Application Security Engineer
for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Use - for any list of duties/requirements/benefits, and
for prose. Do NOT repeat job title as heading. Do NOT put Job ID/requisition numbers as headings. Remove boilerplate, duplicated lines, application instructions. Include a section ONLY when posting has real, specific content for it. Prefer few substantive sections over many thin ones.
We need to parse the posting: It includes "About Retool" (company description) then "WHY WE’RE LOOKING FOR YOU" (role description). Then "In This Role, You Will" (list of responsibilities). Then "The Skillset You’ll Bring" (requirements/qualifications). Then "Nice To Have" (optional). Then pay and benefits info.
We need sections: maybe "About the role" (could be the WHY WE’RE LOOKING FOR YOU). "Responsibilities" (In This Role, You Will). "Requirements" (The Skillset You’ll Bring). "Nice to have" maybe as "Preferred Qualifications" but we can include as part of Requirements or separate? The instruction: Use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can choose appropriate headings. We have content for About the role (company + why). Responsibilities (list). Requirements (skillset). Benefits (benefits description). Pay (salary range). Possibly Schedule not present (no schedule info). So we omit Schedule.
We must not include sections with filler like "commensurate with experience". We have actual pay range and benefits.
We need to preserve all substantive information, not invent or summarize away detail. So we need to include the details from the posting.
We must remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions. The posting includes some like "For candidates based in the United States, the pay range(s) for this role is listed below..." and "Additional compensation in the form(s) of equity and/or commission are dependent on the position offered." and "Pay and benefits are subject to change..." and "Retool provides a comprehensive benefit plan, including medical, dental, vision, and 401(k)." Also "Retool offers generous benefits to all employees and hybrid work location." Also "For more information, please visit the benefits and perks section of our careers page!" Also "Retool is currently set up to employ all roles in the US and specific roles in the UK..." etc. Some of that is boilerplate but also contains substantive info about benefits and pay. We need to keep substantive info: pay range, benefits (medical, dental, vision, 401k), hybrid work location. The rest like "For more information..." is application instruction? It's a reference to benefits page; maybe we can drop as it's not substantive. Also "Retool offers generous benefits to all employees and hybrid work location." That's substantive (hybrid work location). Keep that.
We also need to drop duplicated lines. There's no duplication visible.
We need to output only HTML fragment, no markdown fences.
Let's craft:
About the role
... combine company description and why we're looking for you ...
But we need to preserve all substantive info. The "About Retool" paragraph is company overview; "WHY WE’RE LOOKING FOR YOU" is role motivation. We can combine into About the role.
Then Responsibilities: list from "In This Role, You Will". Each bullet.
Then Requirements: list from "The Skillset You’ll Bring". Could be bullet list.
Then Benefits: list benefits: medical, dental, vision, 401(k), hybrid work location. Possibly also mention "generous benefits". We'll put as - .
Then Pay:
The base pay range for this role is $231,900 – $318,250 per year.
maybe also mention additional compensation equity/commission? That's substantive: "Additional compensation in the form(s) of equity and/or commission are dependent on the position offered." We'll include that.
We should not include "Pay and benefits are subject to change..." as it's boilerplate? Might be considered generic; but it's still info about variability. Might be considered boilerplate; but it's not specific. Safer to omit.
We also need to include "Nice To Have" maybe as "Preferred Qualifications". The instruction says we can use headings like Qualifications, Skills. Could include a section "Preferred Qualifications". But we need to avoid thin sections. However we have some nice-to-have items: offensive security experience, SAST pipelines, startup experience. That's substantive. Could include under Requirements or a separate "Preferred Qualifications". Since we already have Requirements section, we could add a sub-list? But we need to follow instruction: Use - for any list of duties/requirements/benefits. So we can have one list for required skillset and another for nice-to-have under same heading? Might be confusing. Better to have two sections: Requirements and Preferred Qualifications. Both are substantive.
Thus headings: About the role, Responsibilities, Requirements, Preferred Qualifications, Benefits, Pay.
We must not include Schedule.
Now craft content.
