Staff Security Engineer, Level 6, Application Security

Snap Inc. • Los Angeles, CA

1d • $213,000 - $377,000 • Onsite

About The Position

Snap Inc. is hiring a Staff Security Engineer for its Application Security team, focused on browser, web, and memory safety. The role leads security for the runtime powering Snapchat Lenses, Camera Kit, and Spectacles, as well as Snap’s web clients. The engineer will set the security roadmap and guide architecture across native and web teams, addressing challenges similar to those faced by modern browsers.

The position combines security architecture, vulnerability research, engineering collaboration, and technical leadership. It involves hardening runtime boundaries, containing compromised components, strengthening web security, improving memory safety, and leading the bug bounty program for web, mobile, and memory-safety issues. The engineer will also mentor others and independently drive complex security challenges across teams.

Snap follows a “default together” approach, expecting employees to work in an office at least four days per week. In the United States, base salary ranges are $251,000–$377,000 in Zone A (CA, WA, NYC), $238,000–$358,000 in Zone B, and $213,000–$320,000 in Zone C. The position is eligible for equity in the form of RSUs.

Requirements

• Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field.
• 9+ years of post-Bachelor’s security engineering experience; or a technical Master’s degree and 8+ years of post-graduate security engineering experience; or a related technical Ph.D. and 5+ years of post-graduate security engineering experience.
• Hands-on experience with both native memory-corruption analysis and web security, including shipping security improvements to a browser, embedded runtime, or similarly complex platform.
• Deep understanding of memory-corruption vulnerabilities such as out-of-bounds access, use-after-free, type confusion, and integer overflows, including assessing exploitability and building proof-of-concept exploits when needed.
• Deep web-security expertise, including same-origin policy, CORS, XSS, CSRF, iframe sandboxing, prototype pollution, and cookie and storage security; hands-on hardening with CSP, Trusted Types, frame-ancestors, HSTS, and COOP/COEP/CORP.
• Understanding of browser and runtime architecture, including execution contexts and workers, native bindings, process models, OS sandboxing, and the difference between language-level isolation and an enforceable security boundary.
• Working knowledge of iOS and Android security models, including app sandboxing and platform exploit mitigations.
• Strong C and C++ programming, code-review, and debugging skills; JavaScript proficiency; and experience building production security tooling in Python, Go, or Rust.
• Hands-on vulnerability discovery experience with coverage-guided fuzzing, sanitizers, reverse engineering, and root-cause analysis.
• Ability to independently validate AI-generated reviews, vulnerability findings, and fixes; distinguish genuine vulnerabilities from false positives; and identify incomplete or unsafe patches.
• Ability to navigate unfamiliar codebases, make sound decisions under ambiguity, and influence technical direction across teams without direct authority.

Nice To Haves

• Experience designing or deploying sandboxing, exploit mitigations, compiler hardening, or memory-safe components in performance-sensitive production systems.
• Experience developing, securing, or exploiting browser engines, embedded browsers, or JavaScript runtimes such as Chromium, V8, WebKit, QuickJS, Hermes, JavaScriptCore, Gecko, or SpiderMonkey.
• Hands-on offensive security experience, such as red teaming, malware analysis, or vulnerability discovery and exploitation, including published exploits, CVEs, bug bounty findings, or competitive CTF experience.
• Experience running or working closely with a bug bounty or vulnerability disclosure program, including triage, severity rating, and researcher communication.

Responsibilities

• Own the security architecture and roadmap for Snap’s Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and hardening the script-to-native boundary.
• Partner with engineering teams to design isolation and containment, including sandboxing, process separation, permission models, and IPC.
• Lead web security across Snap’s web clients and embedded web content, addressing XSS, CSRF, iframe and framing abuse, prototype pollution, cross-origin leaks, postMessage channels, and WebView-to-native bridges.
• Conduct code reviews, vulnerability research, and exploitability analysis across native runtimes, rendering components, parsers, and web-facing code; use AI-assisted testing and fuzzing tools and drive root-cause fixes.
• Deliver memory-safety improvements, exploit mitigations, and attack-surface reductions while balancing performance, compatibility, and developer experience.
• Drive the bug bounty program for web, mobile, and memory-safety issues, including setting severity and reward criteria, conducting variant analysis, and building relationships with external researchers.
• Mentor engineers, establish secure design patterns, and communicate risks and tradeoffs to engineering and product leadership.
• Independently navigate complex, cross-team security challenges and drive them to resolution.

Benefits

• Paid parental leave
• Comprehensive medical coverage
• Emotional and mental health support programs
• Compensation packages that provide an opportunity to share in Snap’s long-term success
• Equity in the form of RSUs

What This Job Offers

• Job Type: Full-time
• Career Level: Senior