Lead Application Security Engineer — Remote

The French Sourcer; San Francisco (CA); Remote; USD 220,000 - 320,000; Full time

Benefits offered by this job

Competitive equity

Benefits

Job summary

The French Sourcer is seeking a Lead Application Security Engineer to own security end-to-end as the first dedicated hire, reporting to the VP of Engineering. This fully remote role focuses on building secure, scalable software across regions in the United States.

You’ll work in production TypeScript and Go, threat-model new features, design tenant isolation, harden APIs, and drive a security roadmap with high autonomy as the first security hire in a fast-growing, remote-first company.

Qualifications

• Backend software engineer with production code experience
• Security engineering background in distributed systems
• Experience securing multi-tenant / cloud-based platforms

Responsibilities

• Own application security end-to-end as the first dedicated security hire
• Write production code in TypeScript and Go and ship security fixes
• Threat-model new products and major redesigns early
• Design sub-tenant access control for multi-brand customers
• Improve rate limiting and abuse detection on public APIs
• Extend multi-region backend into new regions with data residency in mind
• Build your roadmap with autonomy as the first security hire

Skills

Backend software engineer

Security engineering

Distributed systems

Cloud platforms

Education

CS/Math/Physics degree

Job description

Lead Application Security Engineer — Remote (United States)

Remote, United States · Permanent · Remote
Compensation: $220,000 to $320,000 base, plus competitive equity

Be the first security engineer on a platform that moves customer data for hundreds of enterprises, where tenant isolation is a problem you solve in the code and the roadmap is yours to write.

What you'd actually work on

• Owning application security end to end as the first dedicated security hire, reporting to the VP of Engineering, while the engineering team roughly doubles in size
• Spending most of your week in the codebase, reading and writing production TypeScript and Go, and shipping security fixes yourself
• Threat modeling new products and major redesigns early, while design choices are still cheap to change, and hardening them before they reach customers
• Designing sub-tenant access control for multi-team and multi-brand customers who need different levels of access to configuration and data inside the same account
• Improving rate limiting, abuse detection and the granularity of access control on internet-facing APIs that serve customer data at high volume
• Extending a multi-region, multi-cloud backend into new regions so global customers can meet their data residency requirements, with security designed into each launch
• Building your own roadmap: looking at the architecture, finding the highest-leverage problems and going after them, with the autonomy that comes with being the first person in the role

Where it gets technically interesting

• Multi-tenant isolation on a system that runs very large volumes of data jobs every day and ingests a high-throughput stream of events. At that scale, a single isolation gap can expose one customer's data to another, so the margin for error is very small
• Compute isolation frameworks that you'll build and refine, balancing how strongly customer workloads are separated against cost and performance on a platform that keeps growing fast
• A backend spread across AWS, Azure and GCP that often operates against customer-owned cloud accounts, which means part of the trust boundary runs through infrastructure you don't control
• An authorization model for sub-tenants that has to be right early, because once hundreds of enterprise customers organize their teams and brands on top of it, changing it gets very expensive
• High-throughput public APIs where rate limiting and abuse detection must stop bad traffic without adding latency or blocking legitimate customers
• Privacy controls (PII handling, data residency, GDPR and CCPA) that are core engineering work here, since the product sits directly on top of customers' personal data

What we're looking for

• A real background as a backend software engineer: you wrote production code (APIs, distributed systems, data pipelines) inside a product codebase before or alongside your move into security. The team cares much more about what you've built than about certifications
• 6+ years in security engineering with deep distributed systems knowledge, enough to understand what product teams are building and influence it from a place of trust
• Experience as an early security hire (first 1 to 3) at a SaaS or data infrastructure company, plus 2+ years at a venture-backed or high-growth company as it went through real scale
• Staff or Lead level today, reached through promotions over tenures of 2 years or more
• Hands-on experience securing multi-tenant platforms (tenant isolation, authorization models) and systems that span several clouds or regions
• A degree in Computer Science, Math, Physics or a similar field, and the ability to explain a design clearly and stay precise under deep technical questions
• Bonus: privacy-adjacent security work, having designed or secured data infrastructure as an early engineer, or experience at a security-focused company. Former managers who want to return to a fully hands-on IC role are welcome

The company

A late-stage B2B data and AI company, backed by top-tier investors, whose platform helps businesses turn their customer data into personalized marketing, with a growing part of that work now driven by AI agents. Revenue and headcount have been growing fast year over year, and hundreds of companies rely on the platform in production. Several hundred people, fully remote, with an engineering culture that holds a very high bar for quality and simple, scalable software. This is the company's first dedicated security role: it reports to the VP of Engineering and works across every product team. Competitive equity and benefits. Remote within the United States, with visa transfers supported (H-1B transfer, TN), but no new H-1B sponsorship.

Languages:

English (fluent, professional)