Staff security engineer, application security
About this role
The team at Writer builds an end-to-end enterprise generative AI platform that unites IT and business teams through secure, trustworthy AI agents and LLMs. As a staff security engineer focused on applications, the incoming person will build robust security foundations to protect AI architectures, data pipelines, and developer workflows. Responsibilities include threat modeling, establishing automated SAST and DAST scanning in CI/CD pipelines, and partnering closely with engineering groups to embed security directly into product design.
This opportunity exists to define how large-scale enterprise AI applications remain protected against emerging threats without slowing down developer velocity. Candidates who thrive in this environment possess a builder's mindset, value enablement over bottlenecks, and enjoy tackling novel security challenges unique to generative systems. The position reports to the head of security engineering and operates on a hybrid schedule out of designated office hubs.
What you will do
- Conduct threat modeling sessions with product teams to design secure architectures for new features from day one.
- Manage and evolve the application security program by setting up automated SAST and DAST scanning within CI/CD pipelines.
- Partner with engineering colleagues to establish secure coding standards and create reusable security patterns.
- Lead security assessments and penetration testing across applications, AI services, and APIs to remediate vulnerabilities at scale.
- Design and implement specific security controls to protect data pipelines, model training environments, and customer-facing AI agents.
- Research attack vectors specific to LLMs and proactively build defenses against emerging generative AI threats.
What you need
- Bring a minimum of 4 years of hands-on experience in application security engineering with a record of securing large-scale production systems.
- Demonstrate technical expertise in at least two programming languages such as Python, Java, Go, or JavaScript/TypeScript.
- Possess solid knowledge of security tools and methodologies including SAST, DAST, vulnerability management, and DevSecOps practices.
- Understand developer workflows to effectively reduce risk while maintaining high engineering velocity.
- Communicate complex security concepts clearly to both technical and non-technical audiences.
Benefits
- Generous PTO, plus company holidays
- Medical, dental, and vision coverage for you and your family
- Paid parental leave for all parents (16 weeks)
- Fertility and family planning support
- Health savings account for eligible plans with company contribution
- Annual work-life stipends for wellness and learning
Skills and tech stack
Questions candidates ask
What is the remote work policy for this role?
This role is hybrid from the New York City, San Francisco, or Seattle offices.
What is the salary range for the position?
The salary ranges from $183K to $240K with offers of equity.
Who does this position report to?
The role reports to the head of security engineering.
What experience levels are considered for this opening?
The position is open to mid, senior, and staff level candidates.