Principal Security Engineer
Smartsheet · Bellevue, WA, USA
About the role
The most senior individual contributor on Smartsheet's Application Security team, reporting to the Manager, Application Security, and based in Bellevue or remote in the US. The engineer leads threat modelling and product security reviews for the SaaS platform, acts as the team's authority on AI security, and sets the bar for AppSec practice across engineering.
The work includes defining the product security review service and personally reviewing high-risk features, deciding how risks in LLM workflows, agentic pipelines and MCP integrations are assessed, steering SAST, SCA, secrets and IaC tooling and secure coding standards, and mentoring the team. Smartsheet wants ten or more years in application security including running threat modelling programmes at scale, hands-on AI application security with fluency in the OWASP LLM Top 10, and manual code review skill in a language such as Python, Java or Go.