{"id":123891,"url":"https://alion.io/job/smartsheet-principal-security-engineer","title":"Principal Security Engineer","company":{"id":1678,"name":"Smartsheet","domain":"smartsheet.com","url":"https://alion.io/company/smartsheet","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":80,"open_postings":21,"ghost_share":0,"stale_share":0.81,"repost_share":0,"time_to_fill_p50_days":57,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Bellevue, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":205000,"max":257500,"currency":"USD","period":"year","gross":null,"usd_annual":257500},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agile","optional":false},{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"JavaScript","optional":false},{"name":"LLM","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"OWASP","optional":false},{"name":"Python","optional":false},{"name":"Smartsheet","optional":false},{"name":"STRIDE","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Tool Use","optional":false},{"name":"TypeScript","optional":false},{"name":"CVE","optional":true},{"name":"GitLab CI","optional":true}],"status":"live","first_seen_at":"2026-08-25T21:54:10Z","employer_posted_date":"2026-10-05","last_verified_at":"2026-10-17T12:27:12Z","board_verified":true,"closed_at":null,"days_open":52,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":52},"description":"For over 20 years, Smartsheet has empowered teams to manage work seamlessly and scale solutions smarter. Now, in our most ambitious chapter yet, we are uniting human teams with AI agents. By orchestrating the work agents do best, automating manual tasks and uncovering insights at scale, we create the space for people to focus on what truly matters: judgment, creativity, and big thinking. That is magic at work, and it’s what we show up for every day.\nAI is reshaping what product security can accomplish, both as a target and as a tool. We're looking for a Principal Security Engineer to own the highest-leverage application security work at Smartsheet: leading threat modeling and product security reviews across a modern SaaS platform used by millions of customers, serving as the team's technical authority on AI security risk, and setting the technical standard for application security practice across the engineering organization.\nThis is the most senior individual contributor role on the Application Security team. The expectation is not just depth: it is reach. You will engage product and engineering leadership directly, drive security requirements rather than advisory recommendations, and build team capability over time. If you are a security engineer who thinks upstream, builds threat models that generate concrete test scenarios and can translate technical findings into architecture decisions and business outcomes, this role is built for you.\nThis role reports to the Manager, Application Security and can be based in our Bellevue, WA office or remotely from anywhere in the US where Smartsheet is a registered employer.\nYou Will: \n Lead Threat Modeling and Product Security Reviews: Own threat modeling and product security review as the team's primary upstream capability: build models from architecture and data-flow artifacts, derive concrete abuse cases and test scenarios, and drive security requirements into designs before they ship. Define and lead the product security review service (set the service model, triage criteria, and enforcement posture) and personally execute reviews for high-risk features with documented findings and remediation timelines. Engage product and engineering directly to establish security requirements at the design phase, with the technical credibility to influence architecture decisions.\nDefine AI Security Methodology and Drive It Across the Practice: Define how AI security risk is assessed, monitored, and mitigated across product, engineering, and third-party AI integrations, with recognized depth on the current threat landscape: LLM workflows, agentic pipelines, MCP-based integrations, and attack classes including prompt injection, indirect injection, and tool-calling authorization gaps. Own and evolve the AI-assisted security review capability: evaluate detection value, assess build-vs-buy tradeoffs, and shape toolchain coverage as Smartsheet's AI-integrated product surface scales.\n Shape AppSec Technical Direction and SDLC Controls: Serve as the technical authority for the AppSec program's SDLC control surface (secure coding guidelines, CI/CD pipeline security strategy, and toolchain direction across SAST, SCA, secrets, and IaC scanning) with the depth to influence tool decisions and resolve standards decisions that span teams without primary operational ownership. Build runbooks, standards, and documentation that create consistency and reduce single-point-of-failure risk as the team scales.\nElevate Team Capability and Engineering Organization Influence: Mentor AppSec team members on threat modeling tradecraft and security review design, and serve as the trusted technical voice with product and engineering leadership, framing risk in terms that move architecture decisions. Your judgment shapes how the team prioritizes and how the broader organization understands and invests in application security.\nYou Have:\n10+ years in application security with a track record of sustained technical leadership in product security or AppSec engineering, including direct ownership of threat modeling programs and security review services at scale.\nAbility to own threat modeling as a systematic practice (STRIDE, data-flow and architecture diagram driven), producing concrete, actionable test scenarios and abuse cases, embedded into agile design cycles as a repeatable, lightweight practice.\nHands-on experience securing AI-integrated applications (LLM workflows, agentic systems, model APIs, MCP-based integrations) with fluency in the OWASP LLM Top 10 and current AI attack classes, plus experience using AI tooling to scale security review coverage.