Principal Security Engineer

🔥 3 minutes ago

☕ Washington – Remote

☕ Washington – Remote

💵 $205k - $257.5k / year

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Smartsheet

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2005

💼 Consulting

🏥 Healthcare

📣 Marketing

Consulting • Healthcare • Marketing

Smartsheet is a platform designed to manage projects, automate workflows, and build solutions at scale. It offers a wide range of features including automation, team collaboration, dashboards and reporting, and integrations, allowing businesses to streamline their operations. The platform caters to diverse use cases such as project management, IT portfolio management, marketing management, and more, serving various industries including government, finance, and healthcare. Smartsheet also emphasizes security and data protection, ensuring users' data privacy. Additionally, it offers professional services like consulting, training, and implementation support to maximize the platform's capabilities.

📋 Description

• Lead threat modeling and product security reviews across Smartsheet’s modern SaaS platform • Build threat models from architecture and data-flow artifacts • Derive abuse cases and concrete test scenarios • Define and lead the product security review service, including service model, triage criteria, and enforcement posture • Execute reviews for high-risk features and document findings and remediation timelines • Establish security requirements during the design phase and influence architecture decisions • Define how AI security risk is assessed, monitored, and mitigated across product, engineering, and third-party AI integrations • Evaluate AI-assisted security review capabilities, detection value, build-versus-buy tradeoffs, and toolchain coverage • Serve as technical authority for AppSec SDLC controls, secure coding guidelines, CI/CD pipeline security strategy, and SAST, SCA, secrets, and IaC scanning • Build runbooks, standards, and documentation for consistent application security practices • Mentor AppSec team members on threat modeling and security review design • Advise product and engineering leadership and shape organizational application security priorities

🎯 Requirements

• 10+ years in application security with sustained technical leadership in product security or AppSec engineering, including ownership of threat modeling programs and security review services at scale • Ability to own threat modeling as a systematic practice using STRIDE, data-flow and architecture diagrams, producing actionable test scenarios and abuse cases • Hands-on experience securing AI-integrated applications, including LLM workflows, agentic systems, model APIs, and MCP-based integrations • Fluency in the OWASP LLM Top 10 and current AI attack classes • Experience using AI tooling to scale security review coverage • Experience with architecture review and targeted manual code review for complex SaaS features • Track record of driving remediation requirements through implementation and influencing engineering leadership design decisions • Experience mentoring engineers in threat modeling ownership and attacker-mindset review design • Experience establishing security requirements as design-phase gates • Depth in SAST, SCA, secrets, and IaC scanning in modern CI/CD pipelines • Cloud security fundamentals • Fluency in one or more modern languages: Python, Java, TypeScript/JavaScript, Go, or equivalent • Comfortable reading production codebases and writing or extending maintainable automation • Expertise communicating risk and security requirements across engineering and executive audiences • Ability to build trusted relationships across engineering, product, and security organizations • Legally eligible to work in the U.S. on an ongoing basis • Nice-to-have: GitLab CI/CD, AI-assisted security tooling or LLM-integrated review workflows, penetration testing including exploit writing or vulnerability chaining, and public-facing security contributions

🏖️ Benefits

• Employer subsidized medical/vision and dental coverage for full-time employees • 401k Match: 50% of your contribution up to the first 6% of your eligible pay • Monthly stipend to support your work and productivity • Flexible Time Away Program, plus Sick Time Off • Smartsheet-sponsored life insurance, short-term, and long-term disability plans • 12 paid holidays per year • Up to 24 weeks of Parental Leave • Personal paid Volunteer Day • Opportunities for professional growth and development, including access to Udemy online courses • Company Funded Perks, including a counseling membership, local retail discounts, and your own personal Smartsheet account • Teleworking options from any registered location in the U.S. (role specific) • Market competitive incentive opportunity

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume