Staff Application Security Engineer
Leads application security strategy, defines secure frameworks and standards, builds scalable tooling, conducts threat modeling, and mentors engineers. Requires software engineering experience with code review in Go/Python/Rust and deep knowledge of web vulnerabilities, API security, and OWASP practices.
About the job
What You’ll Do
- Define and drive security standards and secure-by-default solutions, serving as the Application Security subject matter expert.
- Build security tooling and automation that scales security practices across engineering teams, and implement robust security observability to support our threat detection team with meaningful, actionable security signals.
- Lead threat modeling and risk assessment for high-risk features and platform changes.
- Assess and address security risks introduced by agentic development practices and AI-powered product features in production.
- Partner with engineering teams to prioritize and remediate critical threats, define API security standards, and conduct security code reviews.
- Identify systemic security risks; lead complex, multi-team remediation efforts end-to-end.
- Partner with Cloud & Infrastructure Security and other teams across the org on cross-domain problems; be the AppSec point of contact on complex cross-domain problems.
- Serve as the AppSec subject matter expert across Datadog; be the person engineering leadership calls when they need clarity on a hard security problem.
- Deeply invest in the growth of AppSec engineers on the team.
Who You Are
- Software engineering background with hands-on code review experience; Go (preferred), Python, or Rust.
- Demonstrated ability to level up the engineers around you: through design reviews, mentorship, and the quality of your documentation.
- Solid grounding in OWASP Top 10, web vulnerabilities (XSS, injection, access control, cryptography), SAST, and DAST.
- Working knowledge of API security: authentication flows, authorization patterns, and input validation at API boundaries.
- Track record of leading threat modeling on complex, multi-team systems and translating outcomes into architectural decisions.
- Experience implementing secure-by-default frameworks and integrating security into core platforms alongside product managers and engineering teams.
- Able to translate business risk into security investment priorities and communicate tradeoffs clearly to executive audiences.
- Familiarity with software supply chain security: dependency management, artifact integrity, and build pipeline trust.
- Bias toward implementing solutions and driving adoption, not just surfacing findings.
- Proven track record of winning buy-in from technical and non-technical stakeholders; able to communicate complex tradeoffs clearly to engineers, product managers, and leadership.
- Current on security best practices, emerging threats, and the tooling landscape.
Skills
Go, Python, Rust, Owasp Top 10, SAST, DAST, Api Security, Threat Modeling, Software Supply Chain Security, Datadog
Similar jobs
Security Engineering jobs
Harvey
San Francisco, CA
Staff Security Software Engineer leading identity and access strategy, architecture, and hands-on platform development across customer, employee, contractor, and agentic identities. Requires 10+ years of production software experience and deep expertise in identity and authorization systems.
Gusto
San Francisco, CA
Own and scale IT general controls, access governance, segregation of duties, and audit readiness across enterprise applications. The role combines SOX expertise with AI-enabled continuous controls monitoring and requires 10+ years of controls, audit, or enterprise governance experience.
United States
Design and operate distributed, low-latency infrastructure that protects Reddit from DDoS attacks, bots, scraping, and other network threats. The role requires 7+ years of distributed-systems experience plus expertise in security, networking, and production operations.
Upside
Washington, DCStaff-level AppSec engineer building secure coding practices and vulnerability management for a commerce platform. Requires 6+ years in application security with deep AWS and Python experience.
Lob
United States
Own the technical security function across cloud infrastructure, detection and response, application security, incident response, and automation. The role requires 8+ years of security engineering experience, deep AWS expertise, and the ability to lead security improvements across engineering teams.