2 days ago
Base Salary
$213k - $377k/yr
Responsibilities
- Own the security architecture and roadmap for Snap’s Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and script-to-native hardening.
- Design isolation and containment using sandboxing, process separation, permission models, and interprocess communication.
- Lead web security for web clients and embedded web content, including protection against XSS, CSRF, framing abuse, prototype pollution, and cross-origin leaks.
- Conduct code review, vulnerability research, exploitability analysis, fuzzing, and root-cause analysis across runtimes, rendering components, parsers, and web-facing code.
- Ship memory-safety improvements, exploit mitigations, and attack-surface reductions while balancing performance, compatibility, and developer experience.
- Drive the bug bounty program by setting severity and reward criteria, performing variant analysis, and working with external security researchers.
- Mentor engineers, establish secure design patterns, communicate risk to leadership, and independently resolve complex cross-team security challenges.
Requirements
- Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field.
- At least 9 years of post-bachelor’s security engineering experience, or a master’s degree with at least 8 years of post-graduate security engineering experience, or a PhD with at least 5 years of post-graduate security engineering experience.
- Hands-on experience with both native memory-corruption analysis and web security, including shipping security improvements to a browser, embedded runtime, or similarly complex platform.
- Deep knowledge of memory-corruption vulnerabilities including out-of-bounds access, use-after-free, type confusion, and integer overflows.
- Deep web-security expertise involving same-origin policy, CORS, XSS, CSRF, iframe sandboxing, prototype pollution, cookie and storage security, CSP, Trusted Types, frame-ancestors, HSTS, COOP, COEP, and CORP.
- Understanding of browser and runtime architecture, execution contexts, workers, native bindings, process models, OS sandboxing, and enforceable security boundaries.
- Working knowledge of iOS and Android security models, including app sandboxing and platform exploit mitigations.
- Strong C and C++ programming, code-review, and debugging skills; JavaScript proficiency; and experience building production security tooling in Python, Go, or Rust.
- Hands-on experience with coverage-guided fuzzing, sanitizers, reverse engineering, and root-cause analysis.
- Ability to validate AI-generated reviews and vulnerability findings, navigate unfamiliar codebases, make decisions under ambiguity, and influence teams without direct authority.
- Preferred experience with sandboxing, exploit mitigations, compiler hardening, memory-safe components, browser engines or JavaScript runtimes, offensive security, and bug bounty or vulnerability disclosure programs.
Benefits
- Paid parental leave, comprehensive medical coverage, emotional and mental health support programs, and compensation packages including long-term-success participation through equity.
- Default-together work arrangement requiring employees to work in an office four or more days per week.
- Snap is an equal opportunity employer and provides disability and other workplace accommodations.
About Snap
Snap Inc. builds Snapchat, a visual messaging app, and supports augmented reality through Lens Studio and Spectacles, plus related services like Bitmoji. The company monetizes primarily via advertising and sponsored AR experiences for consumers, creators, and brands. Founded in 2011 and headquartered in Santa Monica, it is publicly traded on the NYSE under the ticker SNAP.