About the role: need to include company description and why we're looking for you. Let's extract:
About Retool paragraph: "Nearly every company in the world runs on custom software for critical operations like tracking performance metrics, handling support workflows, building admin dashboards, and countless processes you might never have thought of. But most companies don't have the resources to properly invest in these tools, leading to a lot of old, clunky internal software, or worse, teams still stuck in manual and spreadsheet workflows. AI has changed who gets to build software. The definition of "developer" now includes analysts, operators, and domain experts creating solutions directly—and the tools they reach for are multiplying by the week. That's both an opportunity and a challenge: as more people build with more AI tools, the risk of shipping ungoverned software into production grows just as fast. At Retool, we're building the platform that makes all of it safe to ship. Build with any AI tool you want, then deploy into one place that connects to your real business data, enforces enterprise policies automatically, and lets teams create once and reuse everywhere with shared, trusted components. The cost of building software has collapsed. The cost of governing it hasn't—and that's the problem we solve. Developers and domain experts have already automated over 100 million hours of work on our platform, freeing them to focus on creative problem-solving and strategic work that drives real business value. The people closest to the problem can now build the software to solve it, safely, and within enterprise guardrails. Let's build the future together."
WHY WE’RE LOOKING FOR YOU: "Retool handles our customers’ most sensitive data and provides a platform where they write and execute arbitrary code. The security surface that comes with that is large, nuanced, and genuinely interesting. As the platform grows and our customers’ trust in it deepens, the scope and ambition of our security program have grown with it. We’re looking for an Application Security Engineer who combines deep security fundamentals with real engineering execution. This is not a role for someone who audits from a distance or advises without getting their hands dirty. You’ll be in the code, spotting systemic patterns, and building the tooling and solutions that address them at scale. You’ll recognize when a one-off fix isn’t enough, synthesize what you’re seeing in the codebase, and work with engineering teams to make secure outcomes the default rather than the exception. You’ll need to understand the product deeply to secure it well: what customers build on Retool, where code executes, and how data flows. The security problems worth solving here live at the intersection of platform capability and customer trust, and your first team is the business, not just security. We’re also actively thinking about what AI-accelerated development means for application security, from how to use AI to enhance and scale our own security work to managing the risk that comes with developers shipping more code, faster, with different review patterns than ever before. We’re already running experiments in this space, including using AI to find and fix vulnerabilities at scale, automating dependency management, and rethinking what security teams can actually accomplish with the right tooling and ambition. If you want to work out what AI genuinely changes about security engineering practice - in real conditions, not in theory - this role is for you."
Combine into About the role paragraph(s). Could be multiple
tags.
Responsibilities: list from "In This Role, You Will". Let's extract bullet points:
- Identify systemic security gaps in our codebase and engineering workflows, and work with engineering teams to design and ship durable solutions; you’ll drive solutions, not just surface problems
- Build security tooling, automation, and code-level controls that address classes of vulnerabilities, including custom linters, static analysis rules, and automated checks, shifting the cost of catching issues left rather than handling them one at a time or after they’ve reached production
- Conduct in-depth code reviews and security design reviews for significant product initiatives, with the technical depth to engage meaningfully with architectural tradeoffs rather than just flag issues for others to resolve
- Drive threat modeling and security assessments for new features, and translate security requirements into practical engineering guidance that developers can actually act on
- Contribute to the team’s evolving approach to security as AI-assisted development scales internally, including how faster and higher-volume code production changes how we find, prioritize, and fix risks
- Triage, track, and drive remediation of vulnerabilities with product engineering teams, and contribute to our penetration testing and bug bounty programs
We need to preserve the semicolons etc. We'll put each as
- .
