Staff security engineer, application security

WRITER is building security foundations for AI systems used at enterprise scale, and this Staff security engineer role sits at the intersection of application security, AI infrastructure, and developer enablement. You will help shape how teams design, test, and ship security into production by default, including work across applications, AI services, and APIs in a hybrid environment based in San Francisco.

This role focuses on strengthening application security programs, advancing automated defenses in CI/CD, and partnering closely with engineering teams to reduce risk without slowing delivery.

Responsibilities

• Build security into the DNA of the AI platform by running threat modeling sessions with product teams, designing secure architectures for new features, and ensuring security considerations influence product decisions from day one
• Own and evolve the application security program, including establishing and maintaining SAST/DAST scanning in CI/CD pipelines, performing security code reviews for critical changes, and creating automation that identifies vulnerabilities before they reach production
• Collaborate with engineering teams to champion secure coding standards, including reusable security patterns and libraries that help developers build securely by default
• Design and recommend security features and products that protect customer environments, serving as the advocate and vision for how customer security is delivered
• Integrate and leverage AI agents to increase velocity for the security team and the broader engineering organization while minimizing risk
• Lead security assessments and penetration testing of WRITER applications, AI services, and APIs, identify vulnerabilities across the stack, and work with teams to remediate issues at scale
• Design and implement security controls for data pipelines, model training environments, and customer-facing AI agents
• Stay current on emerging AI/ML security threats by researching LLM and generative AI attack vectors and proactively building defenses against novel risks

Requirements

• Minimum 4 years of hands-on experience in application security engineering, including a proven track record securing large-scale production systems (bonus for work in fast-growing startups or high-growth environments)
• Strong understanding of developer experience and shipping workflows, with a focus on reducing risk while maintaining engineering velocity
• Technical expertise in at least two programming languages: Python, Java, Go, JavaScript/TypeScript, with the ability to review code across multiple languages and assess both business logic and security implications
• Knowledge of security tools and methodologies, including SAST/DAST, vulnerability management platforms, security testing frameworks, and DevSecOps, with clear judgment on when automation is preferable to manual review
• Excellent communication skills to explain complex security concepts and translate them into actionable recommendations for technical and non-technical audiences
• A builder’s mindset focused on automating, scaling, and enabling teams rather than introducing bottlenecks
• Alignment with WRITER values: Connect, Challenge, and Own
• Open to Mid, Sr., and Staff level candidates

Technologies

• Python, Java, Go, JavaScript/TypeScript
• SAST, DAST, CI/CD
• AI agents, LLMs, generative AI, AI/ML

Benefits

• Generous PTO plus company holidays
• Medical, dental, and vision coverage for you and your family
• Paid parental leave for all parents (16 weeks)
• Fertility and family planning support
• Early-detection cancer testing through Galleri
• Flexible spending account and dependent FSA options
• Health savings account for eligible plans with company contribution
• Annual work-life stipends for wellness (gym, massage/chiropractor, personal training, etc.)
• Annual work-life stipends for learning and development
• Company-wide off-sites and team off-sites
• Competitive compensation, company stock options, and 401k