---
title: 'Product Security Engineer at Retool'
canonical: 'https://feeny.ai/job/product-security-engineer-retool-san-francisco-skk6a7t8596c'
type: 'job'
last_seen: '2026-10-15'
---

# Product Security Engineer at Retool

- **Company:** Retool
- **Location:** San Francisco, CA
- **Compensation:** $232k–$318k
- **Employment:** full-time
- **Work type:** onsite
- **Posted:** 2026-03-21
- **Last confirmed live:** 2026-10-15
- **Apply:** https://jobs.gem.com/retool/am9icG9zdDofimDqsS1Aygy5a0HdAM9u

## Job description

## WHY WE’RE LOOKING FOR YOU

Retool handles our customers’ most sensitive data and provides a platform where they write and execute arbitrary code. The security surface that comes with that is large, nuanced, and genuinely interesting. As the platform grows and our customers’ trust in it deepens, the scope and ambition of our security program have grown with it.

We’re looking for a Product Security Engineer who combines deep security fundamentals with real engineering execution. This is not a role for someone who audits from a distance or advises without getting their hands dirty. You’ll be in the code, spotting systemic patterns, and building the tooling and solutions that address them at scale. You’ll recognize when a one-off fix isn’t enough, synthesize what you’re seeing in the codebase, and work with engineering teams to make secure outcomes the default rather than the exception.

You’ll need to understand the product deeply to secure it well: what customers build on Retool, where code executes, and how data flows. The security problems worth solving here live at the intersection of platform capability and customer trust, and your first team is the business, not just security.

We’re also actively thinking about what AI-accelerated development means for application security, from how to use AI to enhance and scale our own security work to managing the risk that comes with developers shipping more code, faster, with different review patterns than ever before. We’re already running experiments in this space, including using AI to find and fix vulnerabilities at scale, automating dependency management, and rethinking what security teams can actually accomplish with the right tooling and ambition. If you want to work out what AI genuinely changes about security engineering practice - in real conditions, not in theory - this role is for you.

## IN THIS ROLE, YOU WILL:

- Identify systemic security gaps in our codebase and engineering workflows, and work with engineering teams to design and ship durable solutions; you’ll drive solutions, not just surface problems
- Build security tooling, automation, and code-level controls that address classes of vulnerabilities, including custom linters, static analysis rules, and automated checks, shifting the cost of catching issues left rather than handling them one at a time or after they’ve reached production
- Conduct in-depth code reviews and security design reviews for significant product initiatives, with the technical depth to engage meaningfully with architectural tradeoffs rather than just flag issues for others to resolve
- Drive threat modeling and security assessments for new features, and translate security requirements into practical engineering guidance that developers can actually act on
- Contribute to the team’s evolving approach to security as AI-assisted development scales internally, including how faster and higher-volume code production changes how we find, prioritize, and fix risks
- Triage, track, and drive remediation of vulnerabilities with product engineering teams, and contribute to our penetration testing and bug bounty programs

## THE SKILLSET YOU’LL BRING:

- 5+ years of hands-on experience in application security and security engineering: you’ve built things, not only assessed them, and your background is not mainly consulting, audit, or compliance work
- The ability to operate independently with good judgment in a fast-moving environment: you prioritize well by understanding the needs of the business and our shared objectives, make calls with incomplete information, and know when to move fast versus when to slow down and get it right, or escalate and ask for help
- Communication that earns trust: you can make security legible to engineers without being preachy, and you measure your impact by how well you’ve supported the business, not by how many issues you catalogued
- A track record of shipping security tooling or automation that improved things for more than one team
- Genuine engineering depth: you can read, reason about, and review code at the level needed to find real bugs and understand their root causes, not just pattern-match to a checklist
- Comfort working in TypeScript and Python: Retool’s platform is built in TypeScript and our security tooling leans on Python, you’ll need to be productive in both and not just conversant
- Strong AppSec fundamentals: threat modeling, secure code review, a working understanding of common vulnerability classes and, importantly, how to address them durably rather than symptomatically
- A pragmatic, signal-oriented relationship with AI tooling: you reach for it where it genuinely sharpens your work, you’re skeptical where it doesn’t, and you’re thinking about what developer-side AI adoption means for how security risk compounds at scale

## NICE TO HAVE:

- Offensive security experience like bug bounty, CTF participation, redteam, or pentesting work
- Experience building or contributing to SAST pipelines, custom static analysis rules, or automated security testing infrastructure
- Prior experience at a startup or high-growth scaleup, where security programs aren’t fully pre-defined and priorities shift

## About Retool

## Company Overview
- **One-liner**: Retool provides a platform for building, deploying, and managing custom internal software and AI applications by connecting to any database, API, or LLM.
- **Entity Type**: Private (Series C)
- **Headquarters**: San Francisco, California, United States
- **Founded**: 2017
- **Founders**: David Hsu (CEO)

## Core Business
- **Primary industry**: Software Development, Enterprise Internal Tools, AI Application Platform
- **Target customers**: B2B, Enterprise, SMB; specifically developers, IT teams, and business operators building internal software
- **Mission or purpose**: To enable companies to build production-ready internal software and AI applications dramatically faster, with enterprise-grade security and governance, so that domain experts and developers alike can solve critical business problems.