Requirements: from "The Skillset You’ll Bring". Extract bullet points:
- 5+ years of hands-on experience in application security and security engineering: you’ve built things, not only assessed them, and your background is not mainly consulting, audit, or compliance work
- The ability to operate independently with good judgment in a fast-moving environment: you prioritize well by understanding the needs of the business and our shared objectives, make calls with incomplete information, and know when to move fast versus when to slow down and get it right, or escalate and ask for help
- Communication that earns trust: you can make security legible to engineers without being preachy, and you measure your impact by how well you’ve supported the business, not by how many issues you catalogued
- A track record of shipping security tooling or automation that improved things for more than one team
- Genuine engineering depth: you can read, reason about, and review code at the level needed to find real bugs and understand their root causes, not just pattern-match to a checklist
- Comfort working in TypeScript and Python: Retool’s platform is built in TypeScript and our security tooling leans on Python, you’ll need to be productive in both and not just conversant
- Strong AppSec fundamentals: threat modeling, secure code review, a working understanding of common vulnerability classes and, importantly, how to address them durably rather than symptomatically
- A pragmatic, signal-oriented relationship with AI tooling: you reach for it where it genuinely sharpens your work, you’re skeptical where it doesn’t, and you’re thinking about what developer-side AI adoption means for how security risk compounds at scale
Preferred Qualifications: from "Nice To Have":
- Offensive security experience like bug bounty, CTF participation, redteam, or pentesting work
- Experience building or contributing to SAST pipelines, custom static analysis rules, or automated security testing infrastructure
- Prior experience at a startup or high-growth scaleup, where security programs aren’t fully pre-defined and priorities shift
Benefits: from posting: "Reto
for prose. Do NOT repeat job title as heading. Do NOT put Job ID/requisition numbers as headings. Remove boilerplate, duplicated lines, application instructions. Include a section ONLY when posting has real, specific content for it. Prefer few substantive sections over many thin ones. We need to parse the posting: It includes "About Retool" (company description) then "WHY WE’RE LOOKING FOR YOU" (role description). Then "In This Role, You Will" (list of responsibilities). Then "The Skillset You’ll Bring" (requirements/qualifications). Then "Nice To Have" (optional). Then pay and benefits info. We need sections: maybe "About the role" (could be the WHY WE’RE LOOKING FOR YOU). "Responsibilities" (In This Role, You Will). "Requirements" (The Skillset You’ll Bring). "Nice to have" maybe as "Preferred Qualifications" but we can include as part of Requirements or separate? The instruction: Use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can choose appropriate headings. We have content for About the role (company + why). Responsibilities (list). Requirements (skillset). Benefits (benefits description). Pay (salary range). Possibly Schedule not present (no schedule info). So we omit Schedule. We must not include sections with filler like "commensurate with experience". We have actual pay range and benefits. We need to preserve all substantive information, not invent or summarize away detail. So we need to include the details from the posting. We must remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, application instructions. The posting includes some like "For candidates based in the United States, the pay range(s) for this role is listed below..." and "Additional compensation in the form(s) of equity and/or commission are dependent on the position offered." and "Pay and benefits are subject to change..." and "Retool provides a comprehensive benefit plan, including medical, dental, vision, and 401(k)." Also "Retool offers generous benefits to all employees and hybrid work location." Also "For more information, please visit the benefits and perks section of our careers page!" Also "Retool is currently set up to employ all roles in the US and specific roles in the UK..." etc. Some of that is boilerplate but also contains substantive info about benefits and pay. We need to keep substantive info: pay range, benefits (medical, dental, vision, 401k), hybrid work location. The rest like "For more information..." is application instruction? It's a reference to benefits page; maybe we can drop as it's not substantive. Also "Retool offers generous benefits to all employees and hybrid work location." That's substantive (hybrid work location). Keep that. We also need to drop duplicated lines. There's no duplication visible. We need to output only HTML fragment, no markdown fences. Let's craft:
About the role
... combine company description and why we're looking for you ...
But we need to preserve all substantive info. The "About Retool" paragraph is company overview; "WHY WE’RE LOOKING FOR YOU" is role motivation. We can combine into About the role. Then Responsibilities: list from "In This Role, You Will". Each bullet. Then Requirements: list from "The Skillset You’ll Bring". Could be bullet list. Then Benefits: list benefits: medical, dental, vision, 401(k), hybrid work location. Possibly also mention "generous benefits". We'll put as- .
Then Pay:
The base pay range for this role is $231,900 – $318,250 per year.
maybe also mention additional compensation equity/commission? That's substantive: "Additional compensation in the form(s) of equity and/or commission are dependent on the position offered." We'll include that. We should not include "Pay and benefits are subject to change..." as it's boilerplate? Might be considered generic; but it's still info about variability. Might be considered boilerplate; but it's not specific. Safer to omit. We also need to include "Nice To Have" maybe as "Preferred Qualifications". The instruction says we can use headings like Qualifications, Skills. Could include a section "Preferred Qualifications". But we need to avoid thin sections. However we have some nice-to-have items: offensive security experience, SAST pipelines, startup experience. That's substantive. Could include under Requirements or a separate "Preferred Qualifications". Since we already have Requirements section, we could add a sub-list? But we need to follow instruction: Use- for any list of duties/requirements/benefits. So we can have one list for required skillset and another for nice-to-have under same heading? Might be confusing. Better to have two sections: Requirements and Preferred Qualifications. Both are substantive.
