Product Security Engineer II

StubHub; Los Angeles (CA); Hybrid; USD 175,000 - 230,000; Full time

Job summary

Join a leading company in the live event industry as a Security Engineer, focusing on enhancing the security of web applications and APIs. You'll conduct assessments, collaborate with development teams, and implement best practices to safeguard user experiences. With a hybrid work model and a strong emphasis on professional growth, this role offers a unique opportunity to work in a dynamic environment while ensuring the safety and security of our platforms.

Benefits

Accelerated Growth Environment

Top Tier Compensation Package

Flexible Time Off

Comprehensive Benefits Package

Team-Building Events

Qualifications

• Intermediate understanding of offensive web application security testing.
• Experience in implementing SAST, DAST, and SBOM generation tooling.

Responsibilities

• Conduct security assessments and penetration tests on applications.
• Collaborate with teams to integrate security practices into CI/CD pipelines.
• Develop and maintain secure coding guidelines.

Skills

Communication

Scripting

Vulnerability Assessment

Security Testing

Education

Security Certifications

Tools

Burp Suite

OWASP ZAP

Snyk

Job description

Los Angeles, CA

StubHub – Software Engineering / Full-Time / Hybrid

StubHub is on a mission to redefine the live event experience on a global scale. Whether someone is looking to attend their first event or their hundredth, we’re here to delight them all the way from the moment they start looking for a ticket until they step through the gate. The same goes for our sellers. From fans selling a single ticket to the promoters of a worldwide stadium tour, we want StubHub to be the safest, most convenient way to offer a ticket to the millions of fans who browse our platform around the world.

About the team :

Our Security Platform team serves as the linchpin of our engineering organization, offering common code packages that encapsulate best practices around observability and performance. The team provides managed services such as Messaging as a Service and Distributed Caching to the rest of the engineering organization. We focus on the developer experience by equipping our engineers with a rich toolset for building, deploying, and debugging applications and services. We collaborate cross-functionally across all platforms within the organization to ensure all teams are aligned on infrastructure best practices.

What You'll Do :

1. Conduct security assessments, code reviews, and penetration tests on web applications, APIs, and mobile applications to identify vulnerabilities and security flaws.
2. Collaborate with development teams to integrate security practices into the CI / CD pipelines, including implementing automated code scanning tools.
3. Develop and maintain secure coding guidelines and provide training to developers on security best practices and awareness.
4. Manage and respond to security incidents, including performing root cause analysis and recommending remediations.
5. Stay abreast of the latest security threats, vulnerabilities, and mitigation techniques; share insights with internal teams to foster a culture of security.
6. Assist in the development and implementation of application security policies, standards, and procedures in alignment with industry best practices and regulatory requirements.
7. Conduct architectural reviews of new technologies and security controls to ensure they meet security best practices.
8. Develop and/or maintain product vulnerability management processes and procedures.
9. Write and maintain production-quality APIs to automate security processes, benefiting infrastructure and developer workflows.
10. Operate and respond to enterprise Bug-Bounty program findings.

What You've Done :

1. Intermediate understanding of principles, theories, and concepts related to offensive web application security testing and defense-in-depth remediation approaches.
2. Intermediate knowledge in conducting vulnerability assessments and code reviews.
3. Intermediate proficiency with automated security testing tools (e.g., Burp Suite, OWASP ZAP, Snyk).
4. Intermediate communication skills, with the ability to articulate complex security issues to technical and non-technical stakeholders.
5. Intermediate experience in applied cryptography & key management.
6. Intermediate experience in implementing SAST, DAST and SBOM generation tooling into developer workflows.
7. Intermediate experience in performing threat modeling (e.g., STRIDE, PASTA)
8. Intermediate proficiency in at least one scripting language (e.g., Python, Ruby).
9. Intermediate familiarity with security frameworks (e.g., PCI DSS, CIS, ISO 27001, NIST CSF).

Preferred Skills and Qualifications :

1. Security certifications (e.g., OSCP, CEH, CISSP, GWAPT).
2. Intermediate experience with cloud security principles and technologies in AWS & Azure.
3. Intermediate knowledge of Kubernetes (K8s) Security foundations, including admission controllers, K8s Network Policies, K8s RBAC, and K8s Ingress architectures.
4. Intermediate proficiency in DDoS mitigation techniques using AWS Shield, CDN traffic scrubbing, and origin protection mechanisms.

What We Offer

• Accelerated Growth Environment: Immerse yourself in an environment designed for swift skill and knowledge enhancement, where you have the autonomy to lead experiments and tests on a massive scale.
• Top Tier Compensation Package: Enjoy a rewarding compensation package that includes enticing stock incentives, aligning with our commitment to recognizing and valuing your contributions.
• Flexible Time Off: Embrace a healthy work-life balance with unlimited Flex Time Off, providing you the flexibility to manage your schedule and recharge as needed.
• Comprehensive Benefits Package: Prioritize your well-being with a comprehensive benefits package, featuring 401k, and premium Health, Vision, and Dental Insurance options.
• Team-Building Events: Engage in vibrant team events that foster camaraderie and collaboration, creating an atmosphere where your professional and personal growth are celebrated.

The anticipated gross annual base salary range for this role is $175,000 – $230,000 per year. Actual compensation will vary depending on factors such as a candidate’s qualifications, skills, experience, and competencies. Base annual salary is one component of StubHub’s total compensation and competitive benefits package, which also includes equity, 401(k), paid time off, paid parental leave, and comprehensive health benefits.