At Webflow, our mission is to bring development superpowers to everyone. Webflow is a Website Experience Platform (WXP) that empowers modern marketing teams to visually build, manage, and optimize stunning websites. With AI-driven personalization baked in, Webflow enables teams to significantly boost conversion rates, translating directly into measurable business growth. From independent designers and creative agencies to Fortune 500 companies, millions worldwide use Webflow to be more nimble, creative, and collaborative.

We’re looking for a Staff Application Security Engineer to help us level up Webflow’s secure development practices ranging from secure coding, tooling, and improving procedures.

About the role:

• Location: Remote-first (United States; BC & ON, Canada)
• Full-time 
• Permanent
• Exempt
• The cash compensation for this role is tailored to align with the cost of labor in different geographic markets. We've structured the base pay ranges for this role into zones for our geographic markets, and the specific base pay within the range will be determined by the candidate’s geographic location, job-related experience, knowledge, qualifications, and skills.
  • United States  (all figures cited below in USD and pertain to workers in the United States)
    
    • Zone A: $175,780 - $247,690
    • Zone B: $164,500 - $232,180 
    • Zone C: $154,160 - $217,610
  • Canada (figures cited below are in CAD and pertain to workers in ON & BC, Canada)
    • CAD 199,280 - CAD 281,060

This role is also eligible to participate in Webflow's company-wide bonus program. Target amounts are a percentage of base salary and vary by career level. Payouts are based on company performance against established financial and operational goals. 

Please visit our Careers page for more information on which locations are included in each of our geographic pay zones. However, please confirm the zone for your specific location with your recruiter.

• Reporting to the Manager, Application Security 

As a Staff Application Security Engineer, you’ll … 

• Collaborate with the Webflow engineering team to secure Webflow’s web application platform and ecosystem.
• Bring security best practices to the software development lifecycle.
• Work as part of a team to champion security standards while balancing business strategies and requirements.
• Support Webflow’s security current and future compliance frameworks
• Work to find security vulnerabilities through grey-box techniques, and propose solutions at the architecture and code level to mitigate findings.
• Contribute code and architecture improvements to enable security within Webflow’s application for engineers.
• Cross-train entry and mid-level application security engineers

In addition to the responsibilities outlined above, at Webflow we will support you in identifying where your interests and development opportunities lie and we'll help you incorporate them into your role.

About you:

You’ll thrive as a Staff Application Security Engineer  if you:

• Have 7+ years of experience in application security, including 2+ years of software development focused on security.
• Are passionate about security, eager to learn, and enjoy sharing knowledge by explaining complex security concepts to colleagues.
• Have expertise in secure software design, secure coding, and web application security, with a strong commitment to risk reduction and sustainable security practices.
• Have experience with Threat Modeling, penetration testing, and identifying high-complexity application vulnerabilities.
• Have worked on software supply chain security and led bug bounty programs and security tooling initiatives.
• Have successfully implemented and improved secure development lifecycle (SDLC) processes, including planning, communication, and automation.
• Have led and delivered multi-quarter, complex security projects, application security roadmaps, and medium to large security programs in collaboration with engineering teams.
• Have experience mentoring other application security engineers and fostering security best practices across organizations.

Our Core Behaviors:

• Obsess over customer experience. We deeply understand what we’re building and who we’re building for and serving. We define the leading edge of what’s possible in our industry and deliver the future for our customers
• Move with heartfelt urgency. We have a healthy relationship with impatience, channeling it thoughtfully to show up better and faster for o