Staff Application Security Engineer, Thumbtack
$212.5-323.4k
Salary is dependent on location
Local services marketplace app
Open for applications
Local services marketplace app
1001+ employees
Open for applications
$212.5-323.4k
Salary is dependent on location
1001+ employees
Company mission
Thumbtack's mission is to help homeowners care for their homes, all the way from minor retouching to fundamental remodelling projects.
Role
Who you are
- 8+ years of experience in software engineering and application security, including a strong understanding of secure coding practices and application security frameworks
- Deep expertise in secure system design and architecture as well as modern application security tools, patterns, and practices (e.g. threat modeling, secure design patterns, authentication and authorization, secrets management, vulnerability discovery and remediation workflows)
- Proven track record leading large, cross-functional technical initiatives with sustained impact
- Strong experience securing modern, cloud-native systems (AWS and/or GCP)
- Strong product intuition and analytical, risk-informed thinking, identifying where security investments will have the highest leverage and measurable impact. Ability to balance pragmatism and rigor, making thoughtful tradeoffs between risk, velocity, and maintainability
- Strong sense of ownership and accountability, balancing hands-on technical execution with the ability to mentor others, raise standards, and drive organization-wide improvements in application security
- Excellent written and verbal communication skills, with the ability to influence without authority and the ability to explain complex security issues to both technical and non-technical audiences
What the job involves
- The Security Engineering team at Thumbtack is focused on enabling innovation at scale by making the secure path the easiest path. We believe strong security is not a blocker to velocity, but a force multiplier when it is designed into systems, platforms, and developer workflows from the start
- We partner closely with Product, Engineering, Platform, and Data teams to shape system design, guide architectural decisions, and evolve Thumbtack’s security posture as the company scales. Through collaboration, automation, and thoughtful tradeoffs, we help ensure Thumbtack can ship fast, innovate boldly, and maintain customer trust
- As Thumbtack scales and increasingly incorporates AI-powered features into our products and internal systems, security must evolve without slowing innovation
- The number of services, deployment patterns, and data flows continues to grow, and traditional approaches that rely heavily on manual reviews or after-the-fact controls do not scale to meet this need. Instead, the challenge is to design security into the system itself
- This means building secure defaults, paved paths, and reusable building blocks that product and engineering teams can adopt with minimal friction
- By embedding security directly into architectures, tooling, and infrastructure, we reduce cognitive load on engineers and enable teams to move quickly and confidently while meaningfully lowering risk
- Own the long-term technical direction for application security across Thumbtack. Build prioritized roadmaps and drive remediation of systemic security risks across the application stack
- Lead large, cross-functional security initiatives from problem definition through delivery
- Design secure-by-default architectures, standards, and paved paths for engineering teams. Design and implement shared security tooling, libraries, patterns, and services that enable engineering to ship quickly and safely. Embed security into CI/CD pipelines, cloud infrastructure, and developer workflows
- Partner with engineering and product leaders to prioritize security investments based on risk, impact, and business goals
- Lead application security design reviews, architectural discussions, and threat modeling for critical systems. Contribute code, reviews, and designs to address complex or novel security risks
- Mentor engineers and raise the overall security bar through guidance and example
- Support security incident response and drive learning through post-incident analysis
Our take
ThumbTack is a local services marketplace app that pairs customers with skilled professionals. Instead of simply searching for a professional, users provide ThumbTack with details of the job they need completing and the professionals then pitch their services to the potential customer using credits. ThumbTack makes its money by charging the professional for these credits.
It positions itself as something a little different in a saturated local services space that is dominated by companies like Angie’s List, TaskRabbit, Yelp, eBay, and Amazon. It also focuses on a broad range of professionals, from traditional home services like electricians and painters to photographers, personal trainers, and birthday party magicians.
The COVID-19 pandemic saw a boost in business for ThumbTack as more people stayed at home and made changes to their properties, increasing the demand for home professionals. In fact, after 2019, the company doubled in value to $3.2 billion with its 2021 raise. Since its 2024 funding round, its updated app has 30 new features, and the company is partnering with the likes of trade-powering platform and Unicorn ServiceTitan, indicating Thumbtack's sustained sway in the market.
Freddie
Company Specialist at Welcome to the Jungle
Insights
-5% employee growth in 12 months
Company
Funding (last 2 of 9 rounds)
Jun 2021
$275m
LATE VC
Jul 2019
$150m
SERIES F
Total funding: $699.4m
Company benefits
- Parental leave
- Health insurance
- Community matters | Sure, our ways of connecting have changed. But we haven’t missed a beat, from virtual concerts to “TTversary” celebrations to weekly catch-ups
- Always be improving | We bring out the best in our colleagues — and our product — by pushing each beyond what we believe we’re capable of. We give honest feedback, even when it’s hard
- Wellness is a way of life | We promote balance with generous PTO and company-wide holidays — and find our centers every Wellness Wednesday with yoga featuring a Thumbtack pro
- A worthy mission | In a world where tech is often seen as eroding good jobs, we’re helping small business owners thrive. Our product makes entrepreneurship accessible to everyone
- Driven by our values | Our values are the compass by which we make all our decisions. Each one matters: Lead with why, Make it count, Own it, Choose teamwork, and Say what you mean
- Plus, amazing benefits | All the benefits you’d expect, plus a few more: generous parental and fertility benefits, $1800 for Thumbtack services per year and a $1200 remote work stipend
- Virtual-first working model coupled with quarterly in-person events and Camp Thumbtack
- 20+ company-wide holidays including two week-long shutdowns
- Libraries (collaborative workspaces) in San Francisco, Salt Lake City, Toronto, and Manila
- Cell phone and WiFi reimbursements
- Subscriptions and Employee Assistance Program for mental health and well-being
Company HQ
SoMa, San Francisco, CA
Leadership
Marco Zappacosta
(Co-Founder & CEO)Having studied at Columbia University, Marco co-founded Thumbtack in August 2008. He has served as CEO since January 2009.
Jonathan Swanson
(Co-Founder & Chairman)Jonathan started his career creating financial market reports for the White House before co-founding Thumbtack in 2008. Currently Founder at Powerset and Athena.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 9 more jobs at Thumbtack