Staff Security Engineer, Product Security

About the Role

The role of a Staff Security Engineer is critical in today's digital landscape, where cybersecurity threats are becoming increasingly sophisticated. At Mozilla, you will have the opportunity to work on a wide range of products, from the popular Firefox browser to the Mozilla VPN. Your expertise will help shape the security posture of these products, ensuring that they meet the highest standards of security and privacy.

Mozilla's commitment to security and privacy is unwavering, and as a Staff Security Engineer, you will be part of a team that is passionate about making a difference. You will have the opportunity to work with a talented group of individuals who are dedicated to creating products that prioritize users' security and privacy.

What You Will Do

• Safeguard millions of users by embedding security into Firefox, Mozilla VPN, and other mission-critical products.
• Ensure software products are secure by embedding security into the full Software Development Life Cycle (SDLC).
• Anticipate, prioritize, and mitigate risks through proactive threat modeling, security assessments, security testing, and automation.
• Perform security code reviews to identify vulnerabilities and provide recommendations for remediation.
• Lead penetration testing on web, mobile, and embedded applications, then guