Threat Modeling

Threat Modeling Engineer Jobs

13 jobs found

Today

Staff security engineer, application security

WRITER San Francisco, CA

San Francisco, CA

Today

$183k - $240k/yr Full time Ai Security Application Security Application Security Engineering

Apply Now

Job Description

WRITER is building security foundations for AI systems used at enterprise scale, and this Staff security engineer role sits at the intersection of application security, AI infrastructure, and developer enablement. You will help shape how teams design, test, and ship security into production by default, including work across applications, AI services, and APIs in a hybrid environment based in San Francisco.

This role focuses on strengthening application security programs, advancing automated defenses in CI/CD, and partnering closely with engineering teams to reduce risk without slowing delivery.

Responsibilities

Build security into the DNA of the AI platform by running threat modeling sessions with product teams, designing secure architectures for new features, and ensuring security considerations influence product decisions from day one
Own and evolve the application security program, including establishing and maintaining SAST/DAST scanning in CI/CD pipelines, performing security code reviews for critical changes, and creating automation that identifies vulnerabilities before they reach production
Collaborate with engineering teams to champion secure coding standards, including reusable security patterns and libraries that help developers build securely by default
Design and recommend security features and products that protect customer environments, serving as the advocate and vision for how customer security is delivered
Integrate and leverage AI agents to increase velocity for the security team and the broader engineering organization while minimizing risk
Lead security assessments and penetration testing of WRITER applications, AI services, and APIs, identify vulnerabilities across the stack, and work with teams to remediate issues at scale
Design and implement security controls for data pipelines, model training environments, and customer-facing AI agents
Stay current on emerging AI/ML security threats by researching LLM and generative AI attack vectors and proactively building defenses against novel risks

Requirements

Minimum 4 years of hands-on experience in application security engineering, including a proven track record securing large-scale production systems (bonus for work in fast-growing startups or high-growth environments)
Strong understanding of developer experience and shipping workflows, with a focus on reducing risk while maintaining engineering velocity
Technical expertise in at least two programming languages: Python, Java, Go, JavaScript/TypeScript, with the ability to review code across multiple languages and assess both business logic and security implications
Knowledge of security tools and methodologies, including SAST/DAST, vulnerability management platforms, security testing frameworks, and DevSecOps, with clear judgment on when automation is preferable to manual review
Excellent communication skills to explain complex security concepts and translate them into actionable recommendations for technical and non-technical audiences
A builder’s mindset focused on automating, scaling, and enabling teams rather than introducing bottlenecks
Alignment with WRITER values: Connect, Challenge, and Own
Open to Mid, Sr., and Staff level candidates

Technologies

Python, Java, Go, JavaScript/TypeScript
SAST, DAST, CI/CD
AI agents, LLMs, generative AI, AI/ML

Benefits

Generous PTO plus company holidays
Medical, dental, and vision coverage for you and your family
Paid parental leave for all parents (16 weeks)
Fertility and family planning support
Early-detection cancer testing through Galleri
Flexible spending account and dependent FSA options
Health savings account for eligible plans with company contribution
Annual work-life stipends for wellness (gym, massage/chiropractor, personal training, etc.)
Annual work-life stipends for learning and development
Company-wide off-sites and team off-sites
Competitive compensation, company stock options, and 401k

View full job page →

1d ago

Sr Product Security Engineer, AI & DevSecOps

MCKESSON Columbus, OH

Columbus, OH

1d ago

$140k - $234k/yr Full time Ai Security Application Security Cloud Platforms

Apply Now

Job Description

McKesson is hiring a Sr Product Security Engineer, AI & DevSecOps for an onsite role in Columbus, OH. This position focuses on embedding security across the software development lifecycle for AI-enabled products, cloud-native platforms, and DevSecOps practices. You will partner with engineering and platform teams to translate security requirements into reusable patterns and automated guardrails that help teams ship securely and efficiently.

