Senior Enterprise Security Engineer

Thumbtack

About The Position

Thumbtack is seeking a Senior Enterprise Security Engineer to join their Cyber Security Team. This role focuses on enabling innovation at scale by making security the easiest path. The team partners closely with other departments to shape system design, guide architectural decisions, and evolve Thumbtack’s security posture. The role will specifically address the evolving risk landscape due to AI adoption, focusing on hardening IAM for non-human identities, defining safe defaults for AI agents and systems, and securing data pipelines. The goal is to ensure Thumbtack can move fast on AI while protecting customer and employee data.

Requirements

6+ years of experience in security engineering, enterprise security, application security, cloud security, or a related field.
Experience developing threat models and proposing technical guardrails for AI tooling and agentic systems, including non-human identities, tool/permission scoping, and safe defaults for agent behavior.
Deep expertise in modern enterprise security disciplines: authentication and authorization (SSO, OAuth/OIDC, SAML, federation, SCIM), API security and token handling, secrets management, least-privilege design, SaaS security and posture management.
Strong experience evaluating risk and conducting security design and architecture reviews across enterprise applications, SaaS platforms, integrations, and internally developed systems, including evaluating data flows, third-party integrations, trust boundaries, automation platforms, AI-connected workflows, and emerging integration patterns such as MCP.
Strong experience securing modern, cloud-native systems (AWS and/or GCP) and familiarity with core control domains such as audit logging, encryption, access control, data retention, and incident response.
Strong sense of ownership and accountability, balancing hands-on technical execution with the ability to mentor others, raise standards, and drive measurable improvements in enterprise security.
Excellent written and verbal communication skills, with the ability to influence without authority and translate technical risk into clear requirements and actionable guidance for both technical and non-technical audiences.

Responsibilities

Deliver high-quality security assessments and threat models for AI tools, agents, and AI-integrated systems, ensuring adherence to enterprise security principles, sound authentication, authorization, data access, and observability.
Design and validate technical guardrails and reusable patterns for safe AI usage, covering AI behavior (agent actions, tool/permission scoping, human-in-the-loop boundaries, input/output controls, audit/observability) and AI connectivity (MCP servers, integrations, trust boundaries, data pipelines).
Contribute to frameworks and tooling for secure AI development and use.
Harden IAM across the enterprise, focusing on non-human and delegated identities (service accounts, agent credentials, SaaS-to-SaaS OAuth, SCIM federation), applying least-privilege and lifecycle hygiene.
Provide broader security engineering support for enterprise platforms and services, including SaaS security, third-party integration security, data governance, endpoint security, and identity-centric controls.
Build paved paths, shared tooling, and automation to scale security controls.
Lead cross-functional security initiatives end-to-end, partnering with IT, Engineering, Legal, Privacy, Procurement, and business stakeholders.
Conduct security design and architecture reviews for enterprise applications, SaaS platforms, and internally developed systems.
Mentor engineers and partner-team members to raise the overall security bar.
Support security incident response and drive learning through post-incident analysis.