Senior Security Engineer

Apify is the largest marketplace of trusted tools for AI that automate work on the web. Thousands of Actors get web data, generate leads, monitor social media, track competitors, and integrate with existing apps and agents. Actors are created by a global community of builders who earn from them, while Apify manages infrastructure, billing, and distribution. Learn more at apify.com.

Join us to help people put the web to work. Apify can find missing children, protect consumers from fake discounts across the EU, and feed data to AI chatbots.

To support this mission, Apify is looking for a Security Engineer who thinks like an attacker. You'll be the second member of the security team. The Apify platform runs code from a global community of builders and powers AI agents through MCP. That's a big attack surface, and we need someone in-house who finds the weak spots before anyone else does. You'll spend most of your time on offense: researching, testing, and hunting. The rest goes to defense: helping engineers fix what you find and improving detection and automation. Red team at heart, purple team in practice.

What you’ll be working on:

• Offensive testing: Attack Apify the way a real attacker would: the platform (multi-tenant isolation, Actor sandboxing, Apify Proxy, API, Console), AI agents and MCP servers (prompt injection, tool poisoning, data exfiltration), our supply chain and CI/CD (dependencies, GitHub Actions, open-source projects like Crawlee), and AWS (IAM, network, logging).

• AI-assisted security work: Use AI tools daily for pentesting, recon, code review, exploit development, and research.

• Security research: Follow new vulnerabilities, attack techniques, and threat actor activity. Assess what they mean for Apify and act on them fast.

• Threat modeling: Map realistic attack paths for new features and architectural changes before they ship.

• Vulnerability management: Triage, reproduce, and rate reports from researchers, pentesters, scanners, and your own testing. Agree on fixes with engineering, make sure they land within SLAs, and help run Apify's vulnerability program.

• Automation: Use scripting and AI to scale the program: triage pipelines, AI-assisted code review, advisory monitoring, and your own attack tooling.

• Detection and response: Hunt for signs of compromise and platform abuse, turn findings from hunting and attacking into detections, and support incident response.

Who we’re looking for:

• Experience: 3+ years in offensive security, penetration testing, security research, AppSec, or a closely related field.

• Attacker mindset: Hands-on experience finding and exploiting vulnerabilities in web applications and APIs, well beyond OWASP Top 10 checklists.

• Cloud: Hands-on experience securing and breaking AWS environments (IAM, CloudTrail, GuardDuty).

• Scripting or programming: You write your own tools and automation in Python, Go, Bash, or similar. Proficiency in Node.js/TypeScript is a plus.

• Tooling: Experience with Burp Suite or similar, vulnerability scanners, SAST/DAST, and GitHub's security features.

• AI: You use AI tools in your daily work and understand how LLMs and AI agents can be attacked.

• Curiosity: You follow the security community, read new research when it drops, and can't leave an interesting bug alone.

• Communication: You explain technical risks clearly to developers and leadership, and you work with engineers, not against them.

• Self-starter mentality: You find work on your own instead of waiting for tickets.

• Compliance (nice to have): Familiarity with frameworks like SOC 2 or ISO 27001.

Our tech stack:

• Security: AISLE, Claude Mythos, GitHub Advanced Security, in-house security Actors (the Apify platform scanning itself)

• Frontend: React.js, styled-components, Storybook, Chromatic, Cypress, Playwright

• Backend: TypeScript/Node.js, Nest.js, Next.js, Docusaurus, Vitest

• Infra: AWS Compute (Kubernetes (EKS), EC2, Lambda), Helm, Terraform, CloudFormation, MongoDB, Redis, DynamoDB, S3, GitHub Actions

• Monitoring: Grafana, Prometheus, OpenTelemetry, Mezmo, Sentry, PagerDuty

• Tools: GitHub, Notion, Google Workspace, Slack

• OS, code editor, and AI assistant of your choice (Claude premium with unlimited tokens, GH Copilot, Cursor, Gemini, or JetBrains AI)

• Process: two-week sprints, code reviews, tests, automating whatever we can, and deploying multiple times per day.

Why should you work at Apify?

• Space, support, and autonomy for personal growth, with a direct impact on our success

• Full-time position in our amazing offices in Prague (100Yards) or Brno (Titanium)

• Option to work fully remotely

• Flexible working hours (perfect for both night owls and early birds )

• Nobody counts holidays as long as the work gets done

• Unlimited Claude for every Apifier. We don't count tokens. Just use them well

• Stock options and profit sharing

• Free Apify credits for your friends and family to try the platform

• Free Multisport card

• Regular massages in the Prague office, mostly covered by Apify

• We welcome pets, kids, and bikes in the office

• Epic team buildings and offsites with biking, canoeing, and other adventures

• Solid education and training budget, conference tickets, internal “Eat & Learn” sessions, and the possibility to work across teams

• Generous hardware budget

• Free lunches every day when working from the office

• Unlimited supply of & and snacks

• Free entry to the wonderful Prague and Brno Zoo

• Ping-pong, chess, PS5, foosball league after lunch.

For more details about Apify and what it’s like to work with us, see our Careers page.