What you’ll do

Collaborate with development teams to incorporate security requirements across design, development, testing, deployment, and operations
Lead security architecture reviews, threat modeling, secure design reviews, and security assessments for applications, APIs, cloud services, and AI-enabled systems
Write and review code to identify vulnerabilities, attack vectors, and improvement opportunities to strengthen secure development practices
Build reusable security patterns, shared services, and automated guardrails that support secure delivery
Assess and secure AI, machine learning, generative AI, and large language model solutions, including secure use of AI-assisted development tools
Integrate automated security testing into CI/CD pipelines, including SAST, DAST, software composition analysis, secrets detection, container scanning, and infrastructure scanning
Design security controls for cloud-native applications, containers, Kubernetes, serverless platforms, and infrastructure-as-code deployments
Work with engineering and cybersecurity teams to assess risk, remediate vulnerabilities, respond to security concerns, and support a security-first engineering culture

What you bring

Degree in Computer Science, Information Security, Engineering, or a related technical field, or equivalent professional experience
Typically 7+ years of relevant experience in application security, product security, software development, security engineering, DevSecOps, or a related discipline
Hands-on experience writing, reviewing, and deploying application code using TypeScript, Java, Ruby, Python, or comparable languages
Strong understanding of application attack vectors, secure coding practices, software vulnerabilities, and modern application architectures
Experience with threat modeling, security architecture reviews, secure design reviews, and vulnerability remediation
Experience implementing DevSecOps practices and integrating automated security controls into CI/CD
Experience securing AI/ML platforms, generative AI solutions, large language model applications, or AI-assisted development workflows
Experience with cloud platforms, containers, Kubernetes, infrastructure-as-code, security automation, and application security testing tools

Technologies you’ll work with

TypeScript, Java, Ruby, Python; SAST, DAST, software composition analysis, secrets detection, container scanning, infrastructure scanning; cloud-native applications, containers, Kubernetes, serverless platforms, infrastructure-as-code; AI, machine learning, generative AI, large language model, AI-assisted development tools; CI/CD pipelines; threat modeling, security architecture reviews, secure design reviews, and vulnerability remediation.

Benefits

Medical, Dental, and Vision
Health Spending Accounts
Flexible Spending Accounts
401(k) (U.S.)
Pension (Canada)
Employee Stock Purchase Plan
Mental Health Programs
Flexible Schedules
Paid Time Off
Wellness Program
Education Reimbursement
Volunteer Opportunities
Flexible Work Environment

Preferred skills and experience

Knowledge of AI security frameworks and controls, including OWASP Top 10 for LLM Applications and the NIST AI Risk Management Framework
Experience creating reusable security services, secure development patterns, engineering guardrails, or policy-as-code solutions
Experience with CI/CD and infrastructure technologies such as GitHub Actions, Azure DevOps, GitLab, Jenkins, or Terraform
Experience supporting frameworks such as SOC 2, HIPAA, SOX, NIST CSF, or ISO 27001
Ability to translate complex security requirements and technical risks into practical guidance for development teams
Strong collaboration and influencing skills, with the ability to advance security without unnecessarily slowing product delivery

Salary: USD 140,300 - 233,800 per year.

View full job page →

8d ago

Lead Engineer, Information Security (Application Security)

RXO, Inc. United States

United States

8d ago

Full time Ai Security Application Security Cloud Native Security

Apply Now

Job Description

Lead Engineer, Application Security is a senior individual contributor role focused on scaling secure software practices across a multi-cloud environment.

Responsibilities

Own application security standards, secure architecture principles, and threat modeling governance across the enterprise.
Run security assessments and threat modeling for emerging technologies, including agentic AI solutions, LLMs, and autonomous AI workflows.
Review and optimize Web Application Firewall (WAF) configurations to support application protection goals.
Integrate and optimize automated security tooling such as SAST, DAST, and Software Composition Analysis (SCA) within CI/CD and DevSecOps processes.
Collaborate with software engineering teams to identify vulnerabilities and provide code-level remediation guidance aligned to secure coding best practices.
Support security awareness and enablement efforts by mentoring developers and facilitating Security Champion programs across engineering teams.
Evaluate cloud-native applications and services in Azure, GCP, and OCI to ensure alignment with security standards.
Help implement security controls in development pipelines, including mechanisms intended to block deployments with unresolved critical or high-risk vulnerabilities.
Drive continuous improvement to enhance application security processes, tooling, and developer enablement.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field (or equivalent combination of education and experience).
3+ years of experience in Application Security, Security Engineering, DevSecOps, or a related cybersecurity discipline.
Experience identifying and remediating security vulnerabilities within application code and software development environments.
Experience with enterprise WAF platforms such as Akamai App & API Protector, F5 Advanced WAF, or similar technologies.
Experience securing cloud-native workloads and applications in Azure, GCP, and/or OCI.
Experience with container technologies, including Docker and Kubernetes.
Experience integrating security tools into CI/CD pipelines and development workflows.
Knowledge of OWASP Top 10, CWE, secure API design principles, and application security best practices.
Strong analytical, problem-solving, and communication skills with the ability to collaborate across technical teams.

