cybersecurityMillbrae, CA
Product Security Engineer
Product Security Engineer
Product Security Engineer
cybersecurityMillbrae, CA
Apply for this role (opens in a new tab)today
Work as a hands-on Product Security Engineer to make secure outcomes the default across the codebase and delivery workflow.
Responsibilities:
- Identify systemic security gaps in the codebase and engineering workflows, then partner with engineering teams to design and ship durable fixes
- Build security tooling, automation, and code-level controls that address vulnerability classes (for example: custom linters, static analysis rules, and automated checks)
- Conduct in-depth code reviews and security design reviews for major product initiatives, engaging on architectural tradeoffs rather than only flagging issues
- Drive threat modeling and security assessments for new features, translating security requirements into practical engineering guidance
- Help evolve the team's security approach as AI-assisted development scales internally, including how higher-volume code production affects risk discovery, prioritization, and remediation
- Triaging and tracking vulnerabilities with product engineering teams, and contribute to penetration testing and bug bounty programs
Requirements:
- 5+ years of hands-on application security and security engineering experience (built security solutions, not mainly consulting, audit, or compliance work)
- Ability to operate independently with strong judgment in a fast-moving environment, including knowing when to move quickly, when to slow down, and when to esc*late or request help
- Communication style that earns trust, making security legible to engineers without being preachy, and measuring impact by business support rather than issue volume
- Proven track record shipping security tooling or automation that improved outcomes for more than one team
- Deep engineering capability to read, reason about, and review code to find real bugs and understand root causes
- Comfort working with TypeScript and Python (Retool platform is TypeScript; security tooling leverages Python)
- Strong AppSec fundamentals including threat modeling and secure code review, plus a practical understanding of common vulnerability classes and how to address them durably
- Pragmatic approach to AI tooling: use it where it improves results, remain skeptical where it does not, and consider how developer-side AI adoption compounds security risk at scale
- TechnologiesTypeScriptPythonBenefitsComprehensive benefit plan including medical, dental, vision, and 401(k)
- Generous benefits for all employees and hybrid work location
Nice to Have:
- Offensive security experience such as bug bounty, CTF participation, redteam, or pentesting
- Experience building or contributing to SAST pipelines, custom static analysis rules, or automated security testing infrastructure
- Prior experience at a startup or high-growth scaleup where security programs are not fully predefined and priorities change
- Location and Salary
Location: San Francisco, CA (hybrid)
Salary:
USD 231,900 - 318,250 per year (base salary range for non-commissionable roles or on-target earnings for commissionable roles)
Additional compensation: equity and/or commission may apply depending on the position offered
Eligibility notes: Retool is set up to employ roles in the US and specific roles in the UK
Also on the board Same function, level within a rung
Level
Lead
Location
Millbrae, CA
Occupation
Information Security Engineers
Industry
Computer Systems Design Services
Posted
today