Staff Application Security Engineer

What you'll do

• Set and advance AppSec strategy, standards, and cross-team initiatives; influence engineering roadmaps and mentor security engineers and champions.
• Lead architecture reviews, threat modeling, vulnerability investigation, exploit development, and risk-based remediation for complex systems.
• Apply AI and automation to AppSec workflows and define security approaches for AI systems and agent features.

What they ask for

• Track record of leading AppSec strategy across multiple engineering teams with measurable results; typically backed by 10+ years in software engineering or application security.
• Expertise in code review, penetration testing, and exploit development, plus strong software development skills and ability to ship production code.
• Deep experience in secure architecture, authentication and authorization, and security building blocks adopted by other teams.
• Hands-on experience securing AI-powered systems or agent features.

Nice to have

• Ruby and Ruby on Rails experience; Python is a plus. Strong Linux and cloud fundamentals, ideally GCP and Kubernetes.
• Experience with AI-native product security, security champions or developer enablement; public security work or OSCP/OSWE certifications.

Pay

$259,200 — $324,100 USD (total cash compensation); $225,400 — $281,800 USD (total cash compensation)

Tools

React, Ruby, Ruby on Rails, Python, MongoDB, Elasticsearch, Kubernetes, GCP

AI focus

Use AI and agents for code review, threat modeling, triage, and remediation; secure AI systems and agent features, including their APIs, prompts, tool permissions, and data-exfiltration paths.