Application Security Engineer

📋 Job Overview

At LangChain, our mission is to enable every company to own its intelligence. We believe agents will transform how companies operate, and we're building the foundation to make that future possible. Our open-source harnesses and LangSmith platform give developers and enterprises the infrastructure to run, improve, and govern agents at scale.

🏢 About LangChain

We've raised $460M to date, with our most recent funding round valuing the company at $3B, backed by leading investors including Sequoia, Benchmark, IVP, and CapitalG. As we continue to expand our platform and tackle some of the hardest challenges in agent engineering, every team member has the opportunity to make a meaningful impact and help shape both our technology and the future of the industry.

More than 7,000 organizations rely on LangSmith, from fast-growing startups to Fortune 500 enterprises, including NVIDIA, Bridgewater, LinkedIn, Workday, and Rippling. We're just getting started on making high-performing agents easier to build and manage at scale.

🎯 The Role

You’ll be the hands‑on security lead embedded with core product teams to secure agentic workloads end‑to‑end, from SDK through LangSmith/Graph services and customer integrations. You’ll define our security roadmap, land immediate hardening wins, and raise the bar on how AI infra is protected in production.

✅ Key Responsibilities

• Own product & platform security: Design and drive application/infrastructure security controls across LangSmith, LangGraph, and the LangChain SDK ecosystem (Python/TS/Go).
• Secure-by-default authN/Z: Evolve SSO/SAML/OIDC/SCIM, token lifecycles, service‑to‑service auth, and tenant isolation for cloud and self‑hosted customers.
• Ship code & reviews: Land secure designs, write PRs, and introduce lightweight checks (linters, dependency/supply‑chain scanning, SBOM/SLSA provenance).
• Hardening & operations: Network segmentation/Zero Trust, Kubernetes posture, secrets management, key rotation, least‑privilege IAM, egress controls.
• Incident readiness: Develop IR runbooks, detection rules, and tabletop exercises; lead post‑incident forensics and blameless RCAs.
• Vuln management: Own scanning/triage/patch SLAs; coordinate with engineering to remediate quickly without slowing delivery.

📌 Required Qualifications

• 5+ years in security engineering with strong software skills (Python or Go; TypeScript a plus).
• Depth in cloud/Kubernetes security (e.g., GCP/AWS IAM, workload identity, admission controls, network policies).
• Hands‑on AppSec: code review, threat modeling, secure design, secrets & key management, authn/z patterns, multi‑tenant isolation.
• Experience building detection & response and running incident management.
• Familiarity with supply‑chain security (SBOM, sigstore/cosign, SLSA‑style controls) and dependency risk management.
• Clear, pragmatic communication with engineers and customers.

⭐ Desirable Experience

• Security for SaaS + self‑hosted offerings, including air‑gapped deployments.
• Exposure to SOC 2 / ISO 27001 programs and evidence automation.
• Experience with Go services and Infra as Code (Terraform/Helm), plus policy‑as‑code (OPA/Gatekeeper/Kyverno).
• Knowledge of privacy patterns (data minimization, retention, masking, workspace scoping).

🎁 Benefits

We offer competitive compensation that includes base salary, meaningful equity, and benefits such as health and dental coverage, flexible vacation, a 401(k) plan, and life insurance. Actual compensation will vary based on role, level, and location. For team members in the EU and UK, we provide locally competitive benefits aligned with regional norms and regulations.

Annual salary range: $175,000-$215,000 USD for Senior Engineers

🛂 Visa & Eligibility

Team members in the EU, UK, and APAC receive locally competitive benefits aligned with regional norms and regulations.