Security Engineer

Location

San Jose, CA (5 days onsite from day 1)

Note: 2nd interview will be in-person in San Jose, CA.

Experience Required: 50% Security + 50% Coding Experience

[[JD_HEADING:Job Description

Role Overview]]

Support the Search Engineering team by managing vulnerability lifecycles, ensuring secure architectural practices, and overseeing automated fix validations.

Key Responsibilities

1. Threat Modeling & Asset Profiling

• Document trust boundaries, data flows, and architectural entry points for high-priority services.
• Maintain up-to-date threat profiles in centralized repositories.

2. Vulnerability Triage & Policy Management

• Review and filter scanner findings, Classify severity and evaluate exception requests against security policies.

3. Reproduction & PoC Validation

• Construct minimal test environments/harnesses to validate reported findings and Confirm viable vulnerabilities versus false positives.

4. Automated / Agentic Fixer Oversight & QA

• Supervise and validate code patches generated by automated remediation agents, Execute tests and inspect diffs for regressions.

5. Product Team Coordination & Closure

• Route validated patches to code owners and Shepherd fixes through code review to production deployment.

Technical Skills

Must-Have Skills

• Understanding of architectural trust boundaries, attack surfaces, data flows, and threat modeling frameworks (e.g., STRIDE, PASTA).
• Working knowledge of common vulnerability classifications (CWE, CVE, OWASP Top 10) and SLA mapping.
• Proficiency in reading and writing code in at least two core languages (C++, Go, Java, Python) and building test harnesses/PoCs.
• Strong code review skills (identifying regressions, hallucinations) and knowledge of secure coding standards.

Nice-to-Have / Advanced Skills

• Experience with threat model reviews for large distributed / microservices architectures.
• Experience managing vulnerability queues, automated scanning tools, and compliance exception reviews.
• Practical experience with fuzzing, unit test frameworks, sandbox execution, and cross-boundary debugging.
• Experience prompt-tuning automated code generation tools, differential testing, and patch validation.