> Markdown version of [/jobs/ext/3975198-lead-application-security-engineer-remote](https://www.wearedevelopers.com/jobs/ext/3975198-lead-application-security-engineer-remote). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead Application Security Engineer -- Remote

- **Company:** French & French, LLC
- **Location:** San Francisco, CA, United States (Remote available)
- **Experience:** Expert
- **Salary:** $220,000.0 - $320,000.0
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Amazon Web Services, Microsoft Azure, Big Data, Software as a Service, Customer Data Management, Data Infrastructure, Distributed Systems, TypeScript, Privacy Controls, Google Cloud, Software Security, Backend, Rate Limiting, Information Technology, Production Code, Data Pipelines, Golang
- **Published:** October 27, 2026
- **Apply:** https://www.thejobnetwork.com/job/c856bc9e-ef3e-4ee7-8af1-7e8da175c400/lead-application-security-engineer-remote

## About the Role

* A real background as a backend software engineer: you wrote production code (APIs, distributed systems, data pipelines) inside a product codebase before or alongside your move into security. The team cares much more about what you've built than about certifications
 * 6+ years in security engineering with deep distributed systems knowledge, enough to understand what product teams are building and influence it from a place of trust
 * Experience as an early security hire (first 1 to 3) at a SaaS or data infrastructure company, plus 2+ years at a venture-backed or high-growth company as it went through real scale
 * Staff or Lead level today, reached through promotions over tenures of 2 years or more
 * Hands-on experience securing multi-tenant platforms (tenant isolation, authorization models) and systems that span several clouds or regions
 * A degree in Computer Science, Math, Physics or a similar field, and the ability to explain a design clearly and stay precise under deep technical questions
 * Bonus: privacy-adjacent security work, having designed or secured data infrastructure as an early engineer, or experience at a security-focused company. Former managers who want to return to a fully hands-on IC role are welcome, Languages: English (fluent, professional)

## Description

* Owning application security end to end as the first dedicated security hire, reporting to the VP of Engineering, while the engineering team roughly doubles in size
 * Spending most of your week in the codebase, reading and writing production TypeScript and Go, and shipping security fixes yourself
 * Threat modeling new products and major redesigns early, while design choices are still cheap to change, and hardening them before they reach customers
 * Designing sub-tenant access control for multi-team and multi-brand customers who need different levels of access to configuration and data inside the same account
 * Improving rate limiting, abuse detection and the granularity of access control on internet-facing APIs that serve customer data at high volume
 * Extending a multi-region, multi-cloud backend into new regions so global customers can meet their data residency requirements, with security designed into each launch
 * Building your own roadmap: looking at the architecture, finding the highest-leverage problems and going after them, with the autonomy that comes with being the first person in the role

Where it gets technically interesting

 * Multi-tenant isolation on a system that runs very large volumes of data jobs every day and ingests a high-throughput stream of events. At that scale, a single isolation gap can expose one customer's data to another, so the margin for error is very small
 * Compute isolation frameworks that you'll build and refine, balancing how strongly customer workloads are separated against cost and performance on a platform that keeps growing fast
 * A backend spread across AWS, Azure and GCP that often operates against customer-owned cloud accounts, which means part of the trust boundary runs through infrastructure you don't control
 * An authorization model for sub-tenants that has to be right early, because once hundreds of enterprise customers organize their teams and brands on top of it, changing it gets very expensive
 * High-throughput public APIs where rate limiting and abuse detection must stop bad traffic without adding latency or blocking legitimate customers
 * Privacy controls (PII handling, data residency, GDPR and CCPA) that are core engineering work here, since the product sits directly on top of customers' personal data