Product Security Engineer

StackAI; San Francisco (CA); On-site; USD 248,000 - 282,000; Full time

Job summary

StackAI in San Francisco is seeking a hands-on (Senior) Product Security Engineer to design, build, and harden the secure architecture at the core of the no-code AI workflow platform. You will own encryption, key management, data protection, and secure-by-default patterns, collaborating with core engineers to scale security as the platform grows.

In this role you’ll work on PHI/PII scrubbing, storage encryption, tenant isolation, and threat modeling using modern tooling.

Qualifications

• 4+ years building security-critical systems in production.
• Experience with cryptography, key management, encryption, and signing in real systems.
• Secure architecture judgment to design and reason about secure systems.
• Multi-tenant SaaS isolation experience with data isolation guarantees.
• Strong secure-coding skills in Python and TypeScript/Node.js.
• Wiring security checks and gates into CI/CD so security is enforced automatically.

Responsibilities

• Own encryption and signing; manage KMS, envelope encryption, and signing pipelines.
• Protect customer data; extend PHI/PII scrubbing and strengthen data-protection foundations.
• Secure the storage layer; own encryption at rest and tenant isolation.
• Maintain secure-by-default templates and reference implementations embedded in our SDLC.
• Threat-model the platform across seams; lead AI-assisted threat-modeling tooling.
• Improve tooling; expand scanning, signals, and CI enforcement.
• Translate audit, compliance, and incident-response requirements into real codebase implementations.

Skills

Security engineering

Cryptography

Key management

Secure coding

CI/CD security

Multi-tenant isolation

Python

TypeScript/Node.js

Job description

About The Company

StackAI (by Asana) is a no-code AI workflow platform that empowers companies to build, deploy, and scale AI-powered workflows easily. With thousands of users and rapidly growing enterprise adoption, our mission is to democratize access to LLMs and bring AI into the hands of every business operator, not just developers. An Asana Company, we're building the foundational platform for the AI-driven future of work

About The Company

StackAI (by Asana) is a no-code AI workflow platform that empowers companies to build, deploy, and scale AI-powered workflows easily. With thousands of users and rapidly growing enterprise adoption, our mission is to democratize access to LLMs and bring AI into the hands of every business operator, not just developers. An Asana Company, we're building the foundational platform for the AI-driven future of work

About The Role

At StackAI, security is how we earn the trust of the enterprises building AI assistants on our platform. We're hiring a hands-on (Senior) Product Security Engineer to design, build, and harden the secure architecture at the core of the product, working as a technical partner to our Core engineering lead.

This is a hands-on engineering role. You'll write production code and own the security-critical systems the whole platform depends on: encryption and key management, customer data protection, and how security is built into the way every team ships.

If you want deep ownership of these systems and the chance to harden and scale them as the platform grows, we'd love to meet you.

What You'll Do

• Own encryption and signing. Take ownership of our KMS, key management, BYOK, envelope encryption, and signing pipeline across both cloud and on-prem deployments-operating, hardening, and evolving them as the platform scales.
• Protect the most sensitive customer data. Extend our PHI/PII scrubbing and strengthen the data-protection foundations that regulated enterprises already rely on.
• Secure the storage layer. Own encryption at rest and tenant isolation.
• Keep security the default in how we ship. Maintain and expand the secure-by-default templates and reference implementations embedded in our SDLC—the ones engineers actually want to adopt.
• Threat-model the platform. Lead threat modeling on the seams between systems (the execution engine, connector trust boundaries, and multi-tenant isolation), using modern, AI-assisted threat-modeling tooling.
• Raise the bar on tooling. Push our scanning further on coverage, signal, and CI enforcement, so critical findings never reach production.
• Be the technical point of contact for security standards. Translate audit, compliance, and incident-response requirements into real implementation in our codebase.

What we're looking for

• 4+ years building security-critical systems in production, with significant time spent implementing, not only reviewing or assessing.
• Practical depth in cryptography and key management: encryption, KMS, secrets handling, and signing in real systems.
• Secure architecture judgment: you can design and reason about secure systems and hold your own as a technical peer with senior engineers.
• Multi-tenant SaaS isolation experience, including the data-isolation guarantees regulated customers require.
• Strong secure-coding skills in our stack: Python on the backend, TypeScript/Node.js on the product surfaces.
• Comfortable wiring security checks and gates into CI/CD so security is enforced automatically in the pipeline.

Bonus points

• Cloud and API security fundamentals on GCP, Azure, or AWS.
• Securing on-prem, self-hosted, or air-gapped deployments.
• Experience in regulated domains (healthcare/PHI, finance, etc.).
• Familiarity with AI/LLM platform security: agent execution, connector trust boundaries, prompt and tool-call risk.
• Startup or growth-stage experience.

Compensation Range: $248K - $282K