Staff Application Security Engineer

Role overview Guide product and engineering teams in building secure software and operating a secure development pipeline. This staff-level role sets security direction across teams, addresses risks throughout cloud and open-source products, and develops guarded AI-assisted security workflows.

Responsibilities - Integrate security into product architecture and development in partnership with engineering teams. - Lead threat modeling and risk assessments across the product surface, identifying vulnerabilities and attack paths. - Set security strategy and influence technical direction across multiple teams or the broader organization. - Manage code security and third-party software supply-chain controls in the secure development pipeline. - Turn emerging guidance on application and AI-related security into practical internal policies. - Coordinate response to disclosed vulnerabilities in cloud and open-source products, and participate in an on-call rotation.

Requirements - At least 7 years in application security, product security, or a related field; a relevant degree or equivalent experience. - Experience partnering with engineering teams throughout planning and development to address security concerns. - Ability to write production-quality code in at least one language, beyond scripting. - Knowledge of encryption, authentication, and secure communication protocols, plus familiarity with SAST, DAST, or penetration-testing tools. - Strong understanding of application architecture and ability to identify vulnerabilities across programming languages. - Experience securing Kubernetes environments, including workload hardening, RBAC, and admission controls. - Experience with multi-tenant security, including isolation between tenants and protection against cross-tenant data exposure. - Clear communication skills for explaining complex security topics to non-technical stakeholders.

Nice to have - Distributed systems security experience, Go familiarity, or experience running a Security Champions program. - Open-source security automation, expertise in other security areas, or conference talks and published research.