Lead Application Security Engineer — Remote

Remote, United States
· Permanent
· Remote
Compensation: $220,000 to $320,000 base, plus competitive equity

Be the first security engineer on a platform that moves customer data for hundreds of enterprises, where tenant isolation is a problem you solve in the code and the roadmap is yours to write.

• Owning application security end to end as the first dedicated security hire, reporting to the VP of Engineering, while the engineering team roughly doubles in size
• Spending most of your week in the codebase, reading and writing production Type Script and Go, and shipping security fixes yourself
• Threat modeling new products and major redesigns early, while design choices are still cheap to change, and hardening them before they reach customers
• Designing sub-tenant access control for multi-team and multi-brand customers who need different levels of access to configuration and data inside the same account
• Improving rate limiting, abuse detection and the granularity of access control on internet-facing APIs that serve customer data at high volume
• Extending a multi-region, multi-cloud backend into new regions so global customers can meet their data residency requirements, with security designed into each launch
• Building your own roadmap: looking at the architecture, finding the highest-leverage problems and going after them, with the autonomy that comes with being the first person in the role

• Multi-tenant isolation on a system that runs very large volumes of data jobs every day and ingests a high-throughput stream of events. At that scale, a single isolation gap can expose one customer's data to another, so the margin for error is very small
• Compute isolation frameworks that you'll build and refine, balancing how strongly customer workloads are separated against cost and performance on a platform that keeps growing fast
• A backend spread across AWS, Azure and GCP that often operates against customer-owned cloud accounts, which means part of the trust boundary runs through infrastructure you don't control
• An authorization model for sub-tenants that has to be right early, because once hundreds of enterprise customers organize their teams and brands on top of it, changing it gets very expensive
• High-throughput public APIs where rate limiting and abuse detection must stop bad traffic without adding latency or blocking legitimate customers
• Privacy controls (PII handling, data residency, GDPR and CCPA) that are core engineering work here, since the product sits directly on top of customers' personal data

• A real background as a backend software engineer: you wrote production code (APIs, distributed systems, data pipelines) inside a product codebase before or alongside your move into security. The team cares much more about what you've built than about certifications
• 6+ years in security engineering with deep distributed systems knowledge, enough to understand what product teams are building and influence it from a place of trust
• Experience as an early security hire (first 1 to
  3) at a SaaS or data infrastructure company, plus 2+ years at a venture-backed or high-growth company as it went through real scale
• Staff or Lead level today, reached through promotions over tenures of 2 years or more
• Hands-on experience securing multi-tenant platforms (tenant isolation, authorization models) and systems that span several clouds or regions
• A degree in Computer Science, Math, Physics or a similar field, and the ability to explain a design clearly and stay precise under deep technical questions
• Bonus: privacy-adjacent security work, having designed or secured data infrastructure as an early…