Trail of Bits

Security Engineer

• Independently lead security assessments of substantial client components, modules, or systems from scoping through delivery
• Find and validate vulnerabilities, establish root causes and exploitation paths, assess impact, and develop proof-of-concept code when appropriate
• Design and build custom security tools, harnesses, tests, and automation
• Review software architectures, attack surfaces, data flows, trust boundaries, and privilege boundaries; recommend mitigations
• Produce clear, actionable findings and lead technical discussions with client engineering teams
• Review other engineers' code and analysis, share techniques, and improve the team's technical approach
• Contribute new methods, open-source tools, and technical writing to Trail of Bits and the broader security community
• Collaborate with project leads and security engineers while exercising independent technical judgment

Security Engineer II, Application Security

• Contribute to security assessments of client software and partner with experienced engineers.
• Lead review of a specific component, module, or system within larger client engagements.
• Trace root causes and own analysis from vulnerability discovery through client delivery.
• Find and validate vulnerabilities in application code and systems.
• Explain exploitation paths, assess impact, and develop proof-of-concept code when appropriate.
• Design and build security-testing tools and automation for vulnerability detection and deeper analysis.
• Review software architectures, identify attack surfaces, data flows, trust boundaries, and privilege boundaries.
• Recommend concrete security mitigations.
• Translate technical findings into clear, actionable recommendations for engineering teams.
• Explain evidence behind conclusions to clients.
• Contribute to security research, open-source tools, internal knowledge sharing, and technical documentation.

Security Engineer I, Application Security

• Lead cryptographic assessments of protocols, libraries, and application code.
• Identify design and implementation weaknesses, validate exploitability, and recommend practical fixes.
• Analyze standardized symmetric and asymmetric cryptography, post-quantum schemes, zero-knowledge proof systems, and multi-party computation protocols.
• Create or extend tools, test harnesses, and proofs of concept for cryptanalysis and implementation review.
• Plan work, surface risk early, lead technical discussions, and produce precise client reports.
• Independently lead substantial portions of client engagements as a senior individual contributor.
• Contribute to scoping, methodology, mentoring, research, tooling opportunities, open-source projects, technical publications, and presentations.
• Collaborate with the Cryptography practice, Assurance team, client engineers, researchers, and other stakeholders.
• Lead assessments from initial threat model through client readout.
• Help clients make defensible engineering decisions about risk and remediation.

Senior Security Engineer, Cryptography

Solutions Engineer

• Join findings readouts and own expansion planning after engagements
• Own technical continuity for named accounts
• Join or lead technical office hours and working sessions
• Support the PMO on technical escalations
• Own the technical portion of business reviews for strategic accounts
• Build multi-year security roadmaps for named accounts
• Provide technical input to account teams, account planning, and portfolio strategy
• Identify single-practice clients who could benefit from broader firm services
• Convert post-engagement needs into scoped work, including fix reviews, differential reviews, follow-ons, retained advisory, and multi-phase programs
• Design and price cross-practice programmatic engagements
• Help shape milestone- and outcome-based engagement models
• Handle complex pre-sales involving cross-practice engagements, multi-year programs, and ambiguous client needs
• Refine service offerings with Sales Engineering, Engineering Directors, and GTM leadership
• Iterate agentic tooling for scoping and account planning
• Document learnings and define how the new role evolves

Security Engineer II, Application Security

Security Engineer I, Application Security

Senior Security Engineer, Cryptography

Solutions Architect