Staff security engineer, application security

WRITER is building security foundations for enterprise AI applications, with a focus on application security and the unique risks that come with LLM-based systems. As a Staff security engineer, you will help shape how security is embedded into product delivery, while advancing AI infrastructure protection through threat modeling, automated controls, assessments, and secure coding practices.

What you’ll do

• Build security into the core of WRITER’s AI platform by running threat modeling sessions with product teams and designing secure architectures for new features so security considerations influence decisions from the start
• Own and evolve the application security program, including establishing and maintaining SAST/DAST scanning in CI/CD pipelines, performing security code reviews for critical changes, and creating automation that reduces the chance of vulnerabilities reaching production
• Partner with engineering teams to establish and champion secure coding standards, along with reusable security patterns and libraries that support secure development by default
• Design and recommend security features and products that help secure customer environments, serving as the advocate and guiding vision for customer protection
• Integrate and leverage AI agents to increase velocity for the security team and the broader engineering organization, supporting proactive risk reduction as products are built
• Lead security assessments and penetration testing across WRITER applications, AI services, and APIs, identifying vulnerabilities across the technology stack and working with teams to remediate issues at scale
• Design and implement security controls for data pipelines, model training environments, and customer-facing AI agents
• Stay ahead of emerging AI/ML security threats by researching LLM and generative AI attack vectors and proactively developing defenses against new risks

Requirements

• Minimum 4 years of hands-on experience in application security engineering, with a proven track record securing large-scale production systems (bonus for fast-growing startups or high-growth environments)
• Strong understanding of developer experience and developer workflows, balancing risk reduction with engineering velocity
• Technical expertise in at least two programming languages: Python, Java, Go, JavaScript/TypeScript, with the ability to read and review code across multiple languages while understanding both business logic and security implications
• Knowledge of security tools and methodologies, including SAST/DAST solutions, vulnerability management platforms, security testing frameworks, and DevSecOps practices
• Excellent communication skills to translate complex security topics into clear recommendations for technical and non-technical audiences
• A builder’s mindset focused on automation, scaling, and enablement rather than bottlenecks, with the view that security enables the business
• Alignment with WRITER values: Connect, Challenge, and Own
• Open to Mid, Sr., and Staff level candidates

Technologies you’ll work with

• SAST, DAST, CI/CD
• Python, Java, Go, JavaScript/TypeScript
• DevSecOps

Compensation and role details

Location: San Francisco, CA (hybrid). Compensation: USD 183,000 - 240,000 per year. Reporting line: head of security engineering.

Benefits

• Generous PTO, plus company holidays
• Medical, dental, and vision coverage for you and your family
• Paid parental leave for all parents (16 weeks)
• Fertility and family planning support
• Early-detection cancer testing through Galleri
• Flexible spending account and dependent FSA options
• Health savings account for eligible plans with company contribution
• Annual work-life stipends for wellness (gym, massage/chiropractor, personal training, etc.)
• Annual work-life stipends for learning and development
• Company-wide off-sites and team off-sites
• Competitive compensation, company stock options, and 401k