> Markdown version of [/jobs/ext/4707955-staff-application-security-engineer](https://www.wearedevelopers.com/jobs/ext/4707955-staff-application-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Staff Application Security Engineer - **Company:** BambooHR LLC - **Location:** Altamont, UT, United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** PHP (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, User Authentication, Microsoft Azure, Software as a Service, Cloud Computing, Code Review, Cyber Security, Continuous Integration, Information Leak Prevention, Data Security, Python (Programming Language), OAuth, Open Source Technology, Open Web Application Security, Systems Development Life Cycle, Openid Connect, Session Management, Software Engineering, Systems Integration, TypeScript, Web Applications, Google Cloud, Large Language Models, Software Security, Model Validation, AI Coding Agents, Agentic-AI, HR Software, GWAPT, Information Technology, Integration Frameworks - **Published:** November 13, 2026 - **Apply:** https://www.careerbuilder.com/job-details/staff-application-security-engineer-altamont-ut--fb7ad470-b56e-4f02-a473-951841c68a94 ## About the Role Applications Security, Software Engineering, Artificial Intelligence (AI), Leading Edge Technology, Applications Security, Software Engineering, MCP - Microsoft Certified Professional, Threat Modeling, Model Review, Computer Security, * Bachelor''s degree in Computer Science, Information Security, or a related field, or equivalent practical experience * 8+ years of experience in security, including 5+ years of hands-on experience in application security * Experience securing multi-tenant SaaS platforms, including tenant isolation * Cloud and infrastructure security experience (e.g., AWS, Azure, GCP) * Hands-on experience building AI agents or agentic workflows, with concrete examples of how you handled permissions, failures, and validation - production systems, internal tools, personal or open-source projects, and substantial prototypes all count * Demonstrated ability to evaluate the security of AI and agentic systems, including prompt injection, tool and context poisoning, excessive agency, delegated authorization, data leakage, and supply-chain risk in models and tools; familiarity with the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications, or comparable frameworks * Ability to design evaluations for agentic workflows covering task success, false positives and negatives, adversarial cases, and regression checks * Proven experience leading threat modeling (e.g., STRIDE, attack trees) and design reviews for complex applications and APIs * Deep understanding of web application and API security, including authentication and authorization (OAuth 2.0 scopes and delegation, OpenID Connect, token audience and validation), session management, and access control models * Strong software engineering skills in at least one language (e.g., Python, TypeScript, PHP), including testing and maintaining tools other people depend on * A track record of influencing without authority: leading cross-team initiatives, building business cases, and explaining technical risk in business terms to engineering, product, legal, and leadership audiences * Experience mentoring engineers, formally or informally * Sound judgment in ambiguous situations, including the ability to explain a tradeoff, recommend a mitigation, and bring risk-acceptance decisions to the right owner What Will Make Us REALLY Love You * Experience securing MCP servers and gateways * Experience securing AI coding assistants or developer agent tooling at organizational scale, or integrating AI-driven security checks into CI/CD pipelines * Familiarity with AI governance and SaaS compliance frameworks (e.g., NIST AI RMF, ISO/IEC 42001, EU AI Act, SOC 2, ISO 27001) * Relevant security certifications (e.g., CSSLP, OSWE, GWAPT) * Experience building or running security champions programs, such as recruiting and training champions or embedding security advocates in engineering teams ## Description * Lead security reviews and threat models of AI features and agentic systems - including autonomous agents, MCP servers, and third-party integrations - and keep review playbooks and quality criteria current * Set BambooHR''s security standards for AI agents, covering identity and delegated authorization, tenant- and user-scoped data access, safe handling of tool output, tool supply chain, and human-approval requirements, and track adoption as threats evolve * Own the design of agents the security team uses for finding validation, triage, review assistance, and remediation - building and shipping them with clear evaluation criteria, bounded permissions, and human approval gates for high-impact actions * Help developers and security champions build and use agents safely through self-serve guidance and tooling, and advocate for the partner-team investment that work requires * Work with engineering and product leadership to embed security requirements into the SDLC, including design-time and release-time gates for AI features, and make agent-assisted code review, finding validation, and fix suggestions a default part of every team''s CI/CD pipeline with clear blocking criteria and a fast exception path * Run security programs that span multiple teams and quarters - setting goals, milestones, and success metrics; maintaining a lightweight intake, prioritization, and retrospective cadence; coordinating dependencies across engineering, product, and operations; and reporting progress, risks, and tradeoffs to leadership * Represent AppSec in architecture forums, harmonize security requirements to reduce duplicated effort across teams, act as a point of escalation, and coach leaders on security tradeoffs * Partner with Legal, Privacy, and GRC on AI governance to close gaps between policy intent and technical implementation through guardrails and automation, including for emerging AI regulations * Train and coach software engineers and engineering teams on secure design and threat modeling, with emphasis on authentication, authorization, multi-tenancy, and AI features * Mentor fellow security engineers on technical direction and career growth, and close skill gaps on the security team through onboarding, training, and mentorship * Participate in an on-call rotation as needed to support incident response and resolve escalated security issues, Our process utilizes AI as an assistant to efficiently process and analyze candidate data. Recruiters and hiring managers maintain full oversight and accountability, ensuring that all final selection and rejection decisions are human-made and based solely on objective job qualifications. Please see our General Privacy Notice and California Privacy Notice for more details.