Technologies

Web Application Firewall (WAF)
Akamai App & API Protector
F5 Advanced WAF
SAST, DAST, Software Composition Analysis (SCA)
CI/CD, DevSecOps
Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI)
Docker, Kubernetes
OWASP Top 10, Common Weakness Enumeration (CWE)
Agentic AI solutions, Large Language Models (LLMs)

Benefits

Comprehensive medical, dental, and vision plans
401(k) retirement plan with up to 5% company match
Pre-tax accounts to help streamline eligible expenses
Company-paid disability and life insurance
Employee Assistance Program (EAP)
Career and Leadership Development Programs
Paid time off, company holidays, and volunteer days

It’d be great if you also have

Experience securing AI-enabled applications, LLM-based solutions, or autonomous agent workflows.
Experience with security certifications such as Microsoft Certified: Azure Security Engineer Associate, GCP Professional Cloud Security Engineer, CISSP, CSSLP, CASE, GWEB, or related security certifications.
Experience with Akamai and/or F5 security platforms in large-scale enterprise environments.
Experience leading Security Champion programs or mentoring engineering teams on secure development practices.
Ability to influence cross-functional teams and drive security improvements through collaboration and technical expertise.
Experience developing scalable security frameworks that support innovation while managing enterprise risk.

View full job page →

1mo ago

Cybersecurity Engineer

Delta Defense, LLC West Bend, WI

West Bend, WI

1mo ago Closed

$100k - $125k/yr Full time Ai Security Api Security Application Security

This position is no longer accepting applications (closed Sep 17, 2026).

Job Description

Delta Defense, LLC is building a modern security engineering program that spans product engineering, cloud infrastructure, and analytics teams. In this role, you will help design and evolve security controls across application and web/API security, offensive security, AI security and governance, incident response and detection, vulnerability management, and security automation.

This onsite position is based in West Bend, WI, and the target salary range is USD 100,000 - 125,000 per year. Delta Defense is seeking a cybersecurity engineer with 3+ years of experience to partner across Engineering, DevOps, Infrastructure, and Product.

Responsibilities

Lead application security throughout the software development lifecycle by partnering with Engineering and DevOps to integrate security into design, development, testing, and deployment.
Conduct threat modeling, secure design reviews, and code reviews, and implement automated SAST, DAST, SCA, and secrets detection in CI/CD pipelines.
Design, implement, and continuously improve web application and API security controls across the enterprise.
Develop and tune WAF policies, perform API security assessments, identify business logic vulnerabilities, and define secure-by-design standards that reduce risk without unnecessarily slowing developer velocity.
Plan and execute penetration testing against web applications, APIs, cloud environments, and supporting infrastructure.
Validate vulnerabilities through manual testing, prioritize findings by business risk, and work with engineering teams to ensure timely remediation and measurable risk reduction.
Develop and enforce security controls governing enterprise AI platforms and internally developed AI capabilities.
Establish policies for data classification, model usage, access controls, audit logging, and secure AI integrations to support responsible adoption.
Perform security assessments of Retrieval-Augmented Generation (RAG), agentic AI systems, MCP integrations, and large language model applications.
Identify and mitigate AI and application risks including prompt injection, indirect prompt injection, insecure tool use, excessive agent permissions, model abuse, and data leakage using guidance such as OWASP LLM Top 10 and MITRE ATLAS.
Support security incident investigation and response, including threat analysis, digital forensics, containment, eradication, and root cause analysis.
Operate a risk-based vulnerability management program that prioritizes remediation based on exploitability, business impact, and threat intelligence rather than scanner severity alone.
Measure remediation effectiveness, track risk reduction, and ensure alignment to frameworks including NIST CSF, CIS Controls, OWASP, PCI DSS, and organizational security standards.
Help maintain secure cloud environments across AWS, Google Cloud, and DigitalOcean.
Design and implement cloud security architecture covering IAM, Kubernetes security, container security, Infrastructure-as-Code security scanning, secrets management, workload protection, and Zero Trust network controls.
Build security automation to improve operational efficiency and security outcomes using scripting, APIs, Infrastructure as Code, and AI-assisted workflows.
Develop integrations between security platforms, automate repetitive security processes, and use AI responsibly to enhance detection, investigation, and response while maintaining governance and oversight.
Serve as a trusted technical advisor across Engineering, Infrastructure, and Product teams by providing security guidance, mentoring engineers, evaluating emerging technologies, and translating security risks into practical engineering solutions.
Continuously research evolving threats, techniques, and defensive capabilities to improve the organization’s security posture.

Requirements

Deep cybersecurity engineering capability across application security, cloud and infrastructure security, data platform security, detection engineering, and vulnerability management, with practical experience securing modern cloud-first environments and large-scale SaaS and data platforms.
Hands-on application security experience with SAST, DAST, SCA, secure code review, API security, WAF tuning, threat modeling, CI/CD security, and secrets management using tools such as Doppler, Semgrep, Snyk, Burp Suite, OWASP ZAP, Cloudflare, HashiCorp Vault, or equivalents.
Proficiency in at least one programming or scripting language and the ability to read, write, and exploit code in a security context; Python, JavaScript, PHP, Golang, or Rust preferred.
Working knowledge of AI security risks and controls including prompt injection, indirect prompt injection, model abuse, data leakage, agentic workflow vulnerabilities, OWASP LLM Top 10, MITRE ATLAS, and emerging AI security tooling.
Practical cloud and infrastructure security experience across DigitalOcean, AWS, GCP, Kubernetes, IAM, CSPM, IaC scanning, container security, zero-trust/SASE architectures, and security tooling such as EDR, SIEM, CASB, SWG, DLP, IDS/IPS, and PAM.
Ability to communicate risk clearly in business terms, influence cross-functional stakeholders without direct authority, and stay decisive during active incidents while driving remediation to closure and demonstrating Delta Defense’s core values.
Bachelor’s degree in Computer Science, Information Security, Cybersecurity, Information Technology, or a related field preferred; equivalent work experience and relevant certifications may be considered in lieu of a degree.
Minimum 3 years of cybersecurity engineering experience working closely with application, software, data engineering, DevOps, cloud, infrastructure, or security operations teams.
Experience securing applications, APIs, cloud platforms, CI/CD pipelines, Kubernetes environments, data platforms, and modern engineering ecosystems using technologies such as JavaScript, PHP, PostgreSQL, Kafka, NeonDB, GitLab, Python, Snowflake, dbt, Fivetran, Databricks, Tableau, Informatica, Kestra, or related technologies.
Strong understanding of security frameworks and control models including NIST CSF, CIS Controls, PCI DSS, Cyber Defense Matrix, ISO 27001, OWASP, and MITRE ATT&CK.
Preferred certifications include CCSP, CASP+, Security+, CEH, GPEN, GWAPT, or other relevant cloud, application security, AI security, offensive security, or security engineering certifications.
Must be authorized to work in the United States without current or future sponsorship.

Benefits

Target Salary Range: $100,000 - $125,000
Eligible for Company Incentive Bonus

Working Conditions

Remote or Hybrid

Learn more & apply: https://www.deltadefense.com/careers

View full job page →

1mo ago

Staff AI Security Engineer

Okta Washington, DC

Washington, DC

1mo ago Closed

$180k - $248k/yr Full time Agent Agentic Ai Ai Security

This position is no longer accepting applications (closed Sep 13, 2026).

