Staff Application Security Engineer

Role overview Set application security direction across product, platform, and AI-enabled systems, while remaining hands-on with the hardest security problems. You’ll guide engineering teams toward secure defaults, address vulnerabilities at their root causes, and establish standards and shared tools that help security practices scale across teams.

Responsibilities - Translate a multi-year application security strategy into cross-team initiatives, track outcomes and risks, and influence engineering, product, platform, and data roadmaps. - Define secure design, code review, and risk standards, including expectations for code created with AI tools or agents; mentor senior engineers and support security champions. - Lead threat modeling and architecture reviews for complex systems, including AI and agent features, and develop approaches for problems without established patterns. - Create and drive adoption of shared security components, such as authorization controls, safe token handling, and protections for outbound HTTP requests. - Guide vulnerability management across reviews, penetration tests, bug bounty findings, dependency analysis, and runtime alerts; prioritize root causes and risk-based remediation. - Investigate difficult cases through code review, exploit development, bypass testing, and coordinated remediation; build AI-assisted security workflows and define protections for AI inputs, outputs, tools, and data flows.

Requirements - A record of leading application security strategy that changed how multiple engineering teams work and produced measurable results, typically supported by 10 or more years in software engineering or application security. - Strong secure architecture, authentication, and authorization expertise, including experience creating security components adopted by other teams. - Practical code review, penetration testing, and exploit development skills, including finding design flaws in unfamiliar code and validating fixes against bypasses. - Ability to ship production software; Ruby or Ruby on Rails is valuable, and Python is useful. Strong Linux and cloud fundamentals are expected, ideally including GCP and Kubernetes. - Hands-on experience securing AI-powered systems or agent features, with sound risk judgment and the influence to align technical and non-technical leaders.

Nice to have Experience securing AI products or scaling developer security programs; public security contributions or certifications such as OSCP or OSWE. Familiarity with React, Ruby, Python, MongoDB, Elasticsearch, Kubernetes, Docker, Terraform, and GCP is useful.

Benefits and work setup The listed US cash compensation range is $225,400–$281,800. Additional benefits may include equity, bonus, retirement savings, paid holidays, flexible time off, parental leave, wellbeing support, insurance, and healthcare accounts; details can vary by location and eligibility.