Principal Security Engineer
Smartsheet3 hours ago
Base Salary
$205k - $258k/yr
Responsibilities
- Lead threat modeling and product security reviews for high-risk SaaS features, deriving abuse cases, test scenarios, security requirements, findings, and remediation timelines.
- Define the product security review service model, triage criteria, enforcement posture, and design-phase engagement process.
- Define and drive AI security risk assessment, monitoring, and mitigation methodology across products, engineering teams, and third-party AI integrations.
- Evaluate AI-assisted security review capabilities, build-versus-buy tradeoffs, detection value, and toolchain coverage.
- Set technical direction for AppSec SDLC controls, including secure coding guidelines, CI/CD pipeline security, SAST, SCA, secrets, and IaC scanning.
- Build AppSec standards, runbooks, and documentation that improve consistency and reduce single points of failure.
- Mentor AppSec team members on threat modeling and security review design and influence product and engineering leadership on architecture and risk decisions.
- Conduct architecture reviews and targeted manual code reviews and drive remediation through implementation.
Requirements
- 10+ years of application security experience with sustained technical leadership in product security or AppSec engineering, including ownership of threat modeling programs and security review services at scale.
- Ability to operate threat modeling as a systematic STRIDE- and architecture/data-flow-driven practice embedded in design cycles.
- Hands-on experience securing AI-integrated applications, including LLM workflows, agentic systems, model APIs, and MCP-based integrations, with knowledge of the OWASP LLM Top 10 and current AI attack classes.
- Experience with architecture review, targeted manual code review, and driving remediation requirements through implementation.
- Experience mentoring engineers and establishing security requirements as design-phase gates across engineering teams.
- Depth in SAST, SCA, secrets, IaC scanning, modern CI/CD pipelines, cloud security fundamentals, secure coding standards, and toolchain direction.
- Fluency in one or more modern languages, including Python, Java, TypeScript/JavaScript, Go, or equivalent, and ability to read production code and extend maintainable automation.
- Ability to communicate security risks and requirements clearly from engineering individual contributors through executive leadership and build trusted cross-functional relationships.
- Legally eligible to work in the U.S. on an ongoing basis.
- GitLab CI/CD experience with security policy pipeline configuration and scanning job integration is preferred.
- Experience building AI-assisted security tooling or LLM-integrated review workflows is preferred.
- Penetration testing experience, including exploit writing or vulnerability chaining, is preferred.
- Public security contributions such as conference speaking, CVE credits, published research, or industry recognition are preferred.
Benefits
- Employer-subsidized medical, vision, and dental coverage for full-time employees.
- 401(k) match of 50% of employee contributions up to the first 6% of eligible pay.
- Monthly stipend supporting work and productivity.
- Flexible Time Away Program and sick time off.
- Employer-sponsored life insurance and short- and long-term disability coverage for US employees.
- 12 paid holidays per year for US employees.
- Up to 24 weeks of parental leave.
- One paid volunteer day.
- Professional growth opportunities, including access to Udemy online courses.
- Company-funded perks including counseling membership, local retail discounts, and a personal Smartsheet account.
- Bellevue, WA office or remote work from any registered US location, depending on role eligibility.
Tech Stack
Categories
About Smartsheet
Smartsheet is the Intelligent Work Management platform. By aligning people and technology so organizations can move faster and drive innovation, Smartsheet enables its millions of users to achieve more. Visit www.smartsheet.com to learn more. Backed by enterprise-grade security, Smartsheet is used by more than 85% of the companies in the Fortune 500 to implement, manage, and automate processes across a broad array of departments and use cases.