Staff Security Engineer, Level 6, Application Security

Snap Inc is a technology company. We believe the camera presents the greatest opportunity to improve the way people live and communicate. Snap contributes to human progress by empowering people to express themselves, live in the moment, learn about the world, and have fun together.
The Company operates Snapchat, a visual messaging app that enhances your relationships with friends, family, and the world, and Specs Inc., a wholly-owned subsidiary dedicated to making computing more human, in addition to Bitmoji, Saturn, and other digital services.
Snap Security teams protect the trust and safety of our global community by securing the systems and data that power Snapchat. We safeguard hundreds of millions of Snapchatters every day, ensuring that every product and service is built on a foundation of security and resilience. Our values guide everything we do
- from how we anticipate and mitigate threats to how we collaborate across Snap. We move fast, with precision, and always execute with privacy at the forefront.
We’re looking for a Staff Security Engineer to join the Application Security team at Snap, focused on browser, web, and memory safety As a Staff engineer on the team, you’ll lead the security of the runtime that powers every Lens on Snapchat, Camera Kit, and Spectacles, as well as Snap’s web clients. The platform faces many of the same challenges as a modern browser, and you’ll set the security roadmap and guide architecture across the native and web teams that build it.
What you’ll do:Own the security architecture and roadmap for Snap’s Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and hardening of the script-to-native boundary.
Partner with engineering teams to design isolation and containment, including sandboxing, process separation, permission models, and IPC, so a compromised renderer or runtime stays contained.
Lead web security across Snap’s web clients and embedded web content, eliminating XSS, CSRF, iframe/framing abuse, prototype pollution, and cross-origin leaks, and securing postMessage channels and WebView-to-native bridges.
Conduct deep code review, vulnerability research, and exploitability analysis across native runtimes, rendering components, parsers, and web-facing code, using AI assisted testing and fuzzing tools, and drive root cause fixes that eliminate classes of vulnerabilities.
Ship memory-safety improvements, exploit mitigations, and attack-surface reductions that balance security with performance, compatibility, and developer experience.
Drive the bug bounty program for web, mobile, and memory-safety issues, setting severity and reward criteria, running variant analysis on every report, and building trusted relationships with external researchers.
Provide technical leadership by mentoring engineers, establishing secure design patterns, and communicating risk and tradeoffs to engineering and product leadership.
Get deployed to Snap’s most difficult security challenges that span multiple teams and systems, and independently navigate the technical and organizational complexity to drive them to resolution.
Knowledge, Skills & Abilities:Deep understanding of memory-corruption vulnerabilities such as out-of-bounds access, use-after-free, type confusion, and integer overflows, with the ability to assess exploitability and build proof-of-concept exploits when needed.
Deep web-security expertise, including the same-origin policy, CORS, XSS, CSRF, iframe sandboxing, prototype pollution, and cookie and storage security, and hands-on hardening with CSP, Trusted Types, frame-ancestors, HSTS, and COOP/COEP/CORP.
Understanding of browser and runtime architecture, including execution contexts and workers, native bindings, process models, OS sandboxing, and the difference between language-level isolation and an enforceable security boundary.
Working knowledge of iOS and Android security models, including app sandboxing and platform exploit mitigations.
Strong C and C++ programming, code-review, and debugging skills, JavaScript proficiency, and experience building production security tooling in Python, Go, or Rust.
Hands-on vulnerability discovery experience with coverage-guided fuzzing, sanitizers, reverse engineering, and root-cause analysis.
Ability to independently validate AI generated reviews, vulnerability findings and fixes, separating real vulnerabilities from false positives and catching incomplete or unsafe patches.
Ability to navigate unfamiliar codebases, make sound decisions under ambiguity, and influence technical direction across teams without direct authority.
Minimum

Qualifications:
Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field.9+ years of post-Bachelor’s security engineering experience; or a Master’s degree in a technical field + 8+ year of post-grad security engineering experience; or a PhD in a related technical field + 5+ years of post-grad security engineering