Application Security Engineer, Generative AI

Liftoff•United States (Remote), CA

10d•$184,000 - $250,000•Remote

About The Position

Liftoff is hiring an Application Security Engineer to own application security for its GenAI, Creative GenAI, and emerging businesses. Application security is the primary focus, with contributions across cloud and infrastructure security and support for Accelerate and MX as priorities change. This individual contributor reports to the Director of Security and shares the security team's on-call and incident-response work. The role integrates security into engineering design and development, provides self-service tools and workflows that help engineers build and deploy securely, and assesses applications, architecture, vendors, and AI tools. The engineer will build maintainable security automation, including an AI-assisted code-security triage pilot, and work with Detection & Response to improve detections and response guidance. The position also participates in incident reviews and remediation follow-through. The role is eligible for full-time remote work in specified U.S. states and Canada. Liftoff is remote-first, with U.S. hubs in Redwood City, Los Angeles, and New York City. Employees are expected to attend in-person gatherings at least once per quarter. Base salary ranges from $200,000 to $250,000 in the San Francisco Bay Area, Los Angeles/Orange County, New York City, and Seattle, or $184,000 to $220,000 in other approved cities and towns, plus bonus. Liftoff describes its compensation as including competitive salaries, equity, and benefits that may include medical coverage, wellness stipends, and other country-dependent perks.

Requirements

At least 5 years of relevant experience in security engineering or software engineering.
Excellent judgment in prioritizing security efforts using a risk-based approach.
Experience partnering with cross-functional teams to deliver security improvements and help engineers select practical fixes.
Ability to write production-quality code for security tools and automation, review pull requests, and navigate large, unfamiliar codebases.
Strong understanding of secure software design, application and API security, authentication and authorization, threat modeling, and code review.
Experience assessing cloud and infrastructure security and contributing beyond a primary application-security specialty.
Ability to quickly understand complex engineering systems and architecture.
Practical software engineering habits, including testing, observability, version control, peer code review, continuous integration, and blameless postmortems.
Strong technical writing skills for design documents, proposals, runbooks, and post-incident reviews; ability to explain security risks and tradeoffs clearly in writing and conversation.
Willingness to share the security team's on-call and incident-response responsibilities, including occasional off-hours response.

Nice To Haves

Experience with Go, Python, Clojure, or JavaScript; ability to work across languages is more important than a specific language.
Experience securing GenAI applications, designing sandboxes, or evaluating AI-assisted security tools and their output.
Experience scaling cloud security or working with high-velocity software engineering teams, mobile advertising, or other high-volume SaaS environments.

Responsibilities

Establish secure software development standards and integrate security into engineering design and development.
Create documented review workflows, reusable tools, and secure design patterns so engineering teams can build and deploy securely through self-service paths.
Perform design and code reviews, threat modeling, and security assessments for GenAI, Creative GenAI, and emerging businesses, including sandbox design and isolation.
Partner with organizational stakeholders to foster a culture of security-minded builders.
Triage incoming security issues, prioritize vulnerabilities by risk, and work with engineering teams on timely remediation and verification.
Assess vendors and AI tools to determine whether their security controls and product features support secure employee use.
Share the security team's on-call and incident-response rotation, including occasional off-hours response.
Conduct blameless post-incident reviews, document findings, and follow through on remediation.
Build maintainable security tools and automation, including an AI-assisted code-security triage pilot that produces actionable findings at an acceptable false-positive rate.
Partner with Detection & Response to turn application-security findings and threat models into detection improvements and response guidance.
Contribute across application, cloud, and infrastructure security as priorities change, including support for Accelerate and MX.