App Security Expert

What you'll do

You build the test material that AI security tools get graded against. Each piece is a small, purpose-built application fixture that either contains a real vulnerability or implements a secure solution, focused on OWASP's LLM risk list (Sensitive Information Disclosure and Excessive Agency are the two the ad names). For every fixture you write deterministic test cases, a security-context manifest describing what the app is supposed to do, and a hidden answer key that says whether the code is vulnerable and where.

Those keys are then used to score how well an AI model or a static analysis scanner (AI-SAST) tells vulnerable code from safe code. You also critique the pipeline that produces these tasks, pushing fixtures to be hard enough to separate good tools from weak ones while staying realistic. Agent-based application architecture, where an LLM can call tools and take actions, is part of the scope.

Who fits

• Around five years or more in application security, secure software development or security-focused engineering
• Working knowledge of OSWE-level web exploitation, LLM security and AI-SAST tooling
• Experience designing or reviewing security architecture for both traditional and agent-based applications
• Hands-on skill finding and fixing advanced vulnerabilities in real codebases
• Precise technical writing for documentation and peer review
• Experience with synthetic security fixtures or deterministic testing is called highly desirable

All of these are listed as preferred, and the ad says no prior AI experience is required, but the bar reads as senior.

What it pays

micro1 publishes $40–80/hour. The ad does not state whether pay is hourly or per task, weekly hours or project length. For the seniority described, the band is modest; it sits below micro1's Application Security Engineer (AppSec) ceiling of $100, though the floor is higher.

How it compares

The AppSec Engineer listing is mostly general coding-task and verifier authoring where security experience is a plus. This one is security work through and through: the fixtures, tests and answer keys are all about whether code is exploitable, with a specific focus on LLM-era risks.

Worth knowing

Good:

• Genuinely security-centric work, not general coding tasks with a security label
• LLM and agent security is a fast-growing specialism worth having on a CV
• No country restriction stated

Less good:

• $40–80/hour is low for five-plus years of AppSec experience
• Only 10 openings
• Pay structure and weekly hours are not published
• Contractor engagement: no benefits, your own tax to manage
• The customer is not named

About this listing

Posted by micro1 on its own jobs portal; we read the ad on 18 October 2026. The $40–80/hour band, 10 openings and the qualifications above are its published text. Location is "Remote" with no country named, so we have left eligibility open. See micro1.