Staff Application Security Engineer – M&A

About the role

Anthropic’s Application Security team protects the systems that build and serve Claude. This senior position focuses on security due diligence and integration for acquisitions, establishing and scaling the M&A security function.

Key responsibilities

• Lead pre‑close security due diligence on prospective acquisitions, coordinating penetration testing, threat modeling, and delivering risk readouts for leadership.
• Drive post‑close security integration by standing up static and dynamic analysis, tracking remediation, and onboarding assets to Anthropic’s vulnerability management and bug bounty programs.
• Coordinate with supply‑chain, cloud, corporate security, and detection teams to align integration efforts.
• Collaborate with corporate development, legal, security leadership, and engineering teams at both Anthropic and target companies.
• Formalize and scale Anthropic’s M&A security playbook, risk‑scoring model, and automation tooling, leveraging Claude where possible.

Required profile

• Hands‑on application and infrastructure security experience, including cloud and containerized environments.
• Proven ability to rapidly assess unfamiliar codebases and produce clear, prioritized risk assessments for non‑technical audiences.
• Production‑quality coding skills in at least one of Python, Go, Rust, or TypeScript.
• Practical threat‑modeling and vulnerability‑identification experience with real‑world bugs.
• Strong written and verbal communication across executives, legal, and engineering stakeholders.

Required skills

• Python
• Go
• Rust
• TypeScript
• Cloud security
• Container security
• Static analysis (SAST)
• Dynamic analysis (DAST)
• Bug bounty program management
• Vulnerability management
• Threat modeling
• LLM‑driven code analysis