Application Security Engineer

LangChain•San Francisco, CA

2d•$175,000 - $215,000

About The Position

LangChain is hiring a hands-on security lead embedded with core product teams to secure agentic workloads end-to-end, from SDKs through LangSmith and LangGraph services to customer integrations. The engineer will define the security roadmap, deliver immediate hardening improvements, and strengthen protection of AI infrastructure in production. The role owns product and platform security across LangSmith, LangGraph, and the LangChain SDK ecosystem, including Python, TypeScript, and Go. It includes advancing secure-by-default authentication and authorization, SSO/SAML/OIDC/SCIM, token lifecycles, service-to-service authentication, and tenant isolation for cloud and self-hosted customers. The engineer will contribute secure designs and code, establish lightweight security checks, improve infrastructure security, and lead vulnerability management and incident readiness. LangChain builds open-source agent engineering frameworks and a platform for building, evaluating, deploying, and operating agents. Its products include LangSmith and the open-source frameworks LangChain, LangGraph, and Deep Agents. The company serves developers and organizations building production AI agents.

Requirements

At least 5 years of experience in security engineering.
Strong software engineering skills in Python or Go; TypeScript is a plus.
Cloud and Kubernetes security experience, such as GCP/AWS IAM, workload identity, admission controls, and network policies.
Hands-on application security experience, including code review, threat modeling, secure design, secrets and key management, authentication and authorization patterns, and multi-tenant isolation.
Experience building detection and response capabilities and managing incidents.
Familiarity with supply-chain security, including SBOM, sigstore/cosign, SLSA-style controls, and dependency risk management.
Clear, pragmatic communication with engineers and customers.

Nice To Haves

Security experience with SaaS and self-hosted offerings, including air-gapped deployments.
Exposure to SOC 2 or ISO 27001 programs and evidence automation.
Experience with Go services, Infrastructure as Code (Terraform/Helm), and policy-as-code (OPA/Gatekeeper/Kyverno).
Knowledge of privacy patterns such as data minimization, retention, masking, and workspace scoping.

Responsibilities

Own product and platform security controls across LangSmith, LangGraph, and the LangChain SDK ecosystem.
Evolve secure-by-default authentication and authorization, including SSO/SAML/OIDC/SCIM, token lifecycles, service-to-service authentication, and tenant isolation for cloud and self-hosted customers.
Design secure systems, write code and pull requests, and introduce lightweight checks such as linters, dependency and supply-chain scanning, and SBOM/SLSA provenance.
Improve infrastructure security through network segmentation and Zero Trust, Kubernetes posture, secrets management, key rotation, least-privilege IAM, and egress controls.
Develop incident-response runbooks and detection rules, conduct tabletop exercises, and lead post-incident forensics and blameless root-cause analyses.
Own vulnerability scanning, triage, and patch SLAs, coordinating with engineering teams to remediate vulnerabilities quickly.
Define the security roadmap and deliver immediate security hardening improvements.