Senior Application Security Engineer, Amplitude
GraphQL Focus
$161-266k
OTE
+ Employee Stock Purchase Program (ESPP)
Tuesdays and Thursdays
2 days a week in office
Product analytics company
Be an early applicant
Product analytics company
501-1000 employees
Be an early applicant
$161-266k
OTE
+ Employee Stock Purchase Program (ESPP)
Tuesdays and Thursdays
2 days a week in office
501-1000 employees
Company mission
To be the epicenter of digital business.
Role
Who you are
- This role is ideal for a technical engineer who has experience shipping code, understands how modern development works (especially GraphQL), and wants to make prevention (not patching) the default
- 4+ years of experience in application security engineering or software development roles with secure software design as a focus
- Proficient in at least one backend language (TypeScript, Python, or Java)
- Experience in GraphQL API security
- Experience defining and enforcing security controls in CI/CD pipelines and Kubernetes-based environments
- Deep understanding of authentication/authorization patterns (OAuth2, JWT, resolver-level controls) and API security best practices
- Demonstrated ability to implement and operationalize security guardrails, not just suggest them
- Comfort working cross-functionally with engineering, platform, and product teams to balance security, usability, and speed
- Experience using or integrating AI-powered tools for tasks like alert triage, code scanning, and detection automation is a strong plus
- A bias toward action; you’re willing to roll up your sleeves and fix issues directly when it makes sense
What the job involves
- We’re looking for a Senior Application Security Engineer who thrives at the intersection of software engineering and security
- You’ll play a pivotal role in proactively building security into our development lifecycle; designing guardrails, blocking insecure patterns, and ensuring the foundations of our platform are secure by default
- You won't just file Jira tickets and walk away; you’ll partner closely with engineers to fix issues, improve tooling, and make it easier to do the secure thing
- Define and enforce security guardrails by building golden paths and secure frameworks that developers can follow with confidence
- Block insecure code paths in CI/CD using tools like GitHub Actions, Argo Workflows, and Kubernetes admission controllers
- Leverage AI/ML tools to automate code review, alert triage, log analysis, and threat detection for application-layer risks
- Build and deploy rules and other security checks that break the build when critical vulnerabilities are introduced
- Partner with teams to implement fixes for security issues, not just report them; security ownership doesn’t end at filing the ticket
- Define and enforce best practices for GraphQL schema design, including access control, rate limiting, schema hardening, and versioning
- Lead security design and code reviews, threat modeling exercises, and security validation in critical product areas
- Analyze past vulnerabilities and incidents to eliminate root causes and reduce recurring issues
- Contribute to and evolve internal tooling and frameworks to make secure development frictionless and fast
- Participate in an on-call rotation for urgent security issues and incident response
Our take
Amplitude provides product analytics to help companies understand user behaviour. Product, marketing, and growth teams use Amplitude to discover and share insights about user engagement, retention, and revenue.
Amplitude’s user flows reveal which actions are the most commonly taken after users sign up, and which usually precede purchases made in-app, creating paths through the app. The behaviour of individual app users can be viewed with unlimited real-time activity feeds and user timelines.
Thousands of companies use Amplitude analytics including Microsoft, Under Armour, Intuit, Twitter, Bonobos, Peloton, and many more. In 2024, a securities fraud case was filed against Amplitude due to an IPO and stock share rise that was alleged to be artificially inflated before their downturn in 2022. Whilst this case is ongoing, Amplitude is still releasing new products and operating at full capacity.
Freddie
Company Specialist at Welcome to the Jungle
Insights
0% employee growth in 12 months
Company
Funding (last 2 of 7 rounds)
Jun 2021
$150m
LATE VC
May 2020
$50m
SERIES E
Total funding: $336m
Company benefits
- We offer a generous 12-week parental leave for fathers/partners and 18-20 weeks for new birthing parents. This leave policy also provides flexible scheduling so you can spend time with your family and bond with your little one. Specific leave policy will vary by country
- We believe it’s important to unplug from work to reset and recharge. We offer flexible vacation time and unlimited PTO — and we encourage you to use it!
- We provide a monthly stipend for the wellness activity of your choosing, from gym memberships and fitness classes to acupuncture and massages
- Equity is an important component of compensation, but it should benefit you (not just the company). In addition to offering competitive RSU grants that vest quarterly over three years, our Employee Stock Purchase Plan gives employees the option to buy below market price
Company HQ
Yerba Buena, San Francisco, CA
Leadership
Spenser Skates
(CEO)Previously worked as an Algorithmic Trader, Researcher at DRW Trading Group. They co-found Sonalight but are no longer working at the company.
Curtis Liu
(CTO)Previously worked as a Teaching Assistant at MIT and as a Software Engineer at Google. They co-found Sonalight but are no longer working at the company.
Jeffrey Wang
(Chief Architect)They studied computer science at university. They have extensive experience in software engineering prior to co-founding Amplitude.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 34 more jobs at Amplitude