf3-7d33-405d-a

Canonical - Security Software Engineer (CONFIRMED-LIVE, Home-based WORLDWIDE). Best geography (worldwide remote), Go-heavy product hardening = lead with OpenBao + Gitea (Go) CVEs. Verify pay band (region-adjusted, sometimes below 100k USD). Apply: canonical.com/careers/5146620

Chainguard - Senior Product Security Engineer (CONFIRMED-LIVE, Remote US, $157-184k USD). Supply-chain / secure-container firm; your variant-analysis + CVE portfolio maps to product hardening. Confirm they accept Canada-based before investing. Apply: job-boards.greenhouse.io/chainguard/jobs/46889

Anthropic - Staff+ Application Security Engineer (CONFIRMED-LIVE, Remote-friendly, $320-485k USD). Their JD literally describes "an increasingly autonomous vulnerability pipeline - LLM-driven code analysis finds the issue, scores it for exploitability, opens the fix PR" = your exact build. Stretch on Staff+ seniority, but the topical + differentiator match is extraordinary; worth a strong application. Lead File Browser CVE + the pipeline. Apply: job-boards.greenhouse.io/anthropic/jobs/450250

GROUP A - CONFIRMED-LIVE, best fit, geo/pay-viable (apply first)

Company	Role	Remote / Location	Salary	Apply link (verified live)	Why you fit + lead-with	Honesty flag
Mozilla	Senior Product Security Engineer	Remote CANADA (also EU/UK)	CAD 104-139k	www.mozilla.org/en-US/careers/position/gh/7583	AMO add-on/self-hosted-app security; lead File Browser CVE 8.2 + variant analysis	None major. Confirm the exact req title when you open it.
Runlayer	MTS, Security	Remote (US timezones) / hybrid NYC	competitive + equity (not listed)	jobs.ashbyhq.com/runlayer/42c0ccf3-7d33-405d-a	Builds MCP-server/agent scanning + shadow detection; lead MCP/AI-agent angle	Asks 8+ yrs security eng = tenure stretch; MCP depth offsets
Canonical	Security Software Engineer	Home-based WORLDWIDE	not listed	canonical.com/careers/5146620	Ubuntu/product hardening, Go; lead OpenBao + Gitea CVEs	Pay band region-adjusted (verify vs 100k USD); long hiring process; 2-4x/yr travel
Chainguard	Senior Product Security Engineer	Remote UNITED STATES	$157-184k USD	job-boards.greenhouse.io/chainguard/jobs/46889	Supply-chain/secure-container; lead incomplete-fix/variant + File Browser CVE	Says "United States" - confirm Canada eligibility; senior bar
Anthropic	Staff+ Application Security Engineer	Remote-friendly (travel req)	$320-485k USD	job-boards.greenhouse.io/anthropic/jobs/450250	Bug-bounty ownership + LLM-driven vuln pipeline = your build; lead File Browser CVE + pipeline	Staff+ seniority = stretch; travel required
Aikido Security	Customer Security Engineer (Pentest)	Remote (US/UK/SG/BE +)	not listed	aikidosecurity.recruitee.com/o/customer-securi	Offensive/pentest + AppSec at a scanner firm; lead bug-bounty + 3 CVEs	Canada not explicitly listed but remote-flexible - ask; first-of-role

GROUP B - CONFIRMED-LIVE but geo-stretch or senior-stretch (great topical fit; relocation/level caveats)

Company	Role	Remote / Location	Salary	Apply link (verified live)	Why you fit	Honesty flag
Noma Security	Senior Security Researcher	Tel Aviv (on-site)	not listed	noma.security/careers/co/tel-aviv/5D.A5A/senio	Agentic/MCP vuln research is the core; lead MCP angle	Tel-Aviv-only relocation; not remote
Zenity	Senior Security Researcher	Tel Aviv (hybrid)	not listed	zenity.io/careers	Agentic AI / LLM attack-vector research; lead MCP angle	Tel-Aviv relocation; US-remote roles are non-research only
Anthropic	Security Labs Engineer	San Francisco (on-site heavy)	~320-405k (unverified)	job-boards.greenhouse.io/anthropic/jobs/515356	Offensive security / research, prototype-building; lead MCP + CVEs	SF relocation, some airgapped work; 7+ yrs
Anthropic	Lead, Frontier Red Team (Cyber)	SF hybrid + DC travel	$485-755k USD	job-boards.greenhouse.io/anthropic/jobs/532635	Frontier autonomous-vuln research	Leadership role = big stretch; shown for ceiling only
Datadog	Staff Application Security Engineer	Hybrid Boston / NYC	$244-305k USD	careers.datadoghq.com/detail/7777798/	AppSec at scale; lead File Browser CVE	Staff + hybrid + likely US-only = stretch
Wiz	Security Engineer, Product & Prod Infra	Remote NETHERLANDS	not listed	www.wiz.io/careers/job/4595651006/	Cloud/product security	NL-based, no sponsorship = geo mismatch

