Application Security Engineer (Security Consulting)

Job Description

Who We Are

The Information Security (InfoSec) team is a blend of security engineers and security-focused software engineers helping ensure Twitter builds and maintains secure software. In addition we consult, develop tooling, and advocate and train engineers throughout the SDLC to ensure security is prioritized at each step of development.

What You’ll Do

As a Security Engineer, you'll join a team of talented security engineers working to reduce risk across the company. We work as consultants across the organization to identify risk and impact to the company, and communicate that impact to teams and management. We identify recurring classes of security problems, find the root cause, and develop generalized solutions. We strive to advocate and teach security to engineers. Additionally, we assist with third-party security assessments and operate Twitter’s bug bounty program.

Who You Are

The ideal individual has both application security expertise and development experience. They have in-

depth knowledge of application security and can identify potential risks in designs, code, or in deployed applications. They should also have experience with threat modeling and providing security guidance to development teams. They recognize the importance of building security solutions that scale both technically and organizationally, and adapt to changing business requirements. They enjoy advocating security by writing, giving talks, or hosting educational sessions for developers.

Qualifications

You will meet most (but need not meet all) of the following points:

• Undergraduate degree or equivalent.
• 4+ years of relevant experience.
• Experience building tools and processes to reliably identify security issues and logic flaws across large code bases.
• Understanding of security challenges in service architectures or large distributed systems.
• Expertise with browser security controls and web application security best practices.
• Knowledge of two or more programming languages, including at least one of: Java, Python, JavaScript, Scala, Go, or Ruby.
• Knowledge of unique security risks and capabilities with IaaS, PaaS, and SaaS.
• Experience communicating security concerns and issues to non-technical audiences.

***Role can be located in Seattle, WA/San Francisco, CA/Boulder, CO Twitter offices.

We are committed to an inclusive and diverse Twitter. Twitter is an equal opportunity employer. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, age, disability, veteran status, genetic information, marital status or any other legally protected status