Principal Security Engineer

This is a fully remote position, open to applicants in Washington.

📋 Description

• Oversee threat modeling and product security evaluations across Smartsheet’s SaaS platform.

• Develop threat models using architecture and data-flow artifacts, identify abuse cases and test scenarios, and integrate security requirements into designs.

• Establish the product security review service, detailing the service model, triage criteria, and enforcement posture.

• Conduct reviews for high-risk features and record findings along with remediation timelines.

• Define, evaluate, monitor, and mitigate AI security risks across products, engineering, and third-party AI integrations.

• Take ownership of and advance AI-assisted security review capabilities, shaping toolchain coverage.

• Set the technical direction for AppSec SDLC controls, secure coding standards, CI/CD pipeline security, SAST, SCA, secrets management, and IaC scanning.

• Create runbooks, standards, and documentation to ensure consistent application security practices.

• Guide and mentor AppSec team members while influencing product and engineering leadership.

• Articulate security risks to inform architecture decisions and guide organizational investments.

⛳️ Requirements

• Over 10 years of experience in application security with a proven track record in product security or AppSec engineering, including management of threat modeling programs and security review services at scale.

• Proficient in systematic threat modeling utilizing STRIDE, data-flow, and architecture diagrams.

• Practical experience in securing AI-integrated applications, including LLM workflows, agentic systems, model APIs, and MCP-based integrations.

• Familiarity with the OWASP LLM Top 10 and contemporary AI attack vectors.

• Background in architecture review and focused manual code reviews for complex SaaS features.

• Proven experience in driving remediation requirements through to implementation.

• Experience mentoring engineers in threat modeling and designing attacker-mindset reviews.

• Deep understanding of SAST, SCA, secrets management, and IaC scanning within modern CI/CD pipelines.

• Knowledge of cloud security fundamentals.

• Proficient in one or more programming languages such as Python, Java, TypeScript/JavaScript, Go, or similar.

• Ability to read production code and create or extend maintainable automation.

• Excellent written and verbal communication skills to convey risk and security requirements to both technical and executive audiences.

• Capability to establish trusted relationships across engineering, product, and security teams.

• Must be legally eligible to work in the U.S. on an ongoing basis.

• Preferred: Experience with GitLab CI/CD, AI-assisted security tools, penetration testing, exploit development, vulnerability chaining, public speaking at conferences, CVE credits, published research, or industry recognition.

🏝️ Benefits

• Employer-subsidized medical, vision, and dental coverage for full-time employees.

• 401k Match to aid in future savings (50% of your contribution up to the first 6% of your eligible pay).

• Monthly stipend to enhance your work and productivity.

• Flexible Time Away Program, along with Sick Time Off.

• Smartsheet-sponsored life insurance, short-term, and long-term disability plans.

• 12 paid holidays each year.

• Up to 24 weeks of Parental Leave.

• A Personal paid Volunteer Day.

• Opportunities for professional growth and development, including access to Udemy online courses.

• Company-funded perks, such as a counseling membership, local retail discounts, and a personal Smartsheet account.

• Remote work options from any registered location in the U.S. (role-specific).

• Competitive market incentive opportunities.