Snap’s Application Security team focuses on protecting Lens runtime, web clients, and embedded web experiences with a security approach that balances safety, performance, and developer experience. In this Staff Security Engineer role (Level 6), you will shape security architecture and roadmaps for browser, web, and memory safety, and lead technical work that spans multiple teams to drive issues to resolution.
Location: Los Angeles, CA (onsite)
Compensation: USD 213,000 - 377,000 per yearly (zone-based range)
Responsibilities
- Own the security architecture and roadmap for the Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and hardening of the script-to-native boundary.
- Partner with engineering teams to design isolation and containment, including sandboxing, process separation, permission models, and IPC, so a compromised renderer or runtime remains contained.
- Lead web security across Snap’s web clients and embedded web content by eliminating XSS, CSRF, iframe and framing abuse, prototype pollution, and cross-origin leaks, including securing postMessage channels and WebView-to-native bridges.
- Perform deep code review, vulnerability research, and exploitability analysis across native runtimes, rendering components, parsers, and web-facing code; use AI assisted testing and fuzzing tools; drive root-cause fixes that eliminate vulnerability classes.
- Ship memory-safety improvements, exploit mitigations, and attack-surface reductions while balancing security with performance, compatibility, and developer experience.
- Drive the bug bounty program for web, mobile, and memory-safety issues, including setting severity and reward criteria, running variant analysis on every report, and building trusted relationships with external researchers.
- Provide technical leadership through mentoring, establishing secure design patterns, and communicating risk and tradeoffs to engineering and product leadership.
- Deploy to Snap’s most difficult security challenges across multiple teams and systems, navigating technical and organizational complexity to drive resolution independently.
Requirements
- Deep understanding of memory-corruption vulnerabilities such as out-of-bounds access, use-after-free, type confusion, and integer overflows, with the ability to assess exploitability and build proof-of-concept exploits when needed.
- Deep web-security expertise covering same-origin policy, CORS, XSS, CSRF, iframe sandboxing, prototype pollution, and cookie and storage security, with hands-on hardening using CSP, Trusted Types, frame-ancestors, HSTS, and COOP/COEP/CORP.
- Understanding of browser and runtime architecture, including execution contexts and workers, native bindings, process models, OS sandboxing, and how language-level isolation differs from an enforceable security boundary.
- Working knowledge of iOS and Android security models, including app sandboxing and platform exploit mitigations.
- Strong C and C++ programming, code-review, and debugging skills, plus JavaScript proficiency and experience building production security tooling in Python, Go, or Rust.
- Hands-on vulnerability discovery experience using coverage-guided fuzzing, sanitizers, reverse engineering, and root-cause analysis.
- Ability to independently validate AI-generated reviews, vulnerability findings, and fixes, distinguishing real vulnerabilities from false positives and identifying incomplete or unsafe patches.
- Ability to navigate unfamiliar codebases, make sound decisions under ambiguity, and influence technical direction across teams without direct authority.
- Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field.
- 9+ years of post-Bachelor’s security engineering experience, or Master’s degree + 8+ years post-grad, or PhD + 5+ years post-grad.
- Hands-on experience with both native memory-corruption analysis and web security, including shipping security improvements to a browser, embedded runtime, or similarly complex platform.
Tech you’ll work with
- JavaScript, C, C++, Python, Go, Rust
- iOS, Android
- CSP, Trusted Types, HSTS, COOP/COEP/CORP
- XSS, CSRF, CORS
- Same-origin policy, WebView-to-native bridges, postMessage
- iframe sandboxing, prototype pollution
Benefits
- Paid parental leave
- Comprehensive medical coverage
- Emotional and mental health support programs
- Equity in the form of RSUs
Team expectations
Snap’s default together policy expects team members to work in an office 4+ days per week.
Education
Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent
