Staff+ Application Security Engineer - M&A

Staff-plus application security engineer who sets up Anthropic's first dedicated security function for acquisitions, sitting within the Application Security team. Before a deal closes, the engineer runs security due diligence: arranging external penetration tests, threat modelling the target's architecture, assessing its controls and writing the risk readout for leadership. After close, the work is bringing acquired code and systems up to Anthropic's standard through SAST and DAST coverage, remediation tracking, bug bounty scope and automated vulnerability tooling, coordinating supply chain, cloud, corporate security and detection teams. The role also formalises the M&A playbook and risk-scoring model as Claude-powered tooling and takes on core AppSec work between deals.

The team wants hands-on application and infrastructure security, the ability to size up an unfamiliar codebase quickly for non-security readers, production coding, and comfort with confidential work. Remote-friendly, with travel.