Job Description

Okta is seeking a Staff AI Security Engineer (senior individual contributor) to set the technical direction for AI security. This role focuses on architecture and hands-on security controls for AI models, agentic workflows, and autonomous systems, with an emphasis on scalable infrastructure, mentorship, and cross-functional partnership.

Responsibilities

Secure AI implementations: Design and deploy enterprise AI guardrails, gateways, and other controls to protect agentic workflows from emerging threats.
Agent hardening and sandboxing: Create security architectures for both local and hosted agents to mitigate risks including tool-calling abuse, prompt injection, goal misalignment, and data exfiltration.
Define paved roads and security standards: Develop secure design patterns and developer tools that help teams build and deploy AI capabilities safely and efficiently.
Threat modeling for AI workflows: Lead threat modeling and security reviews for agentic AI systems, enterprise deployments, and agent ecosystems.
AI discovery and visibility: Build systems to discover, inventory, and evaluate AI usage and data flows across the enterprise.
Agentic platform infrastructure: Design and operate internal AI security platforms, and develop integrated AI capabilities that automate complex security operations.
Technical leadership and mentorship: Provide technical alignment across product, security, and infrastructure teams. Mentor engineers and security practitioners across domains.

Requirements

Deep knowledge of the AI threat landscape, including OWASP, MITRE ATLAS, and NIST AI RMF, with practical experience addressing prompt injection, excessive agency, and other AI-related threats.
8+ years of experience in security engineering or backend software development, with strong coding proficiency in Python or Go and hands-on cloud experience.
Experience securing or auditing agentic frameworks, including LangChain, Strands, Claude Agent SDK, or custom tool-calling agents, particularly in sandboxed environments.
Demonstrated ability to design scalable cloud infrastructure on AWS/GCP, including API gateways, proxy architectures, and enterprise access controls.
Proven ability to build developer-first security tools and platform controls that maintain engineering velocity.
Strong communication skills, including a track record of driving technical strategy, influencing engineering leaders, and mentoring engineers.
Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or equivalent practical experience.

Technologies

Python
Go
OWASP
MITRE ATLAS
NIST AI RMF
LangChain
Strands
Claude Agent SDK
AWS
GCP

Okta Experience

Supporting Your Well-Being
Driving Social Impact
Developing Talent and Fostering Connection and Community

Job Details

Location: Washington, DC (hybrid)
Salary: USD 180,000 - 247,500 per year
Minimum Experience: 8 years

View full job page →

1mo ago

Staff AI Security Engineer

Okta New York, NY

New York, NY

1mo ago Closed

$180k - $248k/yr Full time Agent Security Ai Security Ai Security Guardrails

This position is no longer accepting applications (closed Sep 11, 2026).

Job Description

Okta is seeking a Staff AI Security Engineer (senior individual contributor) to strengthen the Security team’s ability to secure AI models, agentic workflows, and autonomous systems. In this hybrid role in New York, NY, you will help define the technical vision and practical architecture for enterprise AI security, with hands-on controls, scalable infrastructure, and developer-first standards.

What you’ll own

Secure AI implementations: Design and deploy enterprise AI guardrails, gateways, and controls to protect agentic workflows from emerging threats.
Agent hardening and sandboxing: Build security architectures for local and hosted agents to reduce risks including tool-calling abuse, prompt injection, goal misalignment, and data exfiltration.
Define paved roads and security standards: Create secure design patterns and developer tools that enable teams to ship AI features safely and quickly.
Threat modeling for AI workflows: Lead threat modeling and security reviews across agentic AI systems, enterprise deployments, and AI ecosystems.
AI discovery and visibility: Develop systems to discover, inventory, and assess AI usage and data flows across the enterprise.
Agentic platform infrastructure: Design and operate internal AI security platforms, including integrated capabilities that automate complex security operations.
Technical leadership and mentorship: Drive alignment across product, security, and infrastructure teams while mentoring engineers and security practitioners across domains.

