Senior Security Engineer

ThoughtSpot; Phoenix, Northern (AZ, KY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

ThoughtSpot is seeking a Security Engineer to join the AI Platform Security team. This high-ownership, low-oversight role will own security outcomes for a portfolio of products and define how security reviews and standards operate across the organization.

You will build tooling and programs to scale security coverage, lead vulnerability management and the bug bounty program, and drive shift-left practices across the SDLC while shaping the AI/LLM security program for the team.

Qualifications

• Experience in security engineering, application security, offensive security, or a closely related technical discipline.
• Track record owning a security program area independently and driving cross-functional remediation without formal authority.
• Excellent written communication for standards, risk narratives, and executive reporting.

Responsibilities

• Own end-to-end security for an assigned portfolio of products: design reviews, threat modeling, risk acceptance, and driving high-severity findings to closure.
• Set technical direction for program areas: define the review bar, standards, checklists, and intake processes other engineers follow.
• Lead vulnerability management and the bug bounty program: complex triage, escalation, researcher relations, SLA ownership, and program evolution.
• Design and build security automation and internal tooling that removes manual toil and scales coverage beyond headcount.
• Drive shift-left adoption across the SDLC through pipeline gates, guardrails, paved-path patterns, and developer enablement.
• Lead the team's AI/LLM security practice: assessment methodology, testing approach, and applied frameworks for agentic and model-backed features.
• Communicate risk and program health to engineering and executive leadership through metrics, reporting, and clear written narratives.

Skills

Security engineering

Application security

Offensive security

Threat modeling

Written communication

Ambiguity tolerance

Leadership/mentorship

Tools

Snyk

Burp Suite

DAST/ SAST

Job description

ThoughtSpot is a Data & AI platform that helps companies turn data into enterprise advantage. We're Gartner MQ leaders with more than 1,000 customers globally and offices in Mountain View, Chicago, London, Bangalore, Sydney, and Tokyo.

In-Office at ThoughtSpot

Spotters are expected in-office 3+ days per week to be part of the energy of their local team. Momentum compounds when we're in the room together with faster decisions, sharper problem-solving, and the kind of peer learning that doesn't happen over a screen. Being in-office is our default way of working, with flexibility available where it's genuinely needed.

About ThoughtSpot

The world’s most innovative companies turn to ThoughtSpot’s AI-Powered Analytics to put data in the hands of everyone, from the C-suite to the frontline. With simple, natural language search and AI, anyone can ask questions, discover insights, and act with confidence. Unlike legacy tools that sacrifice performance for complexity, ThoughtSpot is intuitively designed for every business user while being built to handle the most complex, large-scale data, wherever it resides. This unique combination of speed and simplicity is why enterprise leaders trust ThoughtSpot to transform decision-making into a truly data-driven culture.

At ThoughtSpot, we’re a curious, data-driven bunch. We believe the world works better when everyone has access to facts. That’s why we build products that make asking and answering data questions as natural as having a conversation.

Mandatory and Required Skills for All ThoughtSpot Roles

Spotters are expected to demonstrate AI literacy and workflow integration to include to ability to:

• Comfortably and confidently integrate artificial intelligence into their daily workflow to increase productivity and quality.
• Hands-on experience to leverage AI tools (industry-leading LLMs) to increase productivity, automate routine tasks, and improve work quality.
• Speak to the experience of using AI for research, content creation, and document summarization while maintaining ownership of judgment and final decisions.
• Write effective prompts to get the most accurate and creative results from AI tools.

Spotters are expected to exemplify these key traits and AI Mindset:

• Curiosity in exploring new AI tools
• Adaptability to quickly learn and implement new, emerging AI technologies
• Critical thinking to know when to identify when AI should be used versus when human judgement is necessary

This combination of curiosity, adaptability, and discernment defines the AI mindset, and it’s required for every role at ThoughtSpot.

AI Mindset for All Spotters

At ThoughtSpot, we believe AI is a necessary and essential part of how we work. Every role, across every team, is expected to be fluent and comfortable with using AI to do their best work.

All Spotters are expected to experiment with ThoughtSpot’s AI tools (like Spotter and SpotterViz) and leading industry LLMs to streamline workflows, enhance output, and uncover new insights. Whether drafting content, analyzing data, or summarizing documents, AI is a daily partner. We value curiosity, openness to learning, and thoughtful application of AI to create real value. Training and resources are provided so every Spotter can confidently create with AI.

ThoughtSpot for All

At ThoughtSpot, diverse teams build better products. Complex data problems need many perspectives, not just one. We welcome different backgrounds, identities, and experiences, and we work to create a place where everyone can be themselves and do their best work.

What Makes ThoughtSpot a Great Place to Work?

ThoughtSpot is the Agentic Analytics Platform that empowers every enterprise to transform insights into action, on a mission to make the world more fact driven. We hire people with unique identities, backgrounds, and perspectives - this balance-for-the-better philosophy is key to our success. When paired with our culture of Trust, Customer Obsession, Innovation and Intensity, ThoughtSpot cultivates a respectful culture that pushes norms to create world-class products.

The Role:

We're looking for a Security Engineer to join our AI Platform Security team. It is a high-ownership, low-oversight role for an application/product security generalist who has already done the work and is ready to set direction rather than follow it. You'll own security outcomes for a portfolio of products, define how security reviews and standards operate across the organization, and build the tooling and programs that let a lean team cover a large surface area.

We are a lean, high-trust team. You'll make real risk calls, push back on engineering leadership when the data supports it, and be accountable for the areas you own while helping to shape how this team operates as it scales.

What You'll Do:

• Own end-to-end security for an assigned portfolio of products: design reviews, threat modeling, risk acceptance, and driving high-severity findings to closure
• Set technical direction for your program areas: define the review bar, standards, checklists, and intake processes other engineers follow
• Lead vulnerability management and the bug bounty program: complex triage, escalation, researcher relations, SLA ownership, and program evolution
• Design and build security automation and internal tooling that removes manual toil and scales coverage beyond headcount
• Drive shift-left adoption across the SDLC through pipeline gates, guardrails, paved-path patterns, and developer enablement
• Lead the team's AI/LLM security practice: assessment methodology, testing approach, and applied frameworks for agentic and model-backed features
• Communicate risk and program health to engineering and executive leadership through metrics, reporting, and clear written narratives

Who We're Looking For:

• Experience in security engineering, application security, offensive security, or a closely related technical discipline
• Deep, demonstrated knowledge of vulnerability classes and exploitation: injection, authentication and session flaws, access control, deserialization, SSRF, and their real-world variants
• Track record of owning a security program area independently and driving cross-functional remediation without formal authority
• Experience threat modeling non-trivial systems and translating findings into decisions engineering teams will actually act on
• Excellent written communication. You will produce standards, risk narratives, executive reporting, and researcher-facing correspondence
• Comfort operating with ambiguity and building structure where none exists yet

Preferred:

• Experience running or substantially maturing a bug bounty or vulnerability disclosure program
• Hands-on depth with security tooling such as Snyk, Burp Suite, DAST, or SAST platforms, including tuning and integration rather than just usage
• Demonstrated ability to build security automation or internal tooling used by others
• Applied understanding of AI/LLM security risks: prompt injection, insecure tool use, context and data leakage, model supply chain
• Prior mentorship, tech lead, or team lead experience
• Bug bounty participation as a researcher, published research, or CVE credit