Staff Application Security Engineer
Bamboohr17 · Utah | Remote
About this role
**Staff Application Security Engineer (Remote)** *Please Note:* This is a remote position available in the state listed on this job. Additionally, employment with BambooHR is contingent on passing both a background and credit check. --- ## AI at BambooHR At BambooHR, we’re integrating AI into our solutions and workflows to enhance efficiency and drive innovation. We’re looking for people who are curious about AI’s potential, eager to learn and adapt, and ready to explore how intelligent tools can elevate their work. --- ## Essential Job Duties AI is becoming part of how BambooHR’s platform works—from features we build to agents that connect through open protocols. You’ll help lead application security through that shift and beyond. You will: - Lead security reviews and threat models of AI features and agentic systems (including autonomous agents, MCP servers, and third-party integrations), and keep review playbooks and quality criteria current. - Set BambooHR’s security standards for AI agents, including identity and delegated authorization, tenant- and user-scoped data access, safe handling of tool output, tool supply chain, and human-approval requirements—while tracking adoption as threats evolve. - Own the design of agents the security team uses for validation, triage, review assistance, and remediation—building and shipping them with clear evaluation criteria, bounded permissions, and human approval gates for high-impact actions. - Help developers and security champions build and use agents safely through self-serve guidance and tooling, and advocate for the partner-team investment required. - Work with engineering and product leadership to embed security requirements into the SDLC, including design-time and release-time gates for AI features. Make agent-assisted code review, validation finding, and fix suggestions a default part of every team’s CI/CD pipeline with clear blocking criteria and a fast exception path. - Run security programs spanning multiple teams and quarters: set goals, milestones, and success metrics; maintain a lightweight intake/prioritization/retrospective cadence; coordinate dependencies across engineering, product, and operations; and report progress, risks, and tradeoffs to leadership. - Represent AppSec in architecture forums, harmonize security requirements to reduce duplicated effort, act as a point of escalation, and coach leaders on security tradeoffs. - Partner with Legal, Privacy, and GRC on AI governance to close gaps between policy intent and technical implementation through guardrails and automation (including emerging AI regulations). - Train and coach software engineers and engineering teams on secure design and threat modeling, with emphasis on authentication, authorization, multi-tenancy, and AI features. - Mentor fellow security engineers on technical direction and career growth, and close skill gaps through onboarding, training, and mentorship. - Participate in an on-call rotation as needed to support incident response and resolve escalated security issues. --- ## What You Need to Get the Job Done - Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent practical experience. - 8+ years of security experience, including 5+ years hands-on application security. - Experience securing multi-tenant SaaS platforms, including tenant isolation. - Cloud/infrastructure security experience (e.g., AWS, Azure, GCP). - Hands-on experience building AI agents or ag
Listing freshness
CronJobs last confirmed this listing 46m ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.