Staff Application Security Engineer

What you'll do

• Define security standards, architectural patterns, and secure-by-default solutions for engineering teams to adopt independently.
• Build scalable security tooling and automation to improve detection capabilities and measure the adoption of secure defaults.
• Lead threat modeling and risk assessments for high-risk features and complex platform changes.
• Develop strategies to mitigate risks introduced by agentic development practices and AI-powered product features.
• Conduct security code reviews and partner with engineering teams to remediate critical threats and define API standards.
• Identify systemic risks and lead multi-team remediation efforts from inception to completion.
• Serve as the primary subject matter expert for complex cross-domain security problems involving multiple departments.
• Mentor and develop the skills of other application security engineers through design reviews and documentation.

What we're looking for

• Software engineering background with hands-on code review experience in Go (preferred), Python, or Rust.
• Solid grounding in OWASP Top 10, web vulnerabilities, SAST, and DAST.
• Working knowledge of API security including authentication flows, authorization patterns, and input validation.
• Experience leading threat modeling for complex systems and translating outcomes into architectural decisions.
• Experience implementing secure-by-default frameworks and integrating security into core platforms.
• Familiarity with software supply chain security, including dependency management and artifact integrity.
• Ability to translate business risk into investment priorities and communicate clearly to executive audiences.
• Demonstrated ability to mentor engineers through design reviews and high-quality documentation.