Product Security Engineer

Work as a hands-on Product Security Engineer to make secure outcomes the default across the codebase and delivery workflow.ResponsibilitiesIdentify systemic security gaps in the codebase and engineering workflows, then partner with engineering teams to design and ship durable fixesBuild security tooling, automation, and code-level controls that address vulnerability classes (for example: custom linters, static analysis rules, and automated checks)Conduct in-depth code reviews and security design reviews for major product initiatives, engaging on architectural tradeoffs rather than only flagging issuesDrive threat modeling and security assessments for new features, translating security requirements into practical engineering guidanceHelp evolve the team’s security approach as AI-assisted development scales internally, including how higher-volume code production affects risk discovery, prioritization, and remediationTriaging and tracking vulnerabilities with product engineering teams, and contribute to penetration testing and bug bounty programsRequirements5+ years of hands-on application security and security engineering experience (built security solutions, not mainly consulting, audit, or compliance work)Ability to operate independently with strong judgment in a fast-moving environment, including knowing when to move quickly, when to slow down, and when to esc*late or request helpCommunication style that earns trust, making security legible to engineers without being preachy, and measuring impact by business support rather than issue volumeProven track record shipping security tooling or automation that improved outcomes for more than one teamDeep engineering capability to read, reason about, and review code to find real bugs and understand root causesComfort working withTypeScriptandPython(Retool platform is TypeScript; security tooling leverages Python)Strong AppSec fundamentals including threat modeling and secure code review, plus a practical understanding of common vulnerability classes and how to address them durablyPragmatic approach to AI tooling: use it where it improves results, remain skeptical where it does not, and consider how developer-side AI adoption compounds security risk at scaleTechnologiesTypeScriptPythonBenefitsComprehensive benefit plan including medical, dental, vision, and 401(k)Generous benefits for all employees and hybrid work locationNice to HaveOffensive security experience such as bug bounty, CTF participation, redteam, or pentestingExperience building or contributing to SAST pipelines, custom static analysis rules, or automated security testing infrastructurePrior experience at a startup or high-growth scaleup where security programs are not fully predefined and priorities changeLocation and SalaryLocation:San Francisco, CA (hybrid)Salary:USD 231,900 - 318,250 per year (base salary range for non-commissionable roles or on-target earnings for commissionable roles)Additional compensation:equity and/or commission may apply depending on the position offeredEligibility notes:Retool is set up to employ roles in the US and specific roles in the UK#J-18808-Ljbffr