Startups · updated daily
Application security startups hiring now
The application security startups hiring the most right now are Aikido Security, Chainguard and Endor Labs. 42% of their open roles are in engineering. 61% of these companies hire mostly remote. Most are based in San Francisco, Palo Alto and Burlington. Every role here comes from the company’s own careers page and is re-checked daily.
42%
of roles in engineering
25%
of roles in sales and gtm
7%
of roles in product and design
2%
of roles in people and finance
2%
of roles in ai and ml
Companies
Who is hiring
Aikido Security
Ghent, BE · Series B
Aikido Security provides a unified security platform that scans source code and cloud infrastructure to identify security vulnerabilities.
79 open roles35% remote
Chainguard
Kirkland, US · Series D
Chainguard provides hardened, secure, and production-ready builds of open source software. Its container catalog builds over 2,200 upstream projects into container images and maintains over 30,000 OS packages.
71 open roles100% remote
Endor Labs
Palo Alto, US · Series B
The platform uses reachability analysis to cut through noise and offers SAST, secrets detection, SCA, malicious package detection, AI governance, and container scanning.
31 open roles86% remote
Zimperium
Dallas, US · Private Equity
Zimperium provides AI-empowered mobile security for mobile applications and devices.
20 open roles70% remote
Salt Security
Palo Alto, US · Series D
Salt Security provides an Agentic Security Platform that secures LLMs, AI agents, MCP servers, and APIs.
13 open roles100% remote
Veracode
Burlington, US · Private Equity
Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, Malicious Package Detection, and Penetration Testing.
12 open roles100% remote
GitGuardian
Paris, FR · Series C
GitGuardian is a secrets and Non-Human Identity (NHI) security platform that detects and prevents hardcoded secrets like API keys and database credentials.
12 open roles0% remote
Semgrep
San Francisco, US · Series D
Semgrep is an application security platform that provides static application security testing (SAST), software composition analysis (SCA), and secrets detection. It identifies vulnerabilities in source code without executing it.
10 open roles20% remote
Finite State
Columbus, US · Series B
Finite State provides an autonomous product security platform for connected devices and embedded systems.
10 open roles100% remote
Mend
Boston, US · Series E
Mend.io is the security platform built for every risk, across application security and AI security — securing the code layer, the AI layer, and the attack surface between them. Mend.io offers the first AI native application security platform, empowering organizations to build and run a proactive AppSec program tuned for AI powered development.
9 open roles78% remote
Legit Security
Tel Aviv, IL · Series B
Legit Security delivers an AI-native ASPM platform that automates AppSec issue discovery, prioritization, and remediation. The platform provides full management from AI-generated code to deployment, helping customers analyze their software risk, fix it with agents, and secure code during generation.
9 open roles11% remote
Bugcrowd
San Francisco, US · Late Stage Venture
The company offers Bug Bounty, Vulnerability Disclosure, Pen Testing as a Service, and Red Team as a Service programs.
8 open roles88% remote
Trail of Bits
New York, US · Bootstrapped
Provides application-security and cryptography services to organizations.
7 open roles100% remote
Kodem
Tel Aviv, IL · Series A
Kodem provides an application security platform that integrates SAST, SCA, Container Security, and ADR. It uses runtime intelligence to determine actual application risk and reduce false positives.
7 open roles0% remote
Apiiro
New York City, US · Series B
Apiiro is the Agentic AppSec Platform built to transform how development teams design, develop, and deliver secure software. Apiiro Guardian Agent prevents vulnerable and non-compliant code before it exists, protects coding agents from attacks, AutoFixes the backlog, and consolidates AppSec into a single control plane.
5 open roles
XBOW
Seattle, US · Series C
XBOW offers autonomous offensive security software designed to identify and validate software vulnerabilities.
4 open roles100% remote
Cobalt
San Francisco, US · Series B
Customers can start a pentest in as little as 24 hours and integrate with development cycles.
4 open roles100% remote
Prime Security
Series A
Prime Security provides AI software that helps teams manage security throughout software development.