Thus headings: About the role, Responsibilities, Requirements, Preferred Qualifications, Benefits, Pay.
We must not include Schedule.
Now craft content.
About the role: need to include company description and why we're looking for you. Let's extract:
About Retool paragraph: "Nearly every company in the world runs on custom software for critical operations like tracking performance metrics, handling support workflows, building admin dashboards, and countless processes you might never have thought of. But most companies don't have the resources to properly invest in these tools, leading to a lot of old, clunky internal software, or worse, teams still stuck in manual and spreadsheet workflows. AI has changed who gets to build software. The definition of "developer" now includes analysts, operators, and domain experts creating solutions directly—and the tools they reach for are multiplying by the week. That's both an opportunity and a challenge: as more people build with more AI tools, the risk of shipping ungoverned software into production grows just as fast. At Retool, we're building the platform that makes all of it safe to ship. Build with any AI tool you want, then deploy into one place that connects to your real business data, enforces enterprise policies automatically, and lets teams create once and reuse everywhere with shared, trusted components. The cost of building software has collapsed. The cost of governing it hasn't—and that's the problem we solve. Developers and domain experts have already automated over 100 million hours of work on our platform, freeing them to focus on creative problem-solving and strategic work that drives real business value. The people closest to the problem can now build the software to solve it, safely, and within enterprise guardrails. Let's build the future together."
WHY WE’RE LOOKING FOR YOU: "Retool handles our customers’ most sensitive data and provides a platform where they write and execute arbitrary code. The security surface that comes with that is large, nuanced, and genuinely interesting. As the platform grows and our customers’ trust in it deepens, the scope and ambition of our security program have grown with it. We’re looking for an Application Security Engineer who combines deep security fundamentals with real engineering execution. This is not a role for someone who audits from a distance or advises without getting their hands dirty. You’ll be in the code, spotting systemic patterns, and building the tooling and solutions that address them at scale. You’ll recognize when a one-off fix isn’t enough, synthesize what you’re seeing in the codebase, and work with engineering teams to make secure outcomes the default rather than the exception. You’ll need to understand the product deeply to secure it well: what customers build on Retool, where code executes, and how data flows. The security problems worth solving here live at the intersection of platform capability and customer trust, and your first team is the business, not just security. We’re also actively thinking about what AI-accelerated development means for application security, from how to use AI to enhance and scale our own security work to managing the risk that comes with developers shipping more code, faster, with different review patterns than ever before. We’re already running experiments in this space, including using AI to find and fix vulnerabilities at scale, automating dependency management, and rethinking what security teams can actually accomplish with the right tooling and ambition. If you want to work out what AI genuinely changes about security engineering practice - in real conditions, not in theory - this role is for you."
Combine into About the role paragraph(s). Could be multiple
tags. Responsibilities: list from "In This Role, You Will". Let's extract bullet points: - Identify systemic security gaps in our codebase and engineering workflows, and work with engineering teams to design and ship durable solutions; you’ll drive solutions, not just surface problems - Build security tooling, automation, and code-level controls that address classes of vulnerabilities, including custom linters, static analysis rules, and automated checks, shifting the cost of catching issues left rather than handling them one at a time or after they’ve reached production - Conduct in-depth code reviews and security design reviews for significant product initiatives, with the technical depth to engage meaningfully with architectural tradeoffs rather than just flag issues for others to resolve - Drive threat modeling and security assessments for new features, and translate security requirements into practical engineering guidance that developers can actually act on - Contribute to the team’s evolving approach to security as AI-assisted development scales internally, including how faster and higher-volume code production changes how we find, prioritize, and fix risks - Triage, track, and drive remediation of vulnerabilities with product engineering teams, and contribute to our penetration testing and bug bounty programs We need to preserve the semicolons etc. We'll put each as
- . Requirements: from "The Skillset You’ll Bring". Extract bullet points: - 5+ years of hands-on experience in application security and security engineering: you’ve built things, not only assessed them, and your background is not mainly consulting, audit, or compliance work - The ability to operate independently with good judgment in a fast-moving environment: you prioritize well by understanding the needs of the business and our shared objectives, make calls with incomplete information, and know when to move fast versus when to slow down and get it right, or escalate and ask for help - Communication that earns trust: you can make security legible to engineers without being preachy, and you measure your impact by how well you’ve supported the business, not by how many issues you catalogued - A track record of shipping security tooling or automation that improved things for more than one team - Genuine engineering depth: you can read, reason about, and review code at the level needed to find real bugs and understand their root causes, not just pattern-match to a checklist - Comfort working in TypeScript and Python: Retool’s platform is built in TypeScript and our security tooling leans on Python, you’ll need to be productive in both and not just conversant - Strong AppSec fundamentals: threat modeling, secure code review, a working understanding of common vulnerability classes and, importantly, how to address them durably rather than symptomatically - A pragmatic, signal-oriented relationship with AI tooling: you reach for it where it genuinely sharpens your work, you’re skeptical where it doesn’t, and you’re thinking about what developer-side AI adoption means for how security risk compounds at scale Preferred Qualifications: from "Nice To Have": - Offensive security experience like bug bounty, CTF participation, redteam, or pentesting work - Experience building or contributing to SAST pipelines, custom static analysis rules, or automated security testing infrastructure - Prior experience at a startup or high-growth scaleup, where security programs aren’t fully pre-defined and priorities shift Benefits: from posting: "Reto
- for any list of duties/requirements/benefits. So we can have one list for required skillset and another for nice-to-have under same heading? Might be confusing. Better to have two sections: Requirements and Preferred Qualifications. Both are substantive.
Thus headings: About the role, Responsibilities, Requirements, Preferred Qualifications, Benefits, Pay.
We must not include Schedule.
Now craft content.
About the role: need to include company description and why we're looking for you. Let's extract:
About Retool paragraph: "Nearly every company in the world runs on custom software for critical operations like tracking performance metrics, handling support workflows, building admin dashboards, and countless processes you might never have thought of. But most companies don't have the resources to properly invest in these tools, leading to a lot of old, clunky internal software, or worse, teams still stuck in manual and spreadsheet workflows. AI has changed who gets to build software. The definition of "developer" now includes analysts, operators, and domain experts creating solutions directly—and the tools they reach for are multiplying by the week. That's both an opportunity and a challenge: as more people build with more AI tools, the risk of shipping ungoverned software into production grows just as fast. At Retool, we're building the platform that makes all of it safe to ship. Build with any AI tool you want, then deploy into one place that connects to your real business data, enforces enterprise policies automatically, and lets teams create once and reuse everywhere with shared, trusted components. The cost of building software has collapsed. The cost of governing it hasn't—and that's the problem we solve. Developers and domain experts have already automated over 100 million hours of work on our platform, freeing them to focus on creative problem-solving and strategic work that drives real business value. The people closest to the problem can now build the software to solve it, safely, and within enterprise guardrails. Let's build the future together."
WHY WE’RE LOOKING FOR YOU: "Retool handles our customers’ most sensitive data and provides a platform where they write and execute arbitrary code. The security surface that comes with that is large, nuanced, and genuinely interesting. As the platform grows and our customers’ trust in it deepens, the scope and ambition of our security program have grown with it. We’re looking for an Application Security Engineer who combines deep security fundamentals with real engineering execution. This is not a role for someone who audits from a distance or advises without getting their hands dirty. You’ll be in the code, spotting systemic patterns, and building the tooling and solutions that address them at scale. You’ll recognize when a one-off fix isn’t enough, synthesize what you’re seeing in the codebase, and work with engineering teams to make secure outcomes the default rather than the exception. You’ll need to understand the product deeply to secure it well: what customers build on Retool, where code executes, and how data flows. The security problems worth solving here live at the intersection of platform capability and customer trust, and your first team is the business, not just security. We’re also actively thinking about what AI-accelerated development means for application security, from how to use AI to enhance and scale our own security work to managing the risk that comes with developers shipping more code, faster, with different review patterns than ever before. We’re already running experiments in this space, including using AI to find and fix vulnerabilities at scale, automating dependency management, and rethinking what security teams can actually accomplish with the right tooling and ambition. If you want to work out what AI genuinely changes about security engineering practice - in real conditions, not in theory - this role is for you."
Combine into About the role paragraph(s). Could be multiple