Staff security engineer, application security

WRITER is hiring a Staff security engineer focused on application security for enterprise AI applications. The role builds security foundations across the platform, including secure architectures, automated testing in CI/CD, and threat-informed practices for LLM-based systems.

Role Focus

Own security for WRITER’s application layer and AI infrastructure by integrating threat modeling, secure design, and secure coding into day-to-day product development. The position also supports developer enablement, security assessments, and proactive defense planning for evolving AI and LLM threats.

Responsibilities

• Embed security into the AI platform by facilitating threat modeling sessions with product teams, designing secure architectures for new features, and ensuring security considerations are incorporated from day one.
• Own and evolve the application security program, including establishing and maintaining SAST/DAST scanning in CI/CD pipelines, leading security code reviews for critical changes, and building automation to reduce vulnerabilities reaching production.
• Partner with engineering teams to champion secure coding standards, and develop reusable security patterns and libraries that help developers build securely by default.
• Recommend security features and products to help protect customer environments, acting as a driver for how WRITER secures customers.
• Integrate and leverage AI agents to increase velocity for the security team and broader engineering organization while minimizing risk as products are built.
• Lead security assessments and penetration testing of WRITER applications, AI services, and APIs, identify vulnerabilities across the technology stack, and collaborate with teams to remediate at scale.
• Design and implement security controls for data pipelines, model training environments, and customer-facing AI agents.
• Research emerging AI/ML security threats, including attack vectors specific to LLMs and generative AI, and build defenses against novel risks.

Requirements

• At least 4 years of hands-on application security engineering experience with a track record securing large-scale production systems (bonus for fast-growing or high-growth startup environments).
• Strong understanding of developer experience and developer workflows for shipping features, with an emphasis on reducing risk while maintaining engineering velocity.
• Technical capability in at least two programming languages: Python, Java, Go, JavaScript/TypeScript, with the ability to read and review code across multiple languages.
• Knowledge of security tooling and methodologies such as SAST/DAST, vulnerability management platforms, security testing frameworks, and DevSecOps practices.
• Excellent communication skills to translate complex security concepts into actionable recommendations for both technical and non-technical stakeholders.
• A builder mindset focused on automation, scalable solutions, and enabling teams without creating bottlenecks.
• Alignment with WRITER values: Connect (relationships across teams), Challenge (pushing boundaries in AI security), and Own (end-to-end responsibility for platform security).
• Open to Mid, Sr., and Staff level candidates.

Technologies

• SAST, DAST
• CI/CD
• Python, Java, Go, JavaScript/TypeScript
• DevSecOps

Compensation

USD 183,000 - 240,000 per year.

Location and Work Model

San Francisco, CA (hybrid).

Reporting to the head of security engineering.

Benefits

• Generous PTO plus company holidays
• Medical, dental, and vision coverage for you and your family
• Paid parental leave for all parents (16 weeks)
• Fertility and family planning support
• Early-detection cancer testing through Galleri
• Flexible spending account and dependent FSA options
• Health savings account for eligible plans with company contribution
• Annual work-life stipends for wellness (gym, massage/chiropractor, personal training, etc.)
• Annual work-life stipend for learning and development
• Company-wide off-sites and team off-sites
• Competitive compensation, company stock options, and 401k