Staff Security Engineer, Level 6, Application Security

Description

The company makes Snapchat, a visual messaging app, along with Specs Inc., a wholly-owned subsidiary focused on making computing more human, plus Bitmoji, Saturn, and other digital services.

The Application Security team sits within the security group, which protects the systems and data behind Snapchat, a service used by hundreds of millions of people each day.

This Staff Security Engineer role focuses on browser, web, and memory safety. The work is similar to securing a modern browser, and the role covers the runtime behind every Lens, Camera Kit, Spectacles, and the company's web clients.

Responsibilities

• Own the security architecture and roadmap for the Lens runtime, covering threat models, trust boundaries, JavaScript engine strategy, and hardening of the script-to-native boundary.
• Work with engineering teams to design isolation and containment, including sandboxing, process separation, permission models, and IPC, so that a compromised renderer or runtime stays contained.
• Lead web security for the company's web clients and embedded web content, removing XSS, CSRF, framing abuse, prototype pollution, and cross-origin leaks, and securing postMessage channels and WebView-to-native bridges.
• Perform deep code review, vulnerability research, and exploitability analysis across native runtimes, rendering components, parsers, and web-facing code, using AI-assisted testing and fuzzing, and fix root causes so whole classes of vulnerabilities disappear.
• Build memory-safety improvements, exploit mitigations, and attack-surface reductions that weigh security against performance, compatibility, and developer experience.
• Run the bug bounty program for web, mobile, and memory-safety issues, set severity and reward criteria, perform variant analysis on every report, and maintain relationships with external researchers.
• Lead technically by mentoring engineers, setting secure design patterns, and explaining risk and tradeoffs to engineering and product leaders.
• Take on the hardest security problems that span several teams and systems, and work through the technical and organizational complexity until they are resolved.

Requirements

• Deep understanding of memory-corruption bugs such as out-of-bounds access, use-after-free, type confusion, and integer overflows, and the ability to judge exploitability and build proof-of-concept exploits when needed.
• Deep web security knowledge, including the same-origin policy, CORS, XSS, CSRF, iframe sandboxing, prototype pollution, and cookie and storage security, with hands-on experience hardening with CSP, Trusted Types, frame-ancestors, HSTS, and COOP/COEP/CORP.
• Understanding of browser and runtime architecture, including execution contexts, workers, native bindings, process models, and OS sandboxing, and the difference between language-level isolation and an enforceable security boundary.
• Working knowledge of iOS and Android security models, including app sandboxing and platform exploit mitigations.
• Strong C and C++ skills in programming, code review, and debugging, solid JavaScript, and experience building production security tooling in Python, Go, or Rust.
• Hands-on vulnerability discovery with coverage-guided fuzzing, sanitizers, reverse engineering, and root-cause analysis.
• Ability to check AI-generated reviews, findings, and fixes independently, separating real vulnerabilities from false positives and catching incomplete or unsafe patches.
• Ability to work in unfamiliar codebases, make sound calls under ambiguity, and steer technical direction across teams without formal authority.
• Bachelor's degree in Computer Science, Engineering, Information Systems, or equivalent experience in a related technical field.
• 9+ years of security engineering experience after a Bachelor's degree, or a Master's in a technical field plus 8+ years after the Master's, or a PhD in a related field plus 5+ years after the PhD.
• Hands-on experience with both native memory-corruption analysis and web security, including shipping security improvements to a browser, embedded runtime, or similarly complex platform.
• Optional: experience designing or deploying sandboxing, exploit mitigations, compiler hardening, or memory-safe components in performance-sensitive production systems.
• Optional: experience developing, securing, or exploiting browser engines, embedded browsers, or JavaScript runtimes such as Chromium, V8, WebKit, QuickJS, Hermes, JavaScriptCore, Gecko, or SpiderMonkey.
• Optional: a record of offensive security work, such as red teaming, malware analysis, or vulnerability discovery and exploitation, for example published exploits, CVEs, bug bounty findings, or competitive CTF experience.
• Optional: experience running or working closely with a bug bounty or vulnerability disclosure program, including triage, severity rating, and researcher communication.

Conditions

The company works in a default-together model and expects team members in the office 4+ days per week.

In the United States, each work location sits in a pay zone that sets the salary range. Starting pay depends on job-related skills, experience, qualifications, work location, and market conditions, and may be negotiable within the range. Pay zones may change in the future.

Zone A (CA, WA, NYC): base salary of $251,000-$377,000 per year.

Zone B: base salary of $238,000-$358,000 per year.

Zone C: base salary of $213,000-$320,000 per year.

The role is eligible for equity in the form of RSUs.

The company is an equal opportunity employer and considers applicants with criminal histories in line with applicable law, including local fair chance ordinances.

Benefits

• Paid parental leave, comprehensive medical coverage, emotional and mental health support programs, and compensation packages that let you share in the company's long-term success.