Principal Security Engineer

About the Role

Smartsheet is seeking a Principal Security Engineer to lead high-impact application security work across its SaaS platform. This is the Application Security team's most senior individual contributor role, responsible for threat modeling, product security reviews, AI security risk, and technical standards across engineering.

The role reports to the Manager, Application Security and may be based in Bellevue, WA, or remotely anywhere in the US where Smartsheet is a registered employer.

Responsibilities

• Own threat modeling and product security reviews, building models from architecture and data-flow artifacts and deriving actionable abuse cases, test scenarios, and design-phase security requirements.
• Define the product security review service, including its service model, triage criteria, and enforcement posture. Personally review high-risk features and document findings and remediation timelines.
• Define how AI security risks are assessed, monitored, and mitigated across products, engineering, and third-party integrations. Address LLM workflows, agentic pipelines, MCP integrations, prompt injection, indirect injection, and tool-calling authorization gaps.
• Evolve AI-assisted security reviews by evaluating detection value, build-versus-buy decisions, and toolchain coverage.
• Set technical direction for secure coding guidelines, CI/CD pipeline security, and SAST, SCA, secrets, and infrastructure-as-code scanning without primary operational ownership.
• Create runbooks, standards, and documentation that improve consistency and reduce single points of failure.
• Mentor AppSec engineers in threat modeling and security review design. Engage product and engineering leadership to influence architecture, security priorities, and investment decisions.

Required Qualifications

• At least 10 years of application security experience, including sustained technical leadership and direct ownership of threat modeling programs and security review services at scale.
• Ability to establish systematic threat modeling using STRIDE and data-flow and architecture diagrams, producing actionable test scenarios and abuse cases within agile design cycles.
• Hands-on experience securing AI-integrated applications, including LLM workflows, agentic systems, model APIs, and MCP integrations; fluency in the OWASP LLM Top 10 and current AI attack classes; experience using AI tools to scale security reviews.
• Experience reviewing architecture and manually reviewing production code for complex SaaS features, driving remediation through implementation, and influencing engineering leadership.
• Experience mentoring engineers into threat modeling ownership and attacker-mindset review design, establishing design-phase security gates, and sustaining engineering engagement.
• Depth in SAST, SCA, secrets, and infrastructure-as-code scanning within modern CI/CD pipelines, plus cloud security fundamentals sufficient to connect application controls to infrastructure.
• Fluency in at least one modern language such as Python, Java, TypeScript/JavaScript, Go, or equivalent. Ability to read production code to find issues tools miss and write maintainable automation.
• Strong written and verbal communication of risk and security requirements to audiences ranging from individual contributors to executives.
• Ability to build trusted relationships across engineering, product, and security through technical credibility and sustained engagement.
• Ongoing legal eligibility to work in the US.

Preferred Qualifications

• GitLab CI/CD experience, including security policy pipeline configuration and scanning job integration.
• Experience building AI-assisted security tools or LLM-integrated review workflows that expand security review coverage.
• Penetration testing expertise, including exploit writing or vulnerability chaining to validate real-world impact.
• Public security contributions such as conference speaking, CVE credits, published research, or industry recognition.

Compensation and Benefits

• Annual US base salary: $205,000–$257,500 USD. Actual compensation depends on experience, skills, and location.
• Eligibility for a market-competitive incentive opportunity.
• Subsidized medical, vision, and dental coverage for full-time employees.
• 401(k) match of 50% of contributions up to the first 6% of eligible pay.
• Monthly work and productivity stipend; flexible time away; sick leave; 12 paid holidays; a paid volunteer day; and up to 24 weeks of parental leave.
• Company-sponsored life insurance and short- and long-term disability coverage.
• Professional development, including Udemy courses, counseling membership, retail discounts, and a personal Smartsheet account.

Interview Accommodations

Candidates may request preparations to support a comfortable and positive interview experience.