Staff Security Engineer, Level 6, Application Security

Snap Inc.; Bellevue, Los Angeles, Palo Alto (WA, CA, CA); Vor Ort; USD 251.000 - 377.000; Vollzeit

Benefits dieser Stelle

Paid parental leave

Comprehensive medical coverage

Emotional and mental health support

Zusammenfassung

Snap Inc. is seeking a Staff Security Engineer, Level 6, focused on Application Security, to own the security architecture for Snap’s Lens runtime and to lead web security across Snap’s web clients and embedded content.

You will guide vulnerability research, exploitability analysis, and security mitigations while mentoring engineers and coordinating with product leadership. The role emphasizes memory-safety improvements, secure design patterns, and collaboration across multiple teams to reduce

Qualifikationen

• Deep understanding of memory‑corruption vulnerabilities (out-of-bounds, use-after-free, etc.).
• Experience with iOS/Android security models and application sandboxing.
• Hands-on vulnerability discovery with fuzzing, sanitizers, reverse engineering.

Aufgaben

• Own security architecture and roadmap for Snap’s Lens runtime.
• Lead web security across Snap’s web clients and embedded content.
• Conduct deep code review, vulnerability research, and exploitability analysis.
• Drive memory‑safety improvements and mitigations balancing security and performance.
• Manage bug bounty program for web, mobile, and memory‑safety issues.
• Mentor engineers and communicate risk to leadership.

Kenntnisse

Memory‑safety

Vulnerability research

Code review

AI-assisted testing

Threat modeling

Ausbildung

BS in Computer Science/Engineering

MS/PhD in a related field (optional)

Jobbeschreibung

Staff Security Engineer, Level 6, Application Security

Snap Inc is a technology company. We believe the camera presents the greatest opportunity to improve the way people live and communicate. Snap contributes to human progress by empowering people to express themselves, live in the moment, learn about the world, and have fun together.

The Company operates Snapchat, a visual messaging app that enhances your relationships with friends, family, and the world, and Specs Inc., a wholly‑owned subsidiary dedicated to making computing more human, in addition to Bitmoji, Saturn, and other digital services.

Snap Security teams protect the trust and safety of our global community by securing the systems and data that power Snapchat. We safeguard hundreds of millions of Snapchatters every day, ensuring that every product and service is built on a foundation of security and resilience. Our values guide everything we do - from how we anticipate and mitigate threats to how we collaborate across Snap. We move fast, with precision, and always execute with privacy at the forefront.

What you’ll do:

Partner with engineering teams to design isolation and containment, including sandboxing, process separation, permission models, and IPC, so a compromised renderer or runtime stays contained.

Lead web security across Snap’s web clients and embedded web content, eliminating XSS, CSRF, iframe/framing abuse, prototype pollution, and cross‑origin leaks, and securing postMessage channels and WebView-to-native bridges.

Conduct deep code review, vulnerability research, and exploitability analysis across native runtimes, rendering components, parsers, and web‑facing code, using AI assisted testing and fuzzing tools, and drive root cause fixes that eliminate classes of vulnerabilities.

Ship memory‑safety improvements, exploit mitigations, and attack‑surface reductions that balance security with performance, compatibility, and developer experience.

Drive the bug bounty program for web, mobile, and memory‑safety issues, setting severity and reward criteria, running variant analysis on every report, and building trusted relationships with external researchers.

Provide technical leadership by mentoring engineers, establishing secure design patterns, and communicating risk and tradeoffs to engineering and product leadership.

Get deployed to Snap’s most difficult security challenges that span multiple teams and systems, and independently navigate the technical and organizational complexity to drive them to resolution.

What you’ll do:

Own the security architecture and roadmap for Snap’s Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and hardening of the script-to-native boundary.

Partner with engineering teams to design isolation and containment, including sandboxing, process separation, permission models, and IPC, so a compromised renderer or runtime stays contained.

Lead web security across Snap’s web clients and embedded web content, eliminating XSS, CSRF, iframe/framing abuse, prototype pollution, and cross‑origin leaks, and securing postMessage channels and WebView-to-native bridges.

Conduct deep code review, vulnerability research, and exploitability analysis across native runtimes, rendering components, parsers, and web‑facing code, using AI assisted testing and fuzzing tools, and drive root cause fixes that eliminate classes of vulnerabilities.

Ship memory‑safety improvements, exploit mitigations, and attack‑surface reductions that balance security with performance, compatibility, and developer experience.

