Staff+ Application Security Engineer

About the Role

Anthropic's Application Security team secures the systems that build, serve, and increasingly are Claude. The attack surface encompasses multi-agent orchestration, sandboxed code execution, agents holding delegated credentials, and untrusted tool output crossing trust boundaries.

We use Claude as our primary tool across every part of the job: driving static analysis, drafting and fixing vulnerabilities via pull requests, performing first-line bug bounty triage, and assisting threat modeling for design reviews.

Key Responsibilities

• Design, build, and operate Claude-powered security systems (LLM-driven code analysis, automated vulnerability remediation, AI-assisted threat modeling) and own them end-to-end.
• Lead secure design reviews and threat modeling for novel AI systems, identifying risks that don't map to existing frameworks.
• Evolve a public bug bounty program where automation handles routine triage and root-cause work.
• Partner with Product, Infrastructure, and Research teams as an embedded security owner.
• Share an operational on-call rotation with the team (bounty escalations, incident response, and launch consults).

Minimum Qualifications

• Hands-on application and infrastructure security experience, including cloud and containerized environments.
• Production-quality coding ability in at least one of Python, Go, Rust, or TypeScript, with a track record of building durable systems.
• Practical threat-modeling and vulnerability-identification skills in real-world systems.
• Demonstrated ability to operate with high autonomy and ambiguity.
• Clear technical communication with both engineers and leadership.

Preferred Qualifications

• 7+ years in application security, security engineering, or security-focused software engineering.
• Existing experience using LLMs as a core part of your workflow.
• Experience securing agentic, code-execution, or LLM-integrated systems.
• Prior ownership of a bug bounty program, vulnerability disclosure program, or vulnerability-management infrastructure at scale.
• Background building security automation or developer-facing security tooling.
• Offensive security or penetration testing experience.