4 open roles
ArmorCode
palo alto, US · Series B
ArmorCode helps enterprises manage security risk and governance across heterogeneous technology environments. Its Agentic AI Platform gives security teams a system of action for unified exposure management across Application Security Posture Management, Vulnerability Management, Software Supply Chain Security, and AI Exposure Management.
3 open roles100% remote
Konvu
New York, US · Seed
Konvu builds AI agents that triage software vulnerabilities in existing security tools, with evidence for every decision.
2 open roles
FOSSA
San Francisco, US · Series B
FOSSA is a leading SBOM and software supply chain risk management platform. It helps enterprises generate, ingest, analyze, and operationalize SBOMs in multiple formats. It also offers comprehensive SCA capabilities, including automated open source license compliance management and vulnerability prioritization solutions.
2 open roles
GitLab
San Francisco, US · Post Ipo
GitLab is the intelligent orchestration platform for DevSecOps. It provides a complete software development lifecycle toolchain including source control, CI/CD, security scanning, and project management in a single application.
205 open roles99% remote
Black Duck
Burlington, US · Private Equity
Black Duck provides application security testing solutions including SAST, SCA, and DAST. Its Black Duck Signal product is an agentic AI AppSec solution. The company serves Global 2000 enterprises across financial services, technology, healthcare, and government sectors.
38 open roles53% remote
Open roles
Newest roles at these startups
Chainguard
New York - Remote
Senior Partner Manager - NY Metro
New York - Remote
$145k–$170k
1d ago
GitLab
Remote, United States
Strategic Account Executive - Chicago
Remote, United States
$115k–$172k
1d ago
GitLab
Remote, United States
Corporate Development Director
Remote, United States
$168k–$286k
1d ago
Finite State
Washington DC
Senior Security Product Consultant- Advisory
Washington DC
—
1d ago
GitLab
Remote Ireland
Renewals Manager EMEA
Remote Ireland
—
1d ago
Aikido Security
Ghent
Forward deployed engineer
Ghent
—
1d ago
Endor Labs
Remote - US
Staff Product Security Engineer
Remote - US
—
2d ago
Bugcrowd
Huntsville, Alabama
Staff Software Engineer (Security Clearance Required)
Huntsville, Alabama
$151k–$189k
2d ago
What application security startups build
Companies working in application security. Aikido Security: Aikido Security provides a unified security platform that scans source code and cloud infrastructure to identify security vulnerabilities. Chainguard: Chainguard provides hardened, secure, and production-ready builds of open source software. Its container catalog builds over 2,200 upstream projects into container images and maintains over 30,000 OS packages. Endor Labs: The platform uses reachability analysis to cut through noise and offers SAST, secrets detection, SCA, malicious package detection, AI governance, and container scanning.
The roles they hire for
Across the roles open today, the mix is engineering (42%), sales and gtm (25%), product and design (7%), people and finance (2%) and ai and ml (2%). Engineering roles here often ask for hands-on work with the product's hardest part, so a portfolio or a shipped project counts for more than a long resume.
How to get hired at application security startups
These teams hire fast and from their own careers pages, so the first applications get read first. Apply in the first day a role is up, tailor your resume to the role's own words, and answer the screening questions like you already work there. landed does all three for you: it watches every company on this page and applies the moment a fitting role goes up.
landed applies. You interview.
Let landed apply to application security for you
landed watches every company on this page and applies the moment a fitting role goes up, with a tailored resume and answers for the role. 25 free applications, no card.
Frequently asked
Which application security startups are hiring the most?
Right now: Aikido Security, Chainguard, Endor Labs, Zimperium and Salt Security. The list above ranks every company by the roles it has open today.
Do application security startups hire remotely?
61% of the companies here hire mostly remote. Each company page shows its own remote share.
What roles do application security startups hire for?
The most common are engineering, sales and gtm and product and design.
Can landed apply to application security startups for me?
Yes. landed watches every company on this page, applies on each company’s own site the moment a fitting role goes up, and writes the answers for every role. Your first 25 applications are free.