[Hiring] Application Security Engineer II @Thumbtack

Role Description

The Security Engineering team at Thumbtack is focused on enabling innovation at scale by making the secure path the easiest path. We believe strong security is not a blocker to velocity, but a force multiplier when it is designed into systems, platforms, and developer workflows from the start.

As Thumbtack scales and increasingly incorporates AI-powered features into our products and internal systems, security must evolve without slowing innovation. The number of services, deployment patterns, and data flows continues to grow, and traditional approaches that rely heavily on manual reviews or after-the-fact controls do not scale to meet this need.

Instead, the challenge is to design security into the system itself. This means building secure defaults, paved paths, and reusable building blocks that product and engineering teams can adopt with minimal friction.

What you’ll do:

• Own and deliver application security work within defined projects or domains.
• Contribute to cross-functional security initiatives, executing clearly scoped pieces of larger efforts.
• Identify, prioritize, and help remediate application security risks in partnership with engineering teams.
• Apply secure-by-default patterns and approved architectures when designing or reviewing systems.
• Partner with product and engineering teams to assess risk and recommend practical, risk-informed security improvements.
• Participate in application security design reviews and threat modeling for new and existing systems.
• Write code, reviews, and documentation to address vulnerabilities and reduce recurring classes of issues.
• Participate in security incident response and contribute to post-incident analysis and remediation.

Qualifications

• 4+ years of experience in software engineering and/or application security.
• Practical experience with application security techniques such as threat modeling, secure design patterns, authentication and authorization, secrets management, and vulnerability remediation.
• Strong understanding of secure coding practices and common application security risks (e.g., OWASP Top 10).
• Ability to assess security risks and break down complex problems, reason about tradeoffs, make sound recommendations, and deliver practical, impactful solutions with guidance when needed.
• Strong sense of ownership over assigned work, with the ability to execute independently and follow through.
• Clear written and verbal communication skills, including the ability to explain security issues to engineers with varying levels of security expertise.
• A growth mindset and interest in learning from more senior engineers and expanding depth in both application and cloud infrastructure security over time.

Requirements

• Expected salary ranges for candidates living in Ontario and British Columbia: $118,200.00 - $152,900.00.
• Actual offered salaries will vary and will be based on various factors, such as calibrated job level, qualifications, skills, competencies, and proficiency for the role.

Benefits

• Thumbtack embraces diversity and is proud to be an equal opportunity workplace.
• We do not discriminate on the basis of sex, race, color, age, pregnancy, sexual orientation, gender identity or expression, religion, national origin, ancestry, citizenship, marital status, military or veteran status, genetic information, disability status, or any other characteristic protected by law.
• We will consider for employment qualified applicants with arrest and conviction records, consistent with applicable law.
• Thumbtack is committed to working with and providing reasonable accommodation to individuals with disabilities.