Security Engineer (Level 5, Offensive Security)

Join Snap Inc. as a Security Engineer in our Offensive Security Team. In this role, you will design, execute, and lead offensive security engagements, maintain a comprehensive understanding of real-world threat actors, deliver detailed post-engagement reports, implement and manage offensive security engagement infrastructure, collaborate closely with other security and privacy teams, serve as a subject matter expert, and explore novel research topics. You will receive a comprehensive benefits package, including medical coverage, dental coverage, vision coverage, and generous time off.

USD 209,000 - 313,000

Responsibilities

• Design, execute, and lead offensive security and privacy engagements, including red, purple, and orange team exercises.
• Maintain a comprehensive understanding of real-world threat actors, their tools, tactics, and procedures, and collaborate with the threat intelligence team.
• Deliver detailed post-engagement reports that identify vulnerabilities, highlight strengths and weaknesses in our security posture, and provide actionable recommendations.
• Adept at threat modeling and establishing killchains

Requirements

• Coding proficiency in one or more modern languages, including Java, Python, Go, etc
• Proficiency in scripting languages like Bash and PowerShell to automate security tasks and improve efficiency of engagements
• Possess an insatiable drive for learning and the ability to thrive in new, unique, and complex technical environments, with the capability to build a foundational understanding and effectively apply it within the context of engagements
• Proven experience in leading offensive security engagements, coordinating multiple security engineers, and managing and executing assessments to thoroughly test and evaluate security measures
• Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development
• Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field
• You may also provide evidence of personal security research (CVEs or blogs), public bug bounty reports, previous CTF participation, and/or code repositories on GitHub showcasing personally developed security tools
• 6+ years of post-Bachelor’s security related experience; or Master’s degree in a technical field + 5+ year of post-grad security related experience; or PhD in a relevant technical field + 2+ years of post-grad security related experience
• Familiar with frameworks like ATT&CK to represent tools, tactics, and procedures
• Experience in leading or participating in incident response efforts, with a deep understanding of digital forensics, detection engineering, and threat hunting
• Proven ability to work effectively with cross-functional teams at all-levels, including developers, IT, and executive leadership, to align security measures with organizational goals