micro1 role
App Security Expert at micro1
Security engineers build small sample applications that contain planted vulnerabilities or secure fixes, drawing on LLM application risks like data leakage and excessive agency. They also write test cases and hidden answer keys so AI tools and scanners can be judged on telling vulnerable code from safe code.
Referral link. If micro1 hires you through this link and you meet its conditions, we may be paid a referral fee.
What you would do
- Build compact application fixtures with embedded flaws or secure implementations
- Develop repeatable test cases plus security-context manifests
- Create hidden answer keys for scoring AI or scanner results
- Document methods and review peers' contributions in writing
What the listing asks for
- Preferred: around 5 or more years in AppSec, secure development or CyberSWE roles
- Preferred: grounding in OSWE, LLM security, AI-driven static analysis and AppSec best practice
- Preferred: experience securing and testing codebases and fixing advanced vulnerabilities
- Preferred: experience with synthetic fixtures and deterministic testing
- Preferred: precise technical documentation skills
Suits professionals who have several years in application security and can design realistic vulnerable examples and explain findings in writing.
The listing as micro1 posted it
This is micro1's public listing for the role, read October 29, 2026, with dashes and placeholder links cleaned up. The listing is micro1's text; the summary above and everything below it is ours.
Role Title: App Security Expert
Role Type: Contractor
Location: Remote
micro1 is engaging App Security Experts to contribute to a customer’s dynamic project focused on real-world application security. In this role, you'll apply your expertise to help train next-generation AI systems. Your work will shape how models learn, reason, and perform through high-quality, real-world input. No prior experience in AI is required - your domain knowledge is what matters.
Scope of Work
- Design and implement small, purpose-built application fixtures with embedded security vulnerabilities or secure solutions, specifically addressing OWASP LLM risks such as Sensitive Information Disclosure and Excessive Agency.
- Develop deterministic test cases and security-context manifests to robustly assess application security posture.
- Create detailed hidden answer keys to enable accurate AI or scanner evaluation of vulnerable versus secure code.
- Evaluate and iterate on pipeline methodologies to ensure synthetic tasks and fixtures are challenging yet realistic for AppSec assessment.
- Document technical insights and methodologies, ensuring clarity in written feedback and communication.
- Collaborate through clear and thorough written and verbal communication to share findings and review peer contributions.
- Engage with agent-based security architecture and contribute to continuous improvement of the evaluation pipeline.
Preferred Qualifications
- Extensive experience (ideally 5+ years) in application security, secure software development, or CyberSWE roles.
- Strong understanding of OSWE, LLM security, AI-powered static analysis (AI-SAST), and AppSec best practices.
- Proven track record designing or evaluating security architecture for traditional and agent-based applications.
- Expertise in building, securing, and testing application codebases, including identifying and remediating advanced vulnerabilities.
- Exceptional written and verbal communication skills, with a focus on precise technical documentation and collaborative feedback.
- Experience with synthetic security fixtures and deterministic testing approaches is highly desirable.
- Demonstrated ability to deliver thoughtful insights and actionable security recommendations in a remote contribution context.
Referral link. We may be paid a referral fee.
Pay and terms
The listing does not state a rate for this role. micro1's expert guide describes pay in bands by type of work rather than per role, so treat any figure you see elsewhere as unconfirmed until it appears in your contract.
micro1 engages experts as contractors. Its help library says payments are made in USD twice a month and that contracts and payroll run through Deel. Payments cannot be processed until identity verification there is complete. Read our micro1 review for what workers say about project availability and support.
Before you apply
Engineering listings usually ask for years of professional experience, and some ask for a public code history such as open-source commits. Have your profile or repositories ready to link.
Applying starts with an AI interview, then certification, then matching to projects by recruiters. micro1 says certification does not guarantee a project, so treat this as flexible work and not as a job offer. The how to become an AI trainer guide walks through each step.
Referral link. We may be paid a referral fee.
People also ask
What do application security engineers do?
On micro1's App Security Expert project, the work is building small sample applications with planted security flaws or secure fixes, aimed at OWASP LLM risks such as sensitive information disclosure and excessive agency. You also write deterministic test cases and concealed answer keys, which let AI tools and scanners be scored on telling vulnerable code from secure code.
What does an application security engineer do?
The micro1 listing frames the job as test-building and documentation: improving the pipeline that generates synthetic security tasks, writing up technical insights, reviewing peers' contributions and working with agent-based security architecture. It is a remote contractor role, and the listing says no prior AI experience is needed because domain knowledge is what matters.
Is AppSec entry level?
Not on this micro1 listing. It prefers extensive experience, ideally 5 or more years, in application security, secure software development or CyberSWE roles, plus an understanding of OSWE, LLM security and AI-powered static analysis. Experience with synthetic security fixtures and deterministic testing is highly desirable. No AI experience is required.
Can I make $200,000 a year in cyber security?
This site does not publish market salary data for cyber security, so it cannot say whether that is reachable. The micro1 listing for this App Security Expert role states no pay rate or weekly hours, and micro1 listings give rates for a project, not earnings. Contract work depends on being matched to projects, which is not guaranteed.
Can you make $500,000 a year in cyber security?
We give no general salary figures for cyber security, so we cannot confirm a number like that. This micro1 role is remote contractor work on small application fixtures, test cases and answer keys, and its listing states no rate. A project rate would not show annual earnings anyway, because hours are not guaranteed.
What is the average salary for an application security engineer in the US?
This site does not publish an average salary for application security engineers and gives no general figure. The micro1 listing for this App Security Expert role states no rate, and it is contractor work, not a salaried position. Preferred qualifications mention extensive experience, ideally 5+ years, in application security and secure software development.
How much does the App Security Expert role at micro1 pay?
The listing does not state a rate for this role, so we cannot give a figure. micro1's expert guide describes pay in bands by type of work rather than per role. Ask during onboarding, and read the contract before you accept work.
Is the App Security Expert role remote?
The listing calls it remote work and does not name a country limit. micro1 says it hires globally but cannot hire in a list of excluded countries, so read the eligibility line on the listing and in your application before you start.
How do I apply for the App Security Expert role?
Open the listing on micro1's site and apply there. Applying starts with an AI interview, followed by certification and matching to projects by recruiters. micro1 says certification does not guarantee a project. Our how to become an AI trainer guide covers each step.
Is this listing still open?
We read micro1's public listing on October 29, 2026. Roles close without notice, so confirm on the listing itself. If it has closed, the other software engineering roles on this site are linked below.
Related roles at micro1
More remote software engineer jobs
Related roles in other fields
All remote software engineer jobs · Every open micro1 role · Also browse careers at micro1, remote data scientist and ML engineer jobs, remote engineering and CAD jobs
Related guides
Sources and method
- micro1 public job listing for this role, read October 29, 2026. The summary, task and requirement lines are our paraphrase of that listing.
- The questions under People also ask: Google's related questions for this kind of role in the United States, as reported by Ahrefs, pulled October 29, 2026. Answers are ours, written from the listing and from our own sourced micro1 pages.
- micro1 help library and expert guide for payment timing and the hiring steps, read 17 October 2026.
Listings change without notice. If this page is out of date, tell us.
Referral link: we may be paid if micro1 hires you.