Staff Security Architect - Web & Memory Safety

Snap; Los Angeles (CA); Hybrid; USD 180,000 - 260,000; Full time

Job summary

Snap Inc. is seeking a Staff Security Engineer for the Application Security team, focusing on browser, web, and memory safety across Lens runtime and Snap's web clients.

You will set security roadmaps, partner with engineering teams to implement robust containment, and drive changes that reduce attack surfaces. The role requires deep expertise in memory-safety, web security, and browser architecture, with hands-on offense/defense experience, strong code review skills, and the ability to lead

Qualifications

• Deep memory-corruption knowledge including out-of-bounds, use-after-free, type confusion, and overflows.
• Strong web security expertise: same-origin, CORS, XSS/CSRF, iframe sandboxing, and cookie/storage security.
• Experience with browser/runtime architecture, execution contexts, workers, bindings, and OS sandboxing.
• Hands-on vulnerability discovery with fuzzing, sanitizers, reverse engineering, and root-cause analysis.

Responsibilities

• Own the security architecture and roadmap for Snap's Lens runtime, including threat models, trust boundaries, and hardening of the script-to-native boundary.
• Lead design of isolation and containment (sandboxing, IPC, permissions) to contain compromised renderers or runtimes.
• Lead web security for Snap's web clients and embedded content, eliminating XSS/CSRF, framing abuse, and cross-origin leaks.

Skills

Memory-safety

Web security

C/C++

JavaScript

Python/Go/Rust

Fuzzing

Code review

Threat modeling

AI-assisted testing

Cross-origin policies

Education

Bachelor's degree in CS/Engineering or related field

Tools

Python

Go

Rust

Fuzzing tools

Job description

Snap Inc. is seeking a Staff Security Engineer for the Application Security team, focusing on browser, web, and memory safety across Lens runtime and Snap's web clients.

You will set security roadmaps, partner with engineering teams to implement robust containment, and drive changes that reduce attack surfaces. The role requires deep expertise in memory-safety, web security, and browser architecture, with hands-on offense/defense experience, strong code review skills, and the ability to lead