Staff Security Engineer, Level 6, Application Security

Snap’s Application Security team is seeking a Staff Security Engineer to help shape and deliver security architecture for web, browser, and memory-safety critical components. This role focuses on the Lens runtime and the protection of Snap web clients and embedded web experiences.

Role Overview

As a Staff Security Engineer, you will own the security architecture and roadmap for the Lens runtime. You will also lead web security efforts across Snap’s web clients and embedded web content, with a focus on hardening critical trust boundaries and eliminating common web and cross-context vulnerabilities.

Responsibilities

• Own the security architecture and roadmap for Snap’s Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and hardening of the script-to-native boundary.
• Partner with engineering teams to design isolation and containment, including sandboxing, process separation, permission models, and IPC, to ensure that a compromised renderer or runtime remains contained.
• Lead web security across Snap’s web clients and embedded web content, addressing XSS, CSRF, iframe and framing abuse, prototype pollution, and cross-origin leaks, including securing postMessage channels and WebView-to-native bridges.
• Perform deep code review, vulnerability research, and exploitability analysis across native runtimes, rendering components, parsers, and web-facing code, using AI-assisted testing and fuzzing tools, and drive root-cause fixes that remove classes of vulnerabilities.
• Ship memory-safety improvements, exploit mitigations, and attack-surface reductions while balancing security with performance, compatibility, and developer experience.
• Drive the bug bounty program for web, mobile, and memory-safety issues by defining severity and reward criteria, running variant analysis on every report, and building trusted relationships with external researchers.
• Provide technical leadership through mentoring engineers, establishing secure design patterns, and communicating risk and tradeoffs to engineering and product leadership.
• Engage directly with complex security challenges spanning multiple teams and systems, navigating technical and organizational complexity to drive resolution.

Requirements

• Deep understanding of memory-corruption vulnerabilities such as out-of-bounds access, use-after-free, type confusion, and integer overflows, including the ability to assess exploitability and build proof-of-concept exploits when needed.
• Deep web-security expertise covering same-origin policy, CORS, XSS, CSRF, iframe sandboxing, prototype pollution, and cookie and storage security, plus hands-on hardening experience with CSP, Trusted Types, frame-ancestors, HSTS, and COOP/COEP/CORP.
• Knowledge of browser and runtime architecture, including execution contexts and workers, native bindings, process models, OS sandboxing, and the distinction between language-level isolation and an enforceable security boundary.
• Understanding of iOS and Android security models, including app sandboxing and platform exploit mitigations.
• Strong C and C++ programming, code-review, and debugging skills, plus JavaScript proficiency and experience building production security tooling in Python, Go, or Rust.
• Hands-on vulnerability discovery experience with coverage-guided fuzzing, sanitizers, reverse engineering, and root-cause analysis.
• Ability to independently validate AI-generated reviews, vulnerability findings, and fixes, distinguishing real issues from false positives and catching incomplete or unsafe patches.
• Ability to navigate unfamiliar codebases, make sound decisions under ambiguity, and influence technical direction across teams without direct authority.
• Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field.
• 9+ years of post-Bachelor’s security engineering experience, or a Master’s degree plus 8+ years post-grad security engineering experience, or a PhD plus 5+ years post-grad security engineering experience.
• Hands-on experience with both native memory-corruption analysis and web security, including shipping security improvements to a browser, embedded runtime, or similarly complex platform.

Technologies

• JavaScript, C, C++, Python, Go, Rust
• iOS, Android
• CSP, Trusted Types, HSTS, COOP/COEP/CORP
• XSS, CSRF, CORS, same-origin policy
• WebView-to-native bridges, postMessage
• iframe sandboxing, prototype pollution

Compensation

• Zone A (CA, WA, NYC): $251,000 to $377,000 base salary annually
• Zone B: $238,000 to $358,000 base salary annually
• Zone C: $213,000 to $320,000 base salary annually

Benefits

• Paid parental leave
• Comprehensive medical coverage
• Emotional and mental health support programs
• Equity in the form of RSUs

Location and Work Model

Los Angeles, CA (onsite). Snap’s default together policy expects team members to work in an office 4+ days per week.

Preferred Qualifications

• Experience designing or deploying sandboxing, exploit mitigations, compiler hardening, or memory-safe components in performance-sensitive production systems.
• Experience developing, securing, or exploiting browser engines or JavaScript runtimes, such as Chromium, V8, WebKit, QuickJS, Hermes, JavaScriptCore, Gecko, or SpiderMonkey.
• History of hands-on offensive security work, such as red teaming, malware analysis, or vulnerability discovery and exploitation (for example, published exploits, CVEs, bug bounty findings, or competitive CTF experience).
• Experience running or working closely with a bug bounty or vulnerability disclosure program, including triage, severity rating, and researcher communication.

Education

Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent.