AppSec Architect

Elementor's Security Team protects a platform that powers over 14% of the internet - millions of websites, apps, and businesses built by our community of creators. We combine classic security engineering with modern automation and AI-driven tooling to stay ahead of a fast-moving threat landscape, and we work hand-in-hand with R&D to build security into the product from day one.

About the Role

As an AppSec Engineer, you'll be the security partner for our R&D teams - reviewing code and architecture, closing the loop on vulnerabilities, and helping developers ship secure features faster. You'll also own our external vulnerability disclosure channels end-to-end, including leading our Bug Bounty program. This role is a great fit if you have a development background, enjoy digging into code, and want to use AI tools and agents to scale security impact across a large, fast-growing platform.

• 2-4 years of experience in Application Security, Security Engineering, or Software Development with a strong security focus.

• Development experience is a clear advantage - a hands-on coding background in any modern language or stack.

• Solid understanding of common web and application vulnerability classes (e.g., OWASP Top 10).

• Experience with Application Security Testing tools (such as burp suite, CI/CD pipeline security rule configuration etc)

• Experience with SAST/DAST/SCA tools and integrating security into CI/CD pipelines.

• Hands-on, practical familiarity with AI tools and building AI agents for real workflows.

• Basic coding and scripting skills (Python, Bash, JavaScript, or similar).

• Strong communication skills and the ability to work closely with developers and cross-functional teams.

Skills & Mindset

• Ownership mindset - comfortable leading an initiative (like the Bug Bounty program) end-to-end.

• Ability to work independently, prioritize, and stay calm under pressure.

• Clear communicator who can translate security findings into practical action for developers and stakeholders.

• Curiosity for AI tooling and a drive to automate repetitive work.

Nice to Have

• Prior experience running or participating in a Bug Bounty / responsible disclosure program.

• Experience with vulnerability disclosure or WAF/plugin security platforms such as Patchstack, Bugcrowd, or Wordfence.

• Familiarity with n8n, Zapier, or building custom AI agents for security automation.

• Experience with cloud security fundamentals (AWS, Azure, or GCP)