Staff Security Engineer, Level 6, Application Security

Snap•Santa Monica, CA

5d•Onsite

About The Position

Snap Inc. is seeking a Staff Security Engineer to join its Application Security team, focused on browser, web, and memory safety. The engineer will lead security for the runtime powering Snapchat Lenses, Camera Kit, and Spectacles, as well as Snap’s web clients. The role sets the security roadmap and guides architecture across native and web teams, addressing challenges similar to those of a modern browser. The role owns security architecture for the Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and hardening the script-to-native boundary. It partners with engineering teams on isolation and containment, leads web security improvements, conducts code review and vulnerability research, ships memory-safety improvements and exploit mitigations, and drives the bug bounty program. The Staff Engineer also mentors engineers, establishes secure design patterns, communicates risks and tradeoffs to leadership, and independently resolves complex security challenges spanning multiple teams and systems. Snap follows a “default together” approach, expecting team members to work in an office at least four days per week. The position is eligible for RSUs. U.S. annual base salary ranges vary by pay zone: Zone A (CA, WA, NYC), $251,000–$377,000; Zone B, $238,000–$358,000; and Zone C, $213,000–$320,000. Starting pay depends on job-related skills, experience, qualifications, work location, and market conditions and may be negotiable within the range.

Requirements

Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field.
At least 9 years of post-bachelor’s security engineering experience; or a master’s degree in a technical field and at least 8 years of post-graduate security engineering experience; or a PhD in a related technical field and at least 5 years of post-graduate security engineering experience.
Hands-on experience with both native memory-corruption analysis and web security, including shipping security improvements to a browser, embedded runtime, or similarly complex platform.
Deep understanding of memory-corruption vulnerabilities, including out-of-bounds access, use-after-free, type confusion, and integer overflows, with the ability to assess exploitability and develop proof-of-concept exploits when needed.
Deep web-security expertise, including same-origin policy, CORS, XSS, CSRF, iframe sandboxing, prototype pollution, and cookie and storage security; hands-on hardening with CSP, Trusted Types, frame-ancestors, HSTS, and COOP/COEP/CORP.
Understanding of browser and runtime architecture, including execution contexts and workers, native bindings, process models, OS sandboxing, and the distinction between language-level isolation and an enforceable security boundary.
Working knowledge of iOS and Android security models, including app sandboxing and platform exploit mitigations.
Strong C and C++ programming, code-review, and debugging skills; JavaScript proficiency; and experience building production security tooling in Python, Go, or Rust.
Hands-on vulnerability discovery experience with coverage-guided fuzzing, sanitizers, reverse engineering, and root-cause analysis.
Ability to independently validate AI-generated reviews, vulnerability findings, and fixes; distinguish real vulnerabilities from false positives; and identify incomplete or unsafe patches.
Ability to navigate unfamiliar codebases, make sound decisions under ambiguity, and influence technical direction across teams without direct authority.

Nice To Haves

Experience designing or deploying sandboxing, exploit mitigations, compiler hardening, or memory-safe components in performance-sensitive production systems.
Experience developing, securing, or exploiting browser engines, embedded browsers, or JavaScript runtimes, such as Chromium, V8, WebKit, QuickJS, Hermes, JavaScriptCore, Gecko, or SpiderMonkey.
History of hands-on offensive security work, such as red teaming, malware analysis, or vulnerability discovery and exploitation, including published exploits, CVEs, bug bounty findings, or competitive CTF experience.
Experience running or working closely with a bug bounty or vulnerability disclosure program, including triage, severity rating, and researcher communication.

Responsibilities

Own security architecture and roadmap for Snap’s Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and hardening the script-to-native boundary.
Partner with engineering teams to design sandboxing, process separation, permission models, and IPC that contain compromised renderers or runtimes.
Lead web security across Snap’s web clients and embedded web content, addressing XSS, CSRF, iframe and framing abuse, prototype pollution, cross-origin leaks, postMessage channels, and WebView-to-native bridges.
Conduct deep code reviews, vulnerability research, and exploitability analysis across native runtimes, rendering components, parsers, and web-facing code; use AI-assisted testing and fuzzing tools and drive root-cause fixes.
Ship memory-safety improvements, exploit mitigations, and attack-surface reductions while balancing security with performance, compatibility, and developer experience.
Drive the bug bounty program for web, mobile, and memory-safety issues, including setting severity and reward criteria, conducting variant analysis on reports, and building relationships with external researchers.
Mentor engineers, establish secure design patterns, and communicate risk and tradeoffs to engineering and product leadership.
Take on difficult security challenges spanning multiple teams and systems, independently navigating technical and organizational complexity to resolve them.