GROUP C - UNVERIFIED (open yourself), strong fit, CANADA / remote-friendly (highest-value to check tonight)

Company	Role	Remote / Location	Salary	Link to verify	Why you fit	Honesty flag
Greenhouse (the company)	Senior Product Security Engineer (AI/ML)	Remote, Canada-eligible	$155-233k CAD	job-boards.greenhouse.io/greenhouse/jobs/75456	"SME on AI security / securing emerging AI-ML features" = bullseye; lead MCP/AI angle + File Browser CVE	UNVERIFIED - fetch returned an error/redirect = possibly closed; if 404 watch www.greenhouse.com/careers/opportunities
GitHub Security Lab	Staff / Senior Security Researcher	Remote (US-stated)	not listed	www.github.careers/careers-home/jobs (search "Security Lab", IDs 5391/4807)	Literally "find + report vulns in OSS, coordinate disclosure, publish tooling" = your CVEs + pipeline	UNVERIFIED (github.careers JS-blocked) + confirm Canada work-auth; senior bar
Coinbase	Blockchain Security Engineer	Remote - CANADA	not listed	www.coinbase.com/careers/positions/6863712	Secure code review + threat modeling; web3-adjacent = your DeFi audit plus; lead source-review + OpenBao/Gitea	UNVERIFIED (Coinbase blocks fetch); Canada-tagged so geo-clean if open
Chainlink Labs	Blockchain Application Security Engineer (SC Auditor)	100% remote, no geo limit	~$60-110k (one listing)	chainlink.link/open-roles or chain.link careers	Audit angle; most explicitly Canada-friendly; lead dYdX/Polymarket + Immunefi	UNVERIFIED; comp on the one salaried listing seen is below your target; wants ~5yr SWE
OpenZeppelin	Security Researcher (blockchain)	Fully remote, global	market ~150-250k	www.openzeppelin.com/careers	Audit angle, remote-global Canada-friendly; lead dYdX/Polymarket + Immunefi	UNVERIFIED; some listings are "future openings" pipelines
Wealthsimple	Security Engineer (App & Cloud) / Sr Dev, AppSec	Remote anywhere in CANADA	not listed	www.wealthsimple.com/careers (Ashby/GH)	AppSec + source review at a fintech; lead File Browser CVE	UNVERIFIED (startup.jobs 403); some reqs may be older - verify on their site
Arctic Wolf	Security Researcher, Threat Intelligence	Remote, Canadian company (Waterloo)	not listed	arcticwolf.com/careers	Research + findings write-up; your CVE track record	UNVERIFIED; threat-intel-flavored (not pure VR) = moderate fit
1Password	Security Engineer / Vuln Management / Detection	Remote US or CANADA	CAD 143-193k band	jobs.ashbyhq.com/1password (filter Security)	Password/secrets product; lead OpenBao CVE (vault relevance) + File Browser	UNVERIFIED; NOTE their "Senior AppSec" req is CONFIRMED CLOSED - check the others only
Elastic	Security-Elasticsearch engineering (incl. a Canada-remote role)	US / Canada remote	not listed	jobs.elastic.co/jobs/team/security	Security-product engineering; fresh (posted ~07-23)	UNVERIFIED (JS); leans feature-dev over pure AppSec
GitLab	Senior Software Security Engineer / AppSec	All-remote (filter Remote-Canada)	US band $139-196k on one listing	job-boards.greenhouse.io/gitlab (filter Security)	Secure-SDLC + source review; runs a bug-bounty; lead File Browser CVE 8.2	UNVERIFIED at req level (several specific IDs now redirect = filled); use the live board + filter

GROUP D - UNVERIFIED (open yourself), strong fit, US-remote (visa/eligibility to confirm)

Company	Role	Remote / Location	Salary	Link to verify	Why you fit	Honesty flag
Socket (socket.dev)	Vulnerability Research Engineer	Remote USA	not listed	jobs.ashbyhq.com/socket/91b38c09-d291-4fb4-805	JS/TS + vuln research + CVEs = bullseye; lead 3 CVEs + variant method	UNVERIFIED (Ashby JS); US-only remote = confirm Canada
HackerOne	Product Security Analyst	Washington DC	$120-155k	jobs.ashbyhq.com/hackerone/379afa88-fca8-40ed-	Validates bug-bounty findings = your exact background	UNVERIFIED (Ashby JS); DC-located, remote variant unconfirmed
Trail of Bits	Security Engineer, AppSec / Blockchain / Agentic AI / Apprenticeship	US Remote (apprenticeship = worldwide)	R&E band ~$125-185k	www.trailofbits.com/careers	CVE-publishing-auditor culture fit; apprenticeship = global entry path; lead CVEs (AppSec) or dYdX/Polymarket (blockchain)	UNVERIFIED (Workable metadata-only); non-apprentice roles want ToB-grade depth
Horizon3.ai	Security Researcher / WebApp Offensive Sec Engineer	Remote-first (US broadband)	remote band cited up to ~$234k median	jobs.ashbyhq.com/horizon3ai	"Weaponize newly-disclosed vulns, patch-diff" = your incomplete-fix work; lead 3 CVEs + pipeline	UNVERIFIED; leans exploit-dev / OSCP-OSWE depth; US-centric
Bugcrowd	Application Security Engineer / II	100% remote	not listed	www.bugcrowd.com/about/careers/	Bug-bounty triage = perfect fit	UNVERIFIED (Greenhouse IDs expired); check live board
Docker	Senior Security Engineer (Docker Desktop)	Remote-first	not listed	jobs.ashbyhq.com/docker	Container/runtime security; lead source-review + CVEs	UNVERIFIED (Ashby JS)
Sysdig	Senior Security Engineer	Remote	not listed	jobs.lever.co/sysdig	Go/Python secure-code + AppSec	UNVERIFIED (Lever 403)
Grafana Labs	Software Engineer, Security Assurance	US Remote	not listed	job-boards.greenhouse.io/grafanalabs	AppSec at a self-hosted-product company; lead File Browser CVE	UNVERIFIED; older Sr AppSec role appears stale
Assetnote / Searchlight Cyber	(Browser) Vulnerability Researcher	(verify)	not listed	slcyber.io/careers/ (or careers@slcyber.io)	Best culture fit for a CVE-publishing researcher; lead 3 CVEs + method	UNVERIFIED (BambooHR 403); apply direct
Spearbit / Cantina	Security Researcher (tiered)	Remote, global	~$90k salaried SR + marketplace	cantina.xyz	Immunefi/contest receipts plug into their tiered model; lead dYdX/Polymarket + Immunefi	UNVERIFIED; marketplace/curated model, income track-record-gated (not classic W2)

DEAD - do NOT chase (verified closed/removed, so you skip them)

watchTowr "AI Vulnerability Research Engineer" + "Principal Security Researcher" - both read "no longer active"; no VR roles open now.
Trail of Bits "Security Engineer, Research & Engineering" (removed 2026-07-16) and "Senior Security Engineer, Blockchain" builtinnyc listing (removed 2025-02) - stale caches. (The Workable roles above may still be live - verify those.)
Rapid7 "Emergent Threat & Exploit Researcher" (removed 2026-06-17, UK-only).
Snyk "Senior Vulnerability Researcher" (Greenhouse ID 404s), "Vulnerability Modeling / Snyk Code" (EU/closed).
1Password "Senior Security Engineer, Application Security" - CONFIRMED closed ("no longer accepting applications").
HiddenLayer "AI Red Teamer" - 404, and NOT on their current board (all product/sales now).
Zenity "Senior AI Red Team Researcher" specific URL - 404 (filled); use their Senior Security Researcher instead.
Code4rena - winding down (May 2026), do not target as an employer.
GitLab - several specific security req IDs redirect to the index = filled; use the live board filter instead.

Positioning cheat-sheet (which receipt to lead with)

AppSec / Product Security (Mozilla, Chainguard, GitLab, Datadog, Wealthsimple, 1Password): lead File Browser CVE-2026-55667 (HIGH 8.2) as "I ship real high-sev CVEs in self-hosted web apps," back with incomplete-fix/variant analysis + source review. For secrets/vault-flavored (1Password, Canonical) add OpenBao CVE.
AI / MCP / agent security (Runlayer, Anthropic, Noma, Zenity, Greenhouse AI/ML, Lakera): lead the MCP/AI-agent SSRF/credential-forwarding/auth-boundary body of work + the coordinated IBM MCP advisory, and cite the autonomous multi-agent vuln pipeline as your differentiator (Anthropic + GitHub SecLab language matches it directly).
Vuln / security research (GitHub Security Lab, Socket, Horizon3, HackerOne, Trail of Bits, Bugcrowd, Assetnote): lead the 3 CVEs + incomplete-fix/variant + cross-fork discovery method; the pipeline is the standout.
Smart-contract audit (Chainlink, OpenZeppelin, Cantina/Spearbit, Trail of Bits blockchain): lead dYdX/Polymarket findings + Immunefi-cleared.

Reminders

You are Canadian in Calgary - Canada + Canada-remote = clean; US-only-remote roles: confirm they hire from Canada (visa otherwise). Every UNVERIFIED link must be opened in a browser before you invest - JS-rendered ATS pages defeated automated confirmation, and a few mirror-sourced roles had conflicting/closed signals. No link here was invented.

Compiled by Buddy, reviewed by your coordinator. No links invented. Nothing auto-applies, every submit is your button.