Application Security Engineer

LangChain is seeking a hands-on security leader embedded with core product teams to protect agentic workloads end to end across its SDK ecosystem and customer integrations. This onsite role in San Francisco, CA focuses on building practical application and infrastructure security controls, strengthening authN/Z and tenant isolation, and improving hardening, incident readiness, and vulnerability management. You will also help set and drive the security roadmap across LangSmith, LangGraph, and the LangChain SDK ecosystem (Python/TS/Go).

Benefits

• Health and dental coverage
• Medical, dental, and vision coverage
• Flexible vacation
• 401(k) plan
• Life insurance
• Meals on in-office days in the US
• Locally competitive benefits for EU/UK/APAC aligned with regional norms and regulations

Responsibilities

• Own product and platform security by designing and driving application and infrastructure security controls across LangSmith, LangGraph, and the LangChain SDK ecosystem (Python/TS/Go).
• Implement secure-by-default authN/Z, evolving SSO/SAML/OIDC/SCIM, token lifecycles, service-to-service authentication, and tenant isolation for both cloud and self-hosted customers.
• Ship code and security reviews by landing secure designs, writing PRs, and introducing lightweight checks such as linters and dependency or supply-chain scanning, including SBOM and SLSA-style provenance.
• Improve hardening and operations with Zero Trust approaches, network segmentation, Kubernetes posture improvements, secrets management, key rotation, least-privilege IAM, and egress controls.
• Strengthen incident readiness by building IR runbooks, creating detection rules, running tabletop exercises, and leading post-incident forensics and blameless RCAs.
• Own vulnerability management with scanning, triage, and patch SLAs, coordinating with engineering to remediate quickly without slowing delivery.

Requirements

• 5+ years in security engineering with strong software skills (Python or Go; TypeScript is a plus).
• Depth in cloud and Kubernetes security, including GCP/AWS IAM, workload identity, admission controls, and network policies.
• Hands-on AppSec across code review, threat modeling, secure design, secrets and key management, authN/Z patterns, and multi-tenant isolation.
• Experience building detection and response and running incident management.
• Familiarity with supply-chain security, including SBOM and sigstore/cosign and SLSA-style controls, plus dependency risk management.
• Clear, pragmatic communication with engineers and customers.

Technologies

Python, TypeScript, Go, LangSmith, LangGraph, LangChain, SSO, SAML, OIDC, SCIM, SBOM, SLSA, sigstore/cosign, Kubernetes, GCP, AWS, IAM, workload identity, admission controls, network policies, Zero Trust.

Nice to Have

• Security for SaaS and self-hosted offerings, including air-gapped deployments.
• Exposure to SOC 2 / ISO 27001 programs and evidence automation.
• Experience with Go services and Infra as Code (Terraform/Helm), plus policy-as-code (OPA/Gatekeeper/Kyverno).
• Knowledge of privacy patterns such as data minimization, retention, masking, and workspace scoping.

Compensation & Benefits

Annual salary range: $175,000-$215,000 USD for Senior Engineers.

Compensation includes base salary, meaningful equity, and benefits such as health and dental coverage, flexible vacation, a 401(k) plan, and life insurance. EU and UK team members receive locally competitive benefits aligned with regional norms and regulations.