Application Security Engineer II

The role

You will own and deliver application security work within defined projects or domains. You will identify and remediate security risks and apply secure-by-default patterns to systems and architectures.

What you will do

• Own and deliver application security work within defined projects or domains.
• Contribute to cross-functional security initiatives.
• Identify, prioritize, and help remediate application security risks.
• Apply secure-by-default patterns and approved architectures.
• Partner with product and engineering teams to assess risk and recommend security improvements.
• Participate in application security design reviews and threat modeling.
• Write code, reviews, and documentation to address vulnerabilities.
• Participate in security incident response and post-incident analysis.

Required qualifications

• 4+ years of experience in software engineering and/or application security.
• Practical experience with threat modeling, secure design patterns, authentication and authorization, secrets management, and vulnerability remediation.
• Strong understanding of secure coding practices and common application security risks (e.g., OWASP Top 10).
• Ability to assess security risks and break down complex problems.
• Ability to reason about tradeoffs and make sound recommendations.
• Strong sense of ownership over assigned work.
• Clear written and verbal communication skills.

Nice to have

• interest in expanding depth in both application and cloud infrastructure security over time

About the company

Thumbtack is an app used to take care of and improve homes. The company helps homeowners with repairs, maintenance, and improvements through a community of 300,000 local service businesses.