1 day ago
Base Salary
$213k - $377k/yr
Responsibilities
- Own the security architecture and roadmap for Snap’s Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and script-to-native boundary hardening.
- Design isolation and containment measures such as sandboxing, process separation, permission models, and IPC.
- Lead web security for Snap’s web clients and embedded web content, including protection against XSS, CSRF, framing abuse, prototype pollution, and cross-origin leaks.
- Conduct code review, vulnerability research, exploitability analysis, fuzzing, and root-cause analysis across native runtimes, rendering components, parsers, and web-facing code.
- Ship memory-safety improvements, exploit mitigations, and attack-surface reductions while balancing performance, compatibility, and developer experience.
- Drive the web, mobile, and memory-safety bug bounty program, including severity and reward criteria, variant analysis, triage, and researcher relationships.
- Mentor engineers, establish secure design patterns, communicate security risks and tradeoffs, and lead complex cross-team security initiatives.
Requirements
- Bachelor of Science in Computer Science, Engineering, Information Systems, or a related technical field, or equivalent years of experience.
- At least 9 years of post-bachelor’s security engineering experience, 8 years with a relevant master’s degree, or 5 years with a related PhD.
- Hands-on experience with both native memory-corruption analysis and web security, including shipping improvements to a browser, embedded runtime, or similarly complex platform.
- Deep knowledge of memory-corruption vulnerabilities, exploitability assessment, proof-of-concept exploits, web security, browser and runtime architecture, and iOS and Android security models.
- Strong C and C++ programming, code-review, and debugging skills, JavaScript proficiency, and experience building production security tooling in Python, Go, or Rust.
- Experience with coverage-guided fuzzing, sanitizers, reverse engineering, vulnerability discovery, and root-cause analysis.
- Preferred experience with sandboxing, exploit mitigations, compiler hardening, memory-safe components, browser engines or JavaScript runtimes, offensive security, and bug bounty or vulnerability disclosure programs.
- Ability to validate AI-generated reviews and vulnerability findings, navigate unfamiliar codebases, make decisions under ambiguity, and influence technical direction across teams.
Benefits
- Paid parental leave, comprehensive medical coverage, emotional and mental health support programs, and compensation packages that include long-term-success participation.
- The role follows Snap’s default-together policy and expects employees to work in an office four or more days per week.
- The position is eligible for equity in the form of RSUs.
About Snap
Snap Inc. builds Snapchat, a visual messaging app, and supports augmented reality through Lens Studio and Spectacles, plus related services like Bitmoji. The company monetizes primarily via advertising and sponsored AR experiences for consumers, creators, and brands. Founded in 2011 and headquartered in Santa Monica, it is publicly traded on the NYSE under the ticker SNAP.