Staff Security Engineer, Product Security

About the Role

The Mozilla Corporation is driven by its mission to make the internet better for people, and this role is central to achieving that goal. With millions of users worldwide, the company's products and services are used by people from all walks of life, making the work of a Staff Security Engineer both challenging and rewarding. You will be working in a remote-friendly environment, collaborating with a diverse group of professionals who are passionate about creating a safe and private internet experience for all.

What You Will Do

• Safeguard millions of users by embedding security into Firefox, Mozilla VPN, and other mission-critical products
• Ensure software products are secure by embedding security into the full Software Development Life Cycle (SDLC)
• Anticipate, prioritize, and mitigate risks through proactive threat modeling, security assessments, security testing, and automation
• Perform security code reviews
• Lead penetration testing on web, mobile, and embedded applications, then guide remediation efforts
• Develop and maintain automated security tests within CI/CD pipelines to catch vulnerabilities early
• Partner with engineers to integrate security throughout the software development lifecycle
• Help define and enforce security policies and provide security guidance to development teams
• Help shape Mozilla's security culture through collaboration, guidance, and education

What We Are Looking For

• Expertise in secure coding practices, application security tools (SAST, DAST), and a strong understanding of modern architecture, cloud environments (AWS, Azure, GCP)
• Strong understanding of various programming languages
• Experience in performing security code reviews and penetration testing
• Ability to develop and maintain automated security tests within CI/CD pipelines
• Excellent communication and collaboration skills to work effectively with cross-functional teams
• Strong problem-solving skills with the ability to analyze complex security issues
• Experience in shaping and enforcing security policies and providing security guidance to development teams
• Passion for creating a safe and private internet experience for all users

Nice to Have

• Experience with cloud security and compliance frameworks
• Knowledge of machine learning and AI-driven security solutions
• Experience in security awareness and training programs
• Participation in bug bounty programs or Capture The Flag (CTF) challenges

Benefits and Perks

• Opportunity to work with a pioneering company that has shaped the internet for the better over the last 25 years
• Collaborative and dynamic work environment with a team of passionate professionals
• Flexible and remote work arrangements
• Access to cutting-edge technologies and tools
• Professional development opportunities to enhance your skills and career growth
• Comprehensive benefits package, including health insurance, retirement plans, and paid time off
• Chance to make a real impact on the internet and the lives of millions of users worldwide
• Recognition and rewards for outstanding performance and contributions to the company's mission
• A culture that values openness, transparency, and community involvement
• Support for ongoing education and training in the field of cybersecurity and related technologies

• Develop a strong portfolio that showcases your security engineering skills, including examples of secure coding practices and successful penetration testing engagements.
• Highlight your experience with application security tools, such as SAST and DAST, and demonstrate your ability to integrate security into the full software development lifecycle.
• Prepare to discuss your approach to threat modeling, security assessments, and risk mitigation, and be ready to provide examples of how you have applied these skills in previous roles.
• Emphasize your ability to communicate complex security issues effectively to non-technical stakeholders, and demonstrate your experience in collaborating with cross-functional teams.
• Research Mozilla's products and services, and be prepared to discuss how your skills and experience align with the company's mission and goals.
• Be prepared to discuss your experience with cloud security and compliance frameworks, and demonstrate your knowledge of machine learning and AI-driven security solutions.
• Show your passion for creating a safe and private internet experience for all users, and highlight your commitment to ongoing education and training in the field of cybersecurity.