What you bring

AI security expertise: Deep understanding of the AI threat landscape, including OWASP, MITRE ATLAS, and NIST AI RMF, with practical experience addressing threats such as prompt injection and excessive agency.
Software engineering background: 8+ years of experience in security engineering or backend software development, with strong coding proficiency in Python or Go, plus hands-on cloud experience.
Agentic framework knowledge: Experience securing or auditing agentic frameworks (for example LangChain, Strands, Claude Agent SDK, or custom tool-calling agents) in sandboxed environments.
Architectural expertise: Proven ability to design scalable cloud infrastructure on AWS or GCP, including API gateways, proxy architectures, and access controls for enterprise systems.
Paved road construction: Track record building developer-first security tools and platform controls that preserve engineering velocity.
Technical leadership: Strong communication skills, including experience influencing engineering leaders and mentoring engineers.
Education: Bachelor’s degree in Computer Science, Cybersecurity, Information Security, or equivalent practical experience.

Tools and technologies

Python, Go, AWS, GCP
OWASP, MITRE ATLAS, NIST AI RMF
LangChain, Strands, Claude Agent SDK

Okta experience

Supporting Your Well-Being
Driving Social Impact
Developing Talent and Fostering Connection + Community

Compensation: USD 180,000 - 247,500 per year.

Location: New York, NY (hybrid).

View full job page →

1mo ago

Security Engineer, Application Security

Mercor New York, NY

New York, NY

1mo ago Closed

$130k - $400k/yr Full time Application Security DevSecOps Information Security

This position is no longer accepting applications (closed Sep 3, 2026).

Job Description

Mercor is building a platform where the application layer is the highest-priority security surface, and security needs to be embedded into day-to-day engineering. In this role, you will own application security end to end, from reviewing code and improving SDLC workflows to integrating security tooling into CI/CD and driving fixes to closure. The platform supports 300K+ experts and enterprise clients that handle sensitive AI training data.

Security Engineer, Application Security will work onsite in New York, NY and will bring 5+ years of professional experience with an application security focus. The compensation range is USD 130,000 - 400,000 per year.

What you’ll do

Embed security review workflows in the SDLC, performing PR-level analysis to catch authentication bugs, injection flaws, and business logic errors before changes ship
Integrate SAST/DAST pipelines into CI/CD to shift security left while keeping deploy velocity intact
Run vulnerability management with prioritization based on real exploitability rather than CVSS score
Define secure coding standards and guardrails that support safer patterns across a team of 50+ engineers
Develop threat models for new features and architecture changes, with special attention to AI data pipelines, payment flows, and multi-tenant boundaries
Operate the bug bounty program, including triaging HackerOne reports, validating findings, and driving remediation through to closure

Requirements

Have found and fixed real vulnerabilities in production applications, not only run scanners
Possess deep web application security knowledge, with OWASP Top 10 as a baseline and the ability to reason about attack chains and business logic flaws
Strength in at least one of Python, TypeScript, or Go, including the ability to review a PR and spot issues such as an auth bypass
Experience building or tuning SAST/DAST tooling, including familiarity with tools such as Semgrep, CodeQL, Snyk, and Burp
Understand modern web frameworks, APIs, and authentication patterns well enough to threat model them
Experience managing a vulnerability pipeline from discovery through prioritization to verified remediation
Bring 5+ years of professional experience in application security, security engineering, or software engineering with a strong security focus

Technologies

Python, TypeScript, Go
Semgrep, CodeQL, Snyk, Burp
HackerOne
OWASP Top 10

Benefits

Bi-annual performance bonus structure
Generous equity grant vested over 4 years
Up to $15k Relocation bonus
$10K housing bonus if you live within 0.5 miles of the office
$1.5K monthly stipend for meals
Free Equinox membership
$200 monthly laundry reimbursement
$200 monthly personal wellness reimbursement
Health, Dental, Vision insurance

Bonus points

Experience running or triaging a bug bounty program (HackerOne, Bugcrowd)
Offensive security skills, including penetration testing experience and an attacker mindset
Experience securing AI/ML applications, including model serving APIs, training data pipelines, and prompt injection defense
Familiarity with supply chain security such as dependency scanning and registry firewalls (Socket, Snyk)
Built custom security tooling that remains in active use by the team
Contributions to open source security projects or published vulnerability research