Drive the bug bounty program for web, mobile, and memory‑safety issues, setting severity and reward criteria, running variant analysis on every report, and building trusted relationships with external researchers.

Provide technical leadership by mentoring engineers, establishing secure design patterns, and communicating risk and tradeoffs to engineering and product leadership.

Get deployed to Snap’s most difficult security challenges that span multiple teams and systems, and independently navigate the technical and organizational complexity to drive them to resolution.

Knowledge, Skills & Abilities:

• Deep understanding of memory‑corruption vulnerabilities such as out‑of‑bounds access, use‑after‑free, type confusion, and integer overflows, with the ability to assess exploitability and build proof‑of‑concept exploits when needed.
• Working knowledge of iOS and Android security models, including app sandboxing and platform exploit mitigations.
• Hands‑on vulnerability discovery experience with coverage‑guided fuzzing, sanitizers, reverse engineering, and root‑cause analysis.
• Ability to independently validate AI generated reviews, vulnerability findings and fixes, separating real vulnerabilities from false positives and catching incomplete or unsafe patches.
• Ability to navigate unfamiliar codebases, make sound decisions under ambiguity, and influence technical direction across teams without direct authority.

Minimum Qualifications:

• Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field.
• 9+ years of post‑Bachelor’s security engineering experience; or a Master’s degree in a technical field + 8+ year of post‑grad security engineering experience; or a PhD in a related technical field + 5+ years of post‑grad security engineering experience.
• Hands‑on experience with both native memory‑corruption analysis and web security, including shipping security improvements to a browser, embedded runtime, or similarly complex platform.

Preferred Qualifications:

• Experience designing or deploying sandboxing, exploit mitigations, compiler hardening, or memory‑safe components in performance‑sensitive production systems.
• Experience developing, securing or exploiting browser engines, embedded browsers, or JavaScript runtimes, such as Chromium, V8, WebKit, QuickJS, Hermes, JavaScriptCore, Gecko, or SpiderMonkey.
• History of hands‑on offensive security work, such as red teaming, malware analysis, or vulnerability discovery and exploitation (for example, published exploits, CVEs, bug bounty findings, or competitive CTF experience).
• Experience running or working closely with a bug bounty or vulnerability disclosure program, including triage, severity rating, and researcher communication.

“Default Together” Policy at Snap: At Snap Inc. we believe that being together in person helps us build our culture faster, reinforce our values, and serve our community, customers and partners better through dynamic collaboration. To reflect this, we practice a “default together” approach and expect our team members to work in an office 4+ days per week.

At Snap, we believe that having a team of diverse backgrounds and voices working together will enable us to create innovative products that improve the way people live and communicate. Snap is proud to be an equal opportunity employer, and committed to providing employment opportunities regardless of race, religious creed, color, national origin, ancestry, physical disability, mental disability, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, pregnancy, childbirth and breastfeeding, age, sexual orientation, military or veteran status, or any other protected classification, in accordance with applicable federal, state, and local laws. EOE, including disability/vets.

We are an Equal Opportunity Employer and will consider qualified applicants with criminal histories in a manner consistent with applicable law (by example, the requirements of the San Francisco Fair Chance Ordinance and the Los Angeles Fair Chance Initiative for Hiring, where applicable).

Our benefits are built around your needs and include paid parental leave, comprehensive medical coverage, emotional and mental health support programs, and compensation packages that let you share in Snap’s long‑term success!

• paid parental leave
• comprehensive medical coverage
• emotional and mental health support programs
• compensation packages that let you share in Snap’s long‑term success

Our Benefits : Snap Inc. is its own community, so we’ve got your back! We do our best to make sure you and your loved ones have everything you need to be happy and healthy, on your own terms. Our benefits are built around your needs and include paid parental leave, comprehensive medical coverage, emotional and mental health support programs, and compensation packages that let you share in Snap’s long‑term success!

• paid parental leave
• comprehensive medical coverage
• emotional and mental health support programs
• compensation packages that let you share in Snap’s long‑term success

Compensation

In the United States, work locations are assigned a pay zone which determines the salary range for the position. The successful candidate’s starting pay will be determined based on job‑related skills, experience, qualifications, work location, and market conditions. The starting pay may be negotiable within the salary range for the position. These pay zones may be modified in the future.

Zone A (CA, WA, NYC) :

The base salary range for this position is $251,000-$377,000 annually.

Zone B :

The base salary range for this position is $238,000-$358,000 annually.

Zone C :

The base salary range for this position is $213,000-$320,000 annually.This position is eligible for equity in the form of RSUs.