[Hiring] Principal Security Engineer @Smartsheet

Role Description

AI is reshaping what product security can accomplish, both as a target and as a tool. We're looking for a Principal Security Engineer to own the highest-leverage application security work at Smartsheet:

• Leading threat modeling and product security reviews across a modern SaaS platform used by millions of customers.
• Serving as the team's technical authority on AI security risk.
• Setting the technical standard for application security practice across the engineering organization.

This is the most senior individual contributor role on the Application Security team. The expectation is not just depth: it is reach. You will engage product and engineering leadership directly, drive security requirements rather than advisory recommendations, and build team capability over time.

If you are a security engineer who thinks upstream, builds threat models that generate concrete test scenarios, and can translate technical findings into architecture decisions and business outcomes, this role is built for you.

This role reports to the Manager, Application Security and can be based in our Bellevue, WA office or remotely from anywhere in the US where Smartsheet is a registered employer.

Qualifications

• 10+ years in application security with a track record of sustained technical leadership in product security or AppSec engineering.
• Ability to own threat modeling as a systematic practice (STRIDE, data-flow and architecture diagram driven).
• Hands-on experience securing AI-integrated applications (LLM workflows, agentic systems, model APIs, MCP-based integrations).
• Experience doing architecture review and targeted manual code review for complex SaaS features.
• Experience mentoring engineers into threat modeling ownership and attacker-mindset review design.
• Sufficient depth in SAST, SCA, secrets, and IaC scanning in modern CI/CD pipelines.
• Fluent in one or more modern languages (Python, Java, TypeScript/JavaScript, Go, or equivalent).
• Expertise communicating risk and security requirements clearly across audiences.
• Ability to build trusted relationships across engineering, product, and security organizations.
• Legally eligible to work in the U.S. on an ongoing basis.

Requirements

• Own threat modeling and product security review as the team's primary upstream capability.
• Define how AI security risk is assessed, monitored, and mitigated across product, engineering, and third-party AI integrations.
• Serve as the technical authority for the AppSec program's SDLC control surface.
• Mentor AppSec team members on threat modeling tradecraft and security review design.

Benefits

• Employer subsidized medical/vision and dental coverage for full-time employees.
• 401k Match to help you save for your future (50% of your contribution up to the first 6% of your eligible pay).
• Monthly stipend to support your work and productivity.
• Flexible Time Away Program, plus Sick Time Off.
• US employees are automatically covered under Smartsheet-sponsored life insurance, short-term, and long-term disability plans.
• US employees receive 12 paid holidays per year.
• Up to 24 weeks of Parental Leave.
• Personal paid Volunteer Day to support our community.
• Opportunities for professional growth and development including access to Udemy online courses.
• Company Funded Perks, including a counseling membership, local retail discounts, and your own personal Smartsheet account.
• Teleworking options from any registered location in the U.S. (role specific).
• Competitive base salary range for roles that may be hired in different geographic areas.