Principal Security Engineer
Smartsheet14 days ago
Base Salary
$205k - $258k/yr
Responsibilities
- Lead threat modeling and product security reviews for high-risk SaaS features, deriving abuse cases, test scenarios, security requirements, findings, and remediation timelines.
- Define the product security review service model, triage criteria, enforcement posture, and design-phase engagement process.
- Define and drive AI security risk assessment, monitoring, and mitigation methodology across products, engineering teams, and third-party AI integrations.
- Evaluate AI-assisted security review capabilities, build-versus-buy tradeoffs, detection value, and toolchain coverage.
- Set technical direction for AppSec SDLC controls, including secure coding guidelines, CI/CD pipeline security, SAST, SCA, secrets, and IaC scanning.
- Build AppSec standards, runbooks, and documentation that improve consistency and reduce single points of failure.
- Mentor AppSec team members on threat modeling and security review design and influence product and engineering leadership on architecture and risk decisions.
- Conduct architecture reviews and targeted manual code reviews and drive remediation through implementation.
Requirements
- 10+ years of application security experience with sustained technical leadership in product security or AppSec engineering, including ownership of threat modeling programs and security review services at scale.
- Ability to operate threat modeling as a systematic STRIDE- and architecture/data-flow-driven practice embedded in design cycles.
- Hands-on experience securing AI-integrated applications, including LLM workflows, agentic systems, model APIs, and MCP-based integrations, with knowledge of the OWASP LLM Top 10 and current AI attack classes.
- Experience with architecture review, targeted manual code review, and driving remediation requirements through implementation.
- Experience mentoring engineers and establishing security requirements as design-phase gates across engineering teams.
- Depth in SAST, SCA, secrets, IaC scanning, modern CI/CD pipelines, cloud security fundamentals, secure coding standards, and toolchain direction.
- Fluency in one or more modern languages, including Python, Java, TypeScript/JavaScript, Go, or equivalent, and ability to read production code and extend maintainable automation.
- Ability to communicate security risks and requirements clearly from engineering individual contributors through executive leadership and build trusted cross-functional relationships.
- Legally eligible to work in the U.S. on an ongoing basis.
- GitLab CI/CD experience with security policy pipeline configuration and scanning job integration is preferred.
- Experience building AI-assisted security tooling or LLM-integrated review workflows is preferred.
- Penetration testing experience, including exploit writing or vulnerability chaining, is preferred.
- Public security contributions such as conference speaking, CVE credits, published research, or industry recognition are preferred.
Benefits
- Employer-subsidized medical, vision, and dental coverage for full-time employees.
- 401(k) match of 50% of employee contributions up to the first 6% of eligible pay.
- Monthly stipend supporting work and productivity.
- Flexible Time Away Program and sick time off.
- Employer-sponsored life insurance and short- and long-term disability coverage for US employees.
- 12 paid holidays per year for US employees.
- Up to 24 weeks of parental leave.
- One paid volunteer day.
- Professional growth opportunities, including access to Udemy online courses.
- Company-funded perks including counseling membership, local retail discounts, and a personal Smartsheet account.
- Bellevue, WA office or remote work from any registered US location, depending on role eligibility.
Tech Stack
Categories
About Smartsheet
Smartsheet builds a cloud-based enterprise work management platform for project and portfolio tracking, automation, reporting, and collaboration used by business and IT teams. It sells SaaS subscriptions with premium capabilities and add-ons, and integrates with tools like Microsoft 365, Google Workspace, and Slack. Founded in 2005 and headquartered in Bellevue, Washington, Smartsheet is publicly traded on the NYSE (SMAR) and owns Brandfolder, a digital asset management product.