[Remote] Staff Application Security Engineer

Note: The job is a remote job and is open to candidates in USA. Thumbtack is a platform that helps millions of people manage their home improvement projects. They are looking for a Staff Application Security Engineer to own the technical direction for application security, lead cross-functional security initiatives, and design secure architectures to enable fast and safe product delivery.ResponsibilitiesOwn the long-term technical direction for application security across Thumbtack. Build prioritized roadmaps and drive remediation of systemic security risks across the application stackLead large, cross-functional security initiatives from problem definition through deliveryDesign secure-by-default architectures, standards, and paved paths for engineering teams. Design and implement shared security tooling, libraries, patterns, and services that enable engineering to ship quickly and safely. Embed security into CI/CD pipelines, cloud infrastructure, and developer workflowsPartner with engineering and product leaders to prioritize security investments based on risk, impact, and business goalsLead application security design reviews, architectural discussions, and threat modeling for critical systems. Contribute code, reviews, and designs to address complex or novel security risksMentor engineers and raise the overall security bar through guidance and exampleSupport security incident response and drive learning through post-incident analysisSkills8+ years of experience in software engineering and application security, including a strong understanding of secure coding practices and application security frameworksDeep expertise in secure system design and architecture as well as modern application security tools, patterns, and practices (e.g. threat modeling, secure design patterns, authentication and authorization, secrets management, vulnerability discovery and remediation workflows)Proven track record leading large, cross-functional technical initiatives with sustained impactStrong experience securing modern, cloud-native systems (AWS and/or GCP)Strong product intuition and analytical, risk-informed thinking, identifying where security investments will have the highest leverage and measurable impact. Ability to balance pragmatism and rigor, making thoughtful tradeoffs between risk, velocity, and maintainabilityStrong sense of ownership and accountability, balancing hands-on technical execution with the ability to mentor others, raise standards, and drive organization-wide improvements in application securityExcellent written and verbal communication skills, with the ability to influence without authority and the ability to explain complex security issues to both technical and non-technical audiencesCompany OverviewThumbtack is a home services website connecting users with local service providers. It was founded in 2008, and is headquartered in San Francisco, California, USA, with a workforce of 1001-5000 employees. Its website is https://www.thumbtack.com.Company H1B SponsorshipThumbtack has a track record of offering H1B sponsorships, with 7 in 2026, 35 in 2025, 48 in 2024, 39 in 2023, 53 in 2022, 69 in 2021, 47 in 2020. Please note that this does not guarantee sponsorship for this specific role.