Asks for

The ad says“Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development”
The ad says“Familiar with frameworks like ATT&CK to represent tools, tactics, and procedures”
The ad says“Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development”
The ad says“Proficiency in scripting languages like Bash and PowerShell to automate security tasks and improve efficiency of engagements”
The ad says“Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development”
The ad says“Experience in leading or participating in incident response efforts, with a deep understanding of digital forensics, detection engineering, and threat hunting”
The ad says“Experience in leading or participating in incident response efforts, with a deep understanding of digital forensics, detection engineering, and threat hunting”
The ad says“Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development”
The ad says“Coding proficiency in one or more modern languages, including Java, Python, Go, etc”
The ad says“Experience in leading or participating in incident response efforts, with a deep understanding of digital forensics, detection engineering, and threat hunting”
The ad says“Coding proficiency in one or more modern languages, including Java, Python, Go, etc”
The ad says“Adept at threat modeling and establishing killchains”
The ad says“Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development”
The ad says“Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development”
The ad says“Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development”
The ad says“Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development”
The ad says“Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development”
The ad says“Proficiency in scripting languages like Bash and PowerShell to automate security tasks and improve efficiency of engagements”
The ad says“Coding proficiency in one or more modern languages, including Java, Python, Go, etc”
The ad says“Experience in leading or participating in incident response efforts, with a deep understanding of digital forensics, detection engineering, and threat hunting”
The ad says“Adept at threat modeling and establishing killchains”

We’re looking for a Security Engineer to join our Offensive Security Team!
Design, execute, and lead offensive security and privacy engagements, including red, purple, and orange team exercises, across corporate environments, cloud projects/accounts, internal applications, and mobile client applications
Maintain a comprehensive understanding of real-world threat actors, their tools, tactics, and procedures, with a propensity to target Snap, collaborating extensively with the threat intelligence team to enumerate exhaustive killchains that seed and prioritize the future engagement roadmap
Deliver detailed post-engagement reports that identify vulnerabilities, highlight strengths and weaknesses in our security posture, assess detection coverage, and provide actionable recommendations, including prioritized risk mitigation strategies and improvements to defensive measures
Implement and manage offensive security engagement infrastructure and tooling to conduct covert operations and mimic the tactics of relevant adversaries, including the development of custom implants, payloads, and exploits to thoroughly test and evaluate our defenses
Collaborate closely with other security and privacy teams to share insights from engagements, informing strategic roadmaps by identifying priority areas for improvement and aligning on initiatives
Serve as a subject matter expert and consultant to other security and privacy teams, participating in security reviews, reproducing vulnerabilities, and contributing to high-stakes incident response efforts
Explore novel research topics relevant to our tech stack to proactively improve our security posture and integrate lessons learned into future exercises

Benefits

Up to 28 weeks of parental leave and return-to-work program
Adoption, surrogacy, infertility, and fertility preservation benefits
Backup child care coverage, center-based care support, & caregiver assistance
Dependent Daycare Flexible Spending Account
Services to support your path to parenthood & beyond - fertility support & family planning via Carrot, SNOO, Hinge Health
Short-term disability, long-term disability, basic life insurance, and AD&D insurance
Lactation rooms (based on office location) and breastmilk shipping coverage
For Snap, employees taking care of loved ones with complex, chronic, or ongoing care needs (i.e. parent with Dementia, spouse with Cancer, child with Autism), your family can save time, money, & stress with Wellthy
Comprehensive medical coverage, including PPO, HDHP with HSA, and HMO options
Dental coverage, including orthodontia benefits
Vision coverage, including frame and contact allowance and LASIK benefits
Free membership to One Medical for primary and urgent healthcare services
Business Travel Insurance
Gym perks and discounts
Team fitness classes and races
Sports leagues
Cooking and nutritional workshops
Well-being reimbursement
Unlimited access to virtual physical therapy with Anthem
15 sessions per year of mental health for you + dependents through Lyra
Generous time off and leave programs. In the US, this includes the following:
Up to 3 weeks (120 hours) of vacation time and 1 floating holiday for non-exempt team members
15 sick and safe days per year
12 paid holidays per year
Meditation and yoga classes
Speaker series, classes, and subscriptions to educational programs
Social gatherings, team outings, and volunteering programs
Snap Inc. provides a 401(k) plan that allows you to save on a pre-tax, Roth, and after-tax basis for your retirement (yes, we even have the Mega backdoor option!) Snap will also match 100% up to 3% of your contribution and then 50% on your 4th and 5th%
Flexible Spending Accounts for healthcare, daycare and commuter
Health Savings Account with employer contributions
Rocket Lawyer memberships
Financial education programs
Snap exclusive discounts and perks
Compensation packages that let you share in Snap’s long-term success!

Preferred experience

Coding proficiency in one or more modern languages, including Java, Python, Go, etc
Proficiency in scripting languages like Bash and PowerShell to automate security tasks and improve efficiency of engagements
Adept at threat modeling and establishing killchains
Possess an insatiable drive for learning and the ability to thrive in new, unique, and complex technical environments, with the capability to build a foundational understanding and effectively apply it within the context of engagements
Proven experience in leading offensive security engagements, coordinating multiple security engineers, and managing and executing assessments to thoroughly test and evaluate security measures
Expert knowledge in four or more of the following: operating system internals, networking, application development, mobile client development, Kubernetes, cloud infrastructure (AWS/GCP), and payload/implant/exploit development
Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field
You may also provide evidence of personal security research (CVEs or blogs), public bug bounty reports, previous CTF participation, and/or code repositories on GitHub showcasing personally developed security tools
6+ years of post-Bachelor’s security related experience; or Master’s degree in a technical field + 5+ year of post-grad security related experience; or PhD in a relevant technical field + 2+ years of post-grad security related experience
Familiar with frameworks like ATT&CK to represent tools, tactics, and procedures
Experience in leading or participating in incident response efforts, with a deep understanding of digital forensics, detection engineering, and threat hunting
Proven ability to work effectively with cross-functional teams at all-levels, including developers, IT, and executive leadership, to align security measures with organizational goals