> Markdown version of [/jobs/ext/4032172-staff-security-engineer-level-6-application-security](https://www.wearedevelopers.com/jobs/ext/4032172-staff-security-engineer-level-6-application-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Staff Security Engineer, Level 6, Application Security

- **Company:** Snap Inc.
- **Location:** Los Angeles, CA, United States
- **Experience:** Expert
- **Salary:** $251,000.0
- **Contract:** Permanent contract
- **Skills:** JavaScript (Programming Language), Artificial Intelligence, Apple IOS, Code Review, Cyber Security, Information Systems, Computer Programming, Digital Rendering, Cross-Origin Resource Sharing (Ajax Programming), Cross-Site Request Forgery, Data Security, Software Debugging, Gecko (Software), Web Browsers, Python (Programming Language), Parsing, Reverse Engineering, Web Application Security, WebKit, Software Security, Deep Web, Malware, Cross-Site Scripting (XSS), Web Content, Information Technology, Iframes, Vulnerability Analysis
- **Published:** October 30, 2026
- **Apply:** https://dejobs.org/x/x/F3BBF1E9ED4F4231A720EEEE6BCA2417/job/

## About the Role

* Deep understanding of memory-corruption vulnerabilities such as out-of-bounds access, use-after-free, type confusion, and integer overflows, with the ability to assess exploitability and build proof-of-concept exploits when needed.
 * Deep web-security expertise, including the same-origin policy, CORS, XSS, CSRF, iframe sandboxing, prototype pollution, and cookie and storage security, and hands-on hardening with CSP, Trusted Types, frame-ancestors, HSTS, and COOP/COEP/CORP.
 * Understanding of browser and runtime architecture, including execution contexts and workers, native bindings, process models, OS sandboxing, and the difference between language-level isolation and an enforceable security boundary.
 * Working knowledge of iOS and Android security models, including app sandboxing and platform exploit mitigations.
 * Strong C and C++ programming, code-review, and debugging skills, JavaScript proficiency, and experience building production security tooling in Python, Go, or Rust.
 * Hands-on vulnerability discovery experience with coverage-guided fuzzing, sanitizers, reverse engineering, and root-cause analysis.
 * Ability to independently validate AI generated reviews, vulnerability findings and fixes, separating real vulnerabilities from false positives and catching incomplete or unsafe patches.
 * Ability to navigate unfamiliar codebases, make sound decisions under ambiguity, and influence technical direction across teams without direct authority., * Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field.
 * 9+ years of post-Bachelor's security engineering experience; or a Master's degree in a technical field + 8+ year of post-grad security engineering experience; or a PhD in a related technical field + 5+ years of post-grad security engineering experience
 * Hands-on experience with both native memory-corruption analysis and web security, including shipping security improvements to a browser, embedded runtime, or similarly complex platform., * Experience designing or deploying sandboxing, exploit mitigations, compiler hardening, or memory-safe components in performance-sensitive production systems.
 * Experience developing, securing or exploiting browser engines, embedded browsers, or JavaScript runtimes, such as Chromium, V8, WebKit, QuickJS, Hermes, JavaScriptCore, Gecko, or SpiderMonkey.
 * History of hands-on offensive security work, such as red teaming, malware analysis, or vulnerability discovery and exploitation (for example, published exploits, CVEs, bug bounty findings, or competitive CTF experience).
 * Experience running or working closely with a bug bounty or vulnerability disclosure program, including triage, severity rating, and researcher communication.

## Description

* Own the security architecture and roadmap for Snap's Lens runtime, including threat models, trust boundaries, JavaScript engine strategy, and hardening of the script-to-native boundary.
 * Partner with engineering teams to design isolation and containment, including sandboxing, process separation, permission models, and IPC, so a compromised renderer or runtime stays contained.
 * Lead web security across Snap's web clients and embedded web content, eliminating XSS, CSRF, iframe/framing abuse, prototype pollution, and cross-origin leaks, and securing postMessage channels and WebView-to-native bridges.
 * Conduct deep code review, vulnerability research, and exploitability analysis across native runtimes, rendering components, parsers, and web-facing code, using AI assisted testing and fuzzing tools, and drive root cause fixes that eliminate classes of vulnerabilities.
 * Ship memory-safety improvements, exploit mitigations, and attack-surface reductions that balance security with performance, compatibility, and developer experience.
 * Drive the bug bounty program for web, mobile, and memory-safety issues, setting severity and reward criteria, running variant analysis on every report, and building trusted relationships with external researchers.
 * Provide technical leadership by mentoring engineers, establishing secure design patterns, and communicating risk and tradeoffs to engineering and product leadership.
 * Get deployed to Snap's most difficult security challenges that span multiple teams and systems, and independently navigate the technical and organizational complexity to drive them to resolution.