Staff+ Application Security Engineer - M&A

Overview

Staff Application Security Engineer focused on security for Anthropic’s M&A deals, owning pre-close security due diligence and post-close secure integration for acquired systems.

What you'll do

• Lead pre-close security due diligence for acquisitions, including coordinating penetration testing and threat modeling.
• Assess target security controls and deliver a security risk readout for leadership ahead of close.
• Drive post-close security integration by setting up static and dynamic analysis for acquired codebases.
• Track high- and critical-severity remediation through closure and incorporate acquired assets into bug bounty scope.
• Coordinate with adjacent security engineering teams during integrations (e.g., supply chain, cloud, detection & response).
• Formalize and scale an M&A security playbook, including a risk model and integration checklist.
• Contribute between deals to core AppSec work such as secure design reviews and security automation roadmap.

What you'll need

• Hands-on application and infrastructure security experience, including cloud and containerized environments.
• Ability to rapidly assess unfamiliar codebases and produce prioritized risk assessments for non-security audiences.
• Production-quality coding ability in at least one of Python, Go, Rust, or TypeScript.
• Practical threat-modeling and vulnerability-identification skills from real systems.
• Comfort operating with high autonomy, ambiguity, and confidential context.
• Clear written and verbal communication across executives, legal/corporate development partners, and engineers.

Details

• Uses Claude as the primary tool for diligence and integration automation.
• Location-based hybrid policy: expected to be in an office at least 25% of the time.