Product Security Engineer

Retool is seeking a hands-on Product Security Engineer to strengthen security outcomes across its engineering workflows and product initiatives. The role focuses on identifying systemic gaps, building security tooling and code-level controls, and partnering with teams on threat modeling, reviews, and remediation as development practices evolve.

Responsibilities

• Identify systemic security gaps in the codebase and engineering workflows, partnering with engineering teams to design and ship durable solutions
• Build security tooling, automation, and code-level controls that address classes of vulnerabilities, including custom linters, static analysis rules, and automated checks to shift issue detection earlier in the lifecycle
• Perform in-depth code reviews and security design reviews for significant product initiatives, engaging with architectural tradeoffs at a technical depth
• Lead threat modeling and security assessments for new features, translating security requirements into actionable engineering guidance
• Help evolve internal security practices as AI-assisted development scales, including how higher-volume code production affects risk discovery, prioritization, and fixes
• Triage, track, and drive vulnerability remediation with product engineering teams, and contribute to penetration testing and bug bounty programs

Requirements

• 5+ years of hands-on application security and security engineering experience, focused on building security capabilities rather than primarily performing consulting, audit, or compliance work
• Ability to operate independently with strong judgment in a fast-moving environment, including prioritizing based on business needs and objectives and knowing when to move quickly, slow down, or escalate
• Communication that earns trust, making security understandable to engineers without being preachy, and focusing on measurable support for business outcomes
• A track record of shipping security tooling or automation that improved results for more than one team
• Engineering depth to read, reason about, and review code to identify real bugs and understand root causes rather than relying on checklist pattern matching
• Comfort working with TypeScript and Python, with productivity in both since Retool’s platform is built in TypeScript and security tooling leverages Python
• Strong AppSec fundamentals, including threat modeling and secure code review, along with a working understanding of common vulnerability classes and durable remediation approaches
• A pragmatic, signal-oriented approach to AI tooling, applying it where it improves security work and maintaining skepticism where it does not, with attention to how AI adoption can compound risk at scale

Technologies

• TypeScript
• Python

Benefits

• Comprehensive benefit plan including medical, dental, vision, and 401(k)
• Generous benefits for all employees and hybrid work location

Nice to Have

• Offensive security experience such as bug bounty, CTF participation, redteam, or pentesting
• Experience building or contributing to SAST pipelines, custom static analysis rules, or automated security testing infrastructure
• Prior experience at a startup or high-growth scaleup where security programs may not be fully predefined and priorities shift

Location and Salary

Location: San Francisco, CA (hybrid)

Experience: 5+ years

Base salary range (US): USD 231,900 - 318,250 per year

Additional compensation in the form of equity and/or commission may apply depending on the position offered.

Retool is set up to employ all roles in the US and specific roles in the UK.