Product Security Engineer
cybersecurityMillbrae, CA
About the role
Work as a hands-on Product Security Engineer to make secure outcomes the default across the codebase and delivery workflow.
Responsibilities:
- Identify systemic security gaps in the codebase and engineering workflows, then partner with engineering teams to design and ship durable fixes
- Build security tooling, automation, and code-level controls that address vulnerability classes (for example: custom linters, static analysis rules, and automated checks)
- Conduct in-depth code reviews and security design reviews for major product initiatives, engaging on architectural tradeoffs rather than only flagging issues
- Drive threat modeling and security assessments for new features, translating security requirements into practical engineering guidance
- Help evolve the team's security approach as AI-assisted development scales internally, including how higher-volume code production affects risk discovery, prioritization, and remediation
- Triaging and tracking vulnerabilities with product engineering teams, and contribute to penetration testing and bug bounty programs
Requirements:
- 5+ years of hands-on application security and security engineering experience (built security solutions, not mainly consulting, audit, or compliance work)
- Ability to operate independently with strong judgment in a fast-moving environment, including knowing when to move quickly, when to slow down, and when to esc*late or request help
- Communication style that earns trust, making security legible to engineers without being preachy, and measuring impact by business support rather than issue volume
- Proven track record shipping security tooling or automation that improved outcomes for more than one team
- Deep engineering capability to read, reason about, and review code to find real bugs and understand root causes
- Comfort working with TypeScript and Python (Retool platform is TypeScript; security tooling leverages Python)
- Strong AppSec fundamentals including threat modeling and secure code review, plus a practical understanding of common vulnerability classes and how to address them durably
- Pragmatic approach to AI tooling: use it where it improves results, remain skeptical where it does not, and consider how developer-side AI adoption compounds security risk at scale
- TechnologiesTypeScriptPythonBenefitsComprehensive benefit plan including medical, dental, vision, and 401(k)
- Generous benefits for all employees and hybrid work location
Nice to Have:
- Offensive security experience such as bug bounty, CTF participation, redteam, or pentesting
- Experience building or contributing to SAST pipelines, custom static analysis rules, or automated security testing infrastructure
- Prior experience at a startup or high-growth scaleup where security programs are not fully predefined and priorities change
- Location and Salary
Location: San Francisco, CA (hybrid)
Salary:
USD 231,900 - 318,250 per year (base salary range for non-commissionable roles or on-target earnings for commissionable roles)
Additional compensation: equity and/or commission may apply depending on the position offered
Eligibility notes: Retool is set up to employ roles in the US and specific roles in the UK
Matching similar jobs
JOB OVERVIEW
Experience level
Lead
Location
Millbrae, CA
Occupation
Information Security Engineers
Industry
Computer Systems Design Services
Posted
today
Tired of running searches?
Rank the roles you'd take once, and matches like these arrive on their own.
CREATE PROFILE (opens in a new tab)