Senior Principal Offensive Security Researcher

Your next project could be anything from secure systems design, static and dynamic analysis of a multi-node Java infrastructure, to writing a fuzzer for an undocumented network protocol or the grammar of a new programming language, to analysis and reverse engineering of firmware used in the thousands of servers supporting our cloud services.

Other responsibilities include:

• Designing and evaluating complex systems for computer security
• Scope and execute security assessments and vulnerability research
• Perform in-depth security assessments using results from static and dynamic analysis
• Create testing tools to help engineering teams identify security-related weaknesses
• Collaborate with engineering teams to help them triage and fix security issues
• Mentor members of the team in computer and software security as a role model and team leader

What You’ll Bring:

• Bachelor’s or Master’s degree in Computer Science or related field (e.g. Electrical Engineering)
• 15+ years of relevant experience in one or more of the following areas: software/product security assessments, penetration testing, red teaming, web application assessments
• Interest in vulnerability research and exploit development – leading groups of 5 -10 engineers past experience required
• Understanding of operating systems, CPU instruction sets and their associated security designs
• Understanding of exploit mitigations (DEP, ASLR, CFG, PAC, CET, etc.)
• Demonstrable experience in designing and evaluating complex systems for security
• Aptitude for self-study, setting and achieving long term goals (for example, learning an unfamiliar programming language)
• Ability to effectively assess and communicate risks and appropriate levels of urgency to management and engineering staff
• Excellent organizational, presentation, verbal, and written communication skills; strong writing skills are required

Nice to Have:

• Experience working in a large cloud or Internet software company
• Proficiency with multiple programming languages, preferably Go, Java, Python or C/C++
• Ability to perform manual source code reviews in one of the aforementioned languages, or assisted review with code analysis tools such as CodeQL
• Experience navigating and working with extremely large codebases is also highly desirable
• Experience using common security assessment tools and techniques in one or more the following categories: Mobile Application Assessment (iOS / Android), Reverse Engineering (e.g. IDA Pro/Ghidra/Frida), Fuzzing (e.g. Jazzer/AFL/Peach), Web Application assessment (e.g. Burp Suite Proxy, ZAP, REST API testing)
• Proven experience with security research including any published CVEs
• Experience developing proof of concept exploits bypassing modern exploit mitigations
• Active participant or organiser of Capture The Flag competitions
• Knowledge of common vulnerabilities in different types of software and programming languages, including: How to test for/exploit them, Real world mitigations that can be applied
• Familiarity with vulnerability classification frameworks (e.g. OWASP Top 10, CVSS, MITRE CVE)

What We’ll Give You:

• A team of very skilled and diverse personnel across the globe
• Ability to work in a hybrid work environment
• Exposure to mind-blowing large-scale cutting-edge systems
• The resources of a large, global operation while still having the small, start-up feel of a smaller team day to day
• Develop new skills and competencies working with our vast cloud product offerings
• Ongoing extensive training and skills development to further your career aspirations
• Incredible benefits and company perks
• An organization filled with smart, enthusiastic, and motivated colleagues