Principal Security Engineer

Responsibilities

• Lead threat modeling and product security reviews for high-risk SaaS features, deriving abuse cases, test scenarios, security requirements, findings, and remediation timelines.
• Define the product security review service model, triage criteria, enforcement posture, and design-phase engagement process.
• Define and drive AI security risk assessment, monitoring, and mitigation methodology across products, engineering teams, and third-party AI integrations.
• Evaluate AI-assisted security review capabilities, build-versus-buy tradeoffs, detection value, and toolchain coverage.
• Set technical direction for AppSec SDLC controls, including secure coding guidelines, CI/CD pipeline security, SAST, SCA, secrets, and IaC scanning.
• Build AppSec standards, runbooks, and documentation that improve consistency and reduce single points of failure.
• Mentor AppSec team members on threat modeling and security review design and influence product and engineering leadership on architecture and risk decisions.
• Conduct architecture reviews and targeted manual code reviews and drive remediation through implementation.

Requirements

• 10+ years of application security experience with sustained technical leadership in product security or AppSec engineering, including ownership of threat modeling programs and security review services at scale.
• Ability to operate threat modeling as a systematic STRIDE- and architecture/data-flow-driven practice embedded in design cycles.
• Hands-on experience securing AI-integrated applications, including LLM workflows, agentic systems, model APIs, and MCP-based integrations, with knowledge of the OWASP LLM Top 10 and current AI attack classes.
• Experience with architecture review, targeted manual code review, and driving remediation requirements through implementation.
• Experience mentoring engineers and establishing security requirements as design-phase gates across engineering teams.
• Depth in SAST, SCA, secrets, IaC scanning, modern CI/CD pipelines, cloud security fundamentals, secure coding standards, and toolchain direction.
• Fluency in one or more modern languages, including Python, Java, TypeScript/JavaScript, Go, or equivalent, and ability to read production code and extend maintainable automation.
• Ability to communicate security risks and requirements clearly from engineering individual contributors through executive leadership and build trusted cross-functional relationships.
• Legally eligible to work in the U.S. on an ongoing basis.
• GitLab CI/CD experience with security policy pipeline configuration and scanning job integration is preferred.
• Experience building AI-assisted security tooling or LLM-integrated review workflows is preferred.
• Penetration testing experience, including exploit writing or vulnerability chaining, is preferred.
• Public security contributions such as conference speaking, CVE credits, published research, or industry recognition are preferred.

Benefits

• Employer-subsidized medical, vision, and dental coverage for full-time employees.
• 401(k) match of 50% of employee contributions up to the first 6% of eligible pay.
• Monthly stipend supporting work and productivity.
• Flexible Time Away Program and sick time off.
• Employer-sponsored life insurance and short- and long-term disability coverage for US employees.
• 12 paid holidays per year for US employees.
• Up to 24 weeks of parental leave.
• One paid volunteer day.
• Professional growth opportunities, including access to Udemy online courses.
• Company-funded perks including counseling membership, local retail discounts, and a personal Smartsheet account.
• Bellevue, WA office or remote work from any registered US location, depending on role eligibility.