\nExperience doing architecture review and targeted manual code review for complex SaaS features, with a track record of driving remediation requirements through to implementation with enough technical credibility to influence design decisions at the engineering leadership level.\nExperience mentoring engineers into threat modeling ownership and attacker-mindset review design; demonstrated track record of establishing security requirements as design-phase gates and sustaining engagement with engineering teams to drive implementation.\nSufficient depth in SAST, SCA, secrets, and IaC scanning in modern CI/CD pipelines to credibly influence toolchain direction, resolve standards decisions that span teams, and shape secure coding standards without primary operational ownership; cloud security fundamentals sufficient to tie application controls to the infrastructure they run on.\nFluent in one or more modern languages (Python, Java, TypeScript/JavaScript, Go, or equivalent); comfortable reading production codebases to surface issues tooling misses and writing or extending automation others can maintain.\nExpertise communicating risk and security requirements (written and verbal) clearly across audiences from engineering ICs through executive leadership; recognized as a trusted technical voice by partner teams.\nAbility to build trusted relationships across engineering, product, and security organizations; earns influence through technical credibility and sustained engagement.\nLegally eligible to work in the U.S. on an ongoing basis.\nNice to Have:\nGitLab CI/CD experience, including security policy pipeline configuration and scanning job integration.\nExperience building AI-assisted security tooling or LLM-integrated review workflows that scale security review coverage.\nPenetration testing depth including exploit writing or vulnerability chaining to validate exploitability and prove real-world impact.\nPublic-facing security contributions: conference speaking, CVE credits, published research, or industry community recognition that reflects the technical authority expected at principal level.\nCurrent US Perks & Benefits:\nEmployer subsidized medical/vision and dental coverage for full-time employees\n401k Match to help you save for your future (50% of your contribution up to the first 6% of your eligible pay)\nMonthly stipend to support your work and productivity\nFlexible Time Away Program, plus Sick Time Off\nUS employees are automatically covered under Smartsheet-sponsored life insurance, short-term, and long-term disability plans\nUS employees receive 12 paid holidays per year\nUp to 24 weeks of Parental Leave\nPersonal paid Volunteer Day to support our community\nOpportunities for professional growth and development including access to Udemy online courses\nCompany Funded Perks, including a counseling membership, local retail discounts, and your own personal Smartsheet account\nTeleworking options from any registered location in the U.S. (role specific)\nSmartsheet provides a competitive base salary range for roles that may be hired in different geographic areas we are licensed to operate our business from. Actual compensation is determined by several factors including, but not limited to, level of professional, educational experience, skills, and specific candidate location. In addition, this role will be eligible for a market competitive incentive opportunity.\nUS Base Salary Pay Range\n$205,000—$257,500 USD\nGet to Know Us:\nAt Smartsheet, your ideas are heard, your potential is supported, and your contributions have real impact. You’ll have the freedom to explore, push boundaries, and grow beyond your role. We welcome diverse perspectives and nontraditional paths-because we know that impact comes from individuals who care deeply and challenge thoughtfully. When you’re doing work that stretches you, excites you, and connects you to something bigger, that’s magic at work. Let’s build what’s next, together.\nEqual Opportunity Employer:\nSmartsheet is an Equal Opportunity (EEO) employer committed to fostering an inclusive environment with the best employees. It is our policy to provide equal employment opportunities to all qualified applicants in accordance with applicable laws in the US, UK, Australia, Germany, Costa Rica, Japan, Bulgaria, India, and Singapore. All qualified applicants will receive consideration without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, protected veteran or disabled status, or genetic information. \nIf there are preparations we can make to help ensure you have a comfortable and positive interview experience, please let us know.","description_format":"text","description_chars":9301,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Life insurance","Parental leave"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Project & Work Management Software"],"lifecycle":[{"event":"open","at":"2026-08-25T21:54:10Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 33 · green card filings: 18","filings_12m":33,"filings_prev_12m":44,"green_card_filings_12m":18,"median_offered_wage_usd":163088,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":42,"band":"fade","label":"Fading","p_open":1,"p_active":0.555,"p_room":0.75,"age_days":52,"expected_fill_days":57,"reasons":["conf:3","stale_co","velocity","win:late"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":257500,"is_top_pay":true},"html_url":"https://alion.io/job/smartsheet-principal-security-engineer","json_url":"https://alion.io/job/smartsheet-principal-security-engineer.json","meta":{"generated_at":"2026-10-17T14:39:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19732,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1678},"rest":"https://alion.io/mcp/rest/get_company?id=1678"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsmartsheet-principal-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsmartsheet-principal-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsmartsheet-principal-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/smartsheet-principal-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsmartsheet-principal-security-engineer"}]}