Staff Application Security Engineer

BambooHR is hiring a Staff Application Security Engineer to lead application security for AI features and agentic systems, with a focus on standards, reviews, and SDLC integration.

Responsibilities

• Lead security reviews and threat models for AI features and agentic systems, including autonomous agents, MCP servers, and third-party integrations
• Maintain and update review playbooks and quality criteria as threat landscapes evolve
• Set BambooHR security standards for AI agents covering:
  • Identity and delegated authorization
  • Tenant- and user-scoped data access
  • Safe handling of tool output
  • Tool supply chain risk
  • Human-approval requirements
• Own agent designs used by the security team for validation, triage, review assistance, and remediation
• Build and ship agent-assisted capabilities with clear evaluation criteria, bounded permissions, and human approval gates for high-impact actions
• Support developers and security champions with self-serve guidance and tooling, and advocate for engineering investment needed to operationalize work
• Embed AppSec requirements into the SDLC with design-time and release-time gates for AI features
• Make agent-assisted code review, finding validation, and fix suggestions a default part of CI/CD pipelines with blocking criteria and a fast exception path
• Run AppSec programs across teams and quarters by setting goals, milestones, and success metrics; managing a lightweight intake and prioritization cadence; coordinating dependencies across engineering, product, and operations; and reporting progress, risks, and tradeoffs to leadership
• Represent AppSec in architecture forums, harmonize security requirements to reduce duplicated effort, serve as an escalation point, and coach leaders on security tradeoffs
• Partner with Legal, Privacy, and GRC to apply AI governance through guardrails and automation, including for emerging AI regulations
• Train and coach software engineers and engineering teams on secure design and threat modeling, with emphasis on authentication, authorization, multi-tenancy, and AI features
• Mentor security engineers on technical direction and career growth; close skill gaps through onboarding, training, and mentorship
• Participate in an on-call rotation as needed to support incident response and resolve escalated security issues

Requirements

• Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent practical experience
• 8+ years of experience in security, including 5+ years hands-on application security experience
• Experience securing multi-tenant SaaS platforms, including tenant isolation
• Cloud and infrastructure security experience (e.g., AWS, Azure, GCP)
• Hands-on experience building AI agents or agentic workflows, including concrete examples of permissions, failures, and validation (production systems, internal tools, personal or open-source projects, and substantial prototypes all count)
• Demonstrated ability to evaluate security of AI and agentic systems, including:
  • Prompt injection
  • Tool and context poisoning
  • Excessive agency
  • Delegated authorization
  • Data leakage
  • Supply-chain risk in models and tools
• Familiarity with OWASP Top 10 for LLM Applications, OWASP Top 10 for Agentic Applications, or comparable frameworks
• Ability to design evaluations for agentic workflows covering task success, false positives and negatives, adversarial cases, and regression checks
• Proven experience leading threat modeling (e.g., STRIDE, attack trees) and design reviews for complex applications and APIs
• Deep understanding of web application and API security, including authentication and authorization (OAuth 2.0 scopes and delegation, OpenID Connect, token audience and validation), session management, and access control models
• Strong software engineering skills in at least one language (e.g., Python, TypeScript, PHP), including testing and maintaining tools others depend on
• Track record of influencing without authority through cross-team initiatives, business cases, and clear communication of technical risk to engineering, product, legal, and leadership audiences
• Experience mentoring engineers, formally or informally
• Sound judgment in ambiguous situations, including the ability to explain tradeoffs, recommend mitigations, and bring risk-acceptance decisions to the right owner

Technologies

• AWS
• Azure
• GCP
• Python
• TypeScript
• PHP
• OAuth 2.0
• OpenID Connect
• OWASP Top 10 for LLM Applications
• OWASP Top 10 for Agentic Applications
• STRIDE
• MCP servers

Benefits

• Comprehensive health, life, and disability insurance
• Generous leave policies including 4 weeks of vacation, 12 company holidays, parental leave, and volunteer time off
• 401k plans with up to 6% company match
• $2000 Paid-Paid Vacation bonus
• EAP through Headspace

What Would Make You Stand Out

• Experience securing MCP servers and gateways
• Experience securing AI coding assistants or developer agent tooling at organizational scale, or integrating AI-driven security checks into CI/CD pipelines
• Familiarity with AI governance and SaaS compliance frameworks (e.g., NIST AI RMF, ISO/IEC 42001, EU AI Act, SOC 2, ISO 27001)
• Relevant security certifications (e.g., CSSLP, OSWE, GWAPT)
• Experience building or running security champions programs, such as recruiting and training champions or embedding security advocates in engineering teams

Location and Employment Notes

• Location: Draper, UT (remote)
• This is a remote position available in the state listed on the job
• Employment with BambooHR is contingent on passing both a background and credit check