Senior AppSec Engineer: Build Security at Scale

ReTool; San Francisco (CA); On-site; USD 150,000 - 230,000; Full time

Job summary

Retool is seeking an Application Security Engineer who combines deep security fundamentals with hands-on engineering. You’ll work in code, spot systemic patterns, and build tooling and solutions that address security at scale, making secure outcomes the default.

You’ll collaborate with product teams to understand where code executes and how data flows, and you’ll help shape AI-enabled security practices as the company shipping fast grows more complex.

Qualifications

• 5+ years hands-on app security and security engineering experience.
• Ability to operate independently in a fast-moving environment.
• Communication that earns trust with engineers, not preaching.
• Track record shipping security tooling or automation across multiple teams.
• Genuine engineering depth: read, reason about, and review code.
• Proficiency in TypeScript and Python.
• Strong AppSec fundamentals: threat modeling and secure code review.
• Pragmatic, AI‑oriented approach to development and security tooling.

Responsibilities

• Identify systemic security gaps in codebase and engineering workflows; drive durable solutions with engineering teams.
• Build security tooling, automation, and code-level controls to catch issues earlier.
• Conduct in-depth code reviews and security design reviews for major initiatives.
• Drive threat modeling and security assessments for new features; translate requirements into practical guidance for developers.
• Contribute to AI-assisted security approaches as development scales; evaluate where AI adds real value.
• Triage, track, and drive remediation of vulnerabilities with product engineering teams; participate in pen-testing and bug bounty programs.

Skills

5+ years AppSec

Independent work

Communication skills

Security tooling

Code review

TypeScript

Python

AI tooling

Tools

SAST pipelines

Static analysis

Automated security testing

Job description

Retool is seeking an Application Security Engineer who combines deep security fundamentals with hands-on engineering. You’ll work in code, spot systemic patterns, and build tooling and solutions that address security at scale, making secure outcomes the default.

You’ll collaborate with product teams to understand where code executes and how data flows, and you’ll help shape AI-enabled security practices as the company shipping fast grows more complex.