## Products & Services
- **Retool App Builder**: A low-code platform to build custom internal apps (dashboards, admin panels, CRUD tools) by connecting to databases and APIs. Type: SaaS/Platform.
- **Retool Workflows**: A visual automation tool to build and orchestrate complex business processes and backend logic. Type: SaaS/Platform.
- **Retool AI**: An AI-powered app generation capability that transforms natural language into production-ready applications, agents, and workflows, integrating with any LLM. Type: AI Feature/Platform.
- **Retool Mobile**: A solution to build and deploy internal mobile apps from the same Retool platform. Type: SaaS/Platform.

## Market Standing
- **Valuation/Market Cap**: Not publicly disclosed (last round was Series C).
- **Key Metric**: Annual Revenue of $5 million (as per LinkedIn company data); Total Funding of $141.3 million.
- **Notable Investors/Partners**: Sequoia Capital (lead), Nat Friedman, John Collison, Daniel Gross. Customers include Amazon, Stripe, Brex, and Orangetheory Fitness.
- **Growth Signals**: Over 10,000 organizations use Retool. The company has automated over 100 million hours of work. It has 6 offices across the US and UK. Despite a recent headcount reduction (-11% YoY), it maintains a strong brand in the enterprise internal tools space and is aggressively pivoting into AI-powered app generation.

## Competitive Advantages
- **Enterprise Governance from Day One**: Unlike point solutions, apps built in Retool are production-ready and pass security reviews, eliminating the need for rebuilds or audit scrambles.
- **Deep Data Connectivity**: Securely connects to existing databases, APIs, and internal systems, ensuring apps run on real data with real permissions.
- **Unified Platform**: One platform to manage, orchestrate, and scale all internal apps, agents, and workflows, providing centralized visibility and governance for IT.
- **Trusted by Large Enterprises**: A strong customer base of high-profile companies (Amazon, Stripe, Brex) serves as a powerful validation of its enterprise readiness.

## Strategic Focus
- **AI as the Core Platform**: Retool is positioning itself as the "first enterprise AppGen platform," where AI is used to generate production-ready code from natural language, expanding the definition of "developer" to include analysts and operators.
- **Scaling Enterprise Features**: The company is focused on building out governance, security, and platform capabilities to support large-scale deployments across complex organizations.
- **International Expansion**: With offices in London and a German-speaking Sales Engineer role, Retool is actively expanding its presence in the European market.

## Why Work Here
- **Culture**: The company values ambition, intense curiosity, energy, and deep care. They emphasize moving fast, acting like an owner, and being both demanding and supportive.
- **Work Environment**: Hybrid model with offices in San Francisco, New York, Salt Lake City, and London. The company believes great work happens when teams collaborate in person.
- **Product Impact**: Employees are close to the product and use Retool internally, giving them a direct voice in improving it. The mission is to enable a wider community of builders to create production-grade software safely.
- **Hiring Process**: Structured, with initial recruiter/hiring manager chats, a technical evaluation or practical exercise, and a final round of 3–5 interviews. The company aims for transparency and candidate preparation.
- **Employee Sentiment**: Employer rating of 3.4/5.0 (127 reviews). Strengths include Work-Life Balance (4.1) and Culture (3.7). Compensation (3.4) and Career (3.4) are areas for potential improvement.

## Sources
1. [retool.com](https://retool.com/)
2. [retool.com/careers](https://retool.com/careers)
3. [retool.com/about](https://retool.com/about)
4. [linkedin.com/company/tryretool](https://www.linkedin.com/company/tryretool)
5. [jobs.gem.com/retool](https://jobs.gem.com/retool)

## Other roles at Retool

- [Engineering Manager,  Enterprise Platform](https://feeny.ai/job/engineering-manager-enterprise-platform-retool-san-francisco-pq3h2kfqkbzt) — San Francisco, CA
- [HR Business Partner, EMEA](https://feeny.ai/job/hr-business-partner-emea-retool-london-8vhqs9t2mtdp) — London, United Kingdom
- [Software Engineer, Sandbox & Agent Executor](https://feeny.ai/job/software-engineer-sandbox-agent-executor-retool-san-francisco-cxh0bkhe2htj) — San Francisco, CA
- [Product Manager, AI Monetization & Expansion](https://feeny.ai/job/product-manager-ai-monetization-expansion-retool-san-francisco-vehxbz0cz769) — San Francisco, CA
- [Software Engineer, Agent Platform](https://feeny.ai/job/software-engineer-agent-platform-retool-san-francisco-rhdp6pt05hmt) — San Francisco, CA
- [Software Engineer, Automations](https://feeny.ai/job/software-engineer-automations-retool-san-francisco-c5mkacjvq8zh) — San Francisco, CA
- [Product Manager, Integration Platform & Partnerships](https://feeny.ai/job/product-manager-integration-platform-partnerships-retool-san-francisco-gbw4m402pqcn) — San Francisco, CA
- [Product Manager, AI Platform Infrastructure](https://feeny.ai/job/product-manager-ai-platform-infrastructure-retool-san-francisco-7hehw89e4nez) — San Francisco, CA
- [Staff Copywriter](https://feeny.ai/job/staff-copywriter-retool-united-states-wraskj0df9as) — United States
- [Software Engineer, Enterprise Expansion](https://feeny.ai/job/software-engineer-enterprise-expansion-retool-san-francisco-y20tg7mpkr2z) — San Francisco, CA