Retool
Product Security Engineer
San Francisco, United States · On-site · Full-time · Posted Mar 21, 2026
- Experience
- 5+ years of hands-on application security and security engineering experience.
- Visa sponsorship
- Retool is set up to employ all roles in the US and specific roles in the UK; consult the careers page for roles available in the UK.
About the job
Build and ship code-level security solutions, tooling, and processes that protect Retool’s platform and customer data while helping engineering teams make secure development the default.
What you'll do
- Identify systemic security gaps and build durable tooling, automation, and controls to prevent classes of vulnerabilities.
- Conduct code and security design reviews, threat modeling, and security assessments; turn findings into practical engineering guidance.
- Triage and drive vulnerability remediation, contribute to penetration testing and bug bounty programs, and help adapt security practices to AI-assisted development.
What they ask for
- 5+ years of hands-on application security and security engineering experience, including building security solutions.
- Track record of shipping security tooling or automation that improved security across multiple teams.
- Ability to read, review, and reason about code to find bugs and understand root causes; strong application security fundamentals.
- Productive in TypeScript and Python.
Nice to have
- Offensive security experience such as bug bounty, CTF, red team, or penetration testing.
- Experience with SAST pipelines, custom static analysis rules, or automated security testing infrastructure; startup or high-growth scaleup experience.
Tools
TypeScript, Python, SAST
AI focus
Use AI to enhance and scale security work, including finding and fixing vulnerabilities and automating dependency management; address security risks from faster, higher-volume AI-assisted development.
Model-written summary · the original posting is authoritative