Application Security Engineer

Title: Application Security Engineer Location: Palo Alto, CA

About the team:

The Application Security team believes software should be secure because of how it was built, not because someone checked it afterwards. We set the security standards that everything Rubrik builds has to meet, and we build the controls that make those standards the default. We cover any team that builds, generates, or assembles software or automation that runs against Rubrik or customer data. That includes Engineering product code, IT-built tooling, data pipelines, low-code automation, and anything produced by AI coding agents. Other teams handle triaging vulnerabilities and chasing remediation. Our measure of success is the risk we eliminate by design, not the number of vulnerabilities found later.

About the role:

You will do hands-on work across our four focus areas: Standards, Secure Architecture and Design, Preventative Controls, Adoption and Enablement. You will own defined pieces of this work, with guidance from senior engineers, and you will be measured on the outcomes below rather than on activity. The team is small, so you will also be expected to automate repetitive work, using AI tools where they help. You are not expected to know all of this on day one. We are looking for people who have started working in this space and want to learn and grow at speed.

What you'll do:

• Build and maintain the preventative controls in development pipelines, including secrets prevention, dependency and artifact policy, and scan configuration as code.
• With guidance from senior engineers, work with development teams to establish what needs to be scanned, ensure accurate scans policies and that the results can be trusted.
• Help write security standards specific enough to test and build the automated checks that show whether teams conform to them.
• Ensure agent-generated code conforms to the highest security standards and controls through defining and implementing guardrails for AI coding agents.
• Support design reviews and threat modeling for applications, build tooling and internal platforms.
• Enable the team to scale at speed through automation of repetitive tasks, standards checks and review support.

What Success Looks Like:

By the end of your first year, we would expect:

• The controls you built or maintain are enforced in the pipeline and reported by organization.
• The teams you worked with have accurate scan configuration, comprehensive coverage that matches the standard, with no unknown gaps.
• The standards you helped write have automated checks, so conformance is measured and not self-attested.
• Agent-generated code is covered by the same standards and controls as other code.
• The repetitive team work you automated no longer needs manual effort, and the team's time has moved to higher-value work.

Experience you'll need:

• BS or MS in Computer Science, Information Technology, or a related field, or equivalent experience.
• Can write and maintain tooling in Python and at least one of Go, TypeScript, or JavaScript.
• Working knowledge of CI/CD pipelines, Buildkite, Jenkins, Git workflows, and containers.
• Basic grounding in application security: OWASP Top 10, threat modeling, secrets management, and software supply chain risk.
• Practical experience using AI tools such as Claude or Claude Code to build or automate real work, and the judgment to check the output before trusting it.
• Clear writing and speaking, and a willingness to learn fast in an area that changes every few months.

Preferred qualifications:

• You have built an automation or AI-assisted workflow that replaced manual work and you can explain how you checked that its output was right. Claude skills, agents and MCP servers count.

• You have set up or tested controls on an AI coding agent or assistant (permissions, sandboxing, hooks, tool restrictions), and you can describe the risk each one reduced, such as prompt injection, excessive agency, data exfiltration, or a malicious MCP server.
• You have written evals, test cases, or review checks that caught bad LLM output before it was used.
• You have put a security check into a CI/CD pipeline (secrets scanning, SAST, SCA, or dependency and artifact policy).
• Working knowledge of AWS, GCP, or Azure.