Opportunity at
ThumbtackApplication Security Engineer II
Thumbtack operates a home management platform connecting users with thousands of local professionals for repairs, maintenance, and home improvement tasks. The organization is seeking an Application…
Career Tools
About This Role
Thumbtack operates a home management platform connecting users with thousands of local professionals for repairs, maintenance, and home improvement tasks. The organization is seeking an Application Security Engineer II to join the Cybersecurity team. This group embeds security directly into developer workflows, architectures, and systems to support continuous innovation and maintain customer trust as AI features and service offerings expand. The person in this position will take ownership of application…
Job Description
Thumbtack operates a home management platform connecting users with thousands of local professionals for repairs, maintenance, and home improvement tasks. The organization is seeking an Application Security Engineer II to join the Cybersecurity team. This group embeds security directly into developer workflows, architectures, and systems to support continuous innovation and maintain customer trust as AI features and service offerings expand.
The person in this position will take ownership of application security tasks within specific domains, contribute to cross-functional security initiatives, and participate in threat modeling and system design evaluations. The role requires partnering closely with engineering and product groups to identify risks, apply secure-by-default standards, and resolve vulnerabilities. Ideal candidates demonstrate a strong sense of ownership, independent execution abilities, and clear communication skills to convey security concepts across technical teams.
Responsibilities
- Manage and deliver application security tasks within assigned projects or domains
- Contribute to cross-functional security efforts by executing clearly defined segments of larger projects
- Discover, prioritize, and assist in fixing application security vulnerabilities alongside engineering groups
- Implement approved architectures and secure-by-default patterns during system creation or review
- Collaborate with product and engineering teams to evaluate risk and propose practical security enhancements
- Take part in threat modeling and application security design evaluations for current and new systems
- Write documentation, code, and reviews to resolve security flaws and minimize recurring vulnerability types
- Engage in security incident response operations as well as post-incident remediation and analysis
Requirements
- Bring at least four years of professional background in application security and/or software engineering
- Demonstrate practical knowledge of application security methodologies such as secrets management, threat modeling, secure design patterns, authentication, authorization, and vulnerability correction
- Possess a solid grasp of secure coding practices and prevalent application security risks including the OWASP Top 10
- Show the capability to evaluate security risks, dissect complex issues, weigh tradeoffs, and deliver practical solutions
- Exhibit strong ownership over designated tasks with the ability to execute independently
- Maintain clear written and verbal communication skills for explaining security topics to engineers with varying security expertise
Qualifications
- Demonstrate a growth mindset paired with a willingness to learn from senior engineers and broaden knowledge in application and cloud infrastructure security
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the salary for the Application Security Engineer II role?
For candidates living in Ontario and British Columbia, the expected total cash compensation range is $118,200.00 to $152,900.00 per year.
What experience is required for this position?
Applicants must have at least 4 years of experience in software engineering and/or application security.
Is remote work allowed for this position?
The source posting indicates that the remote status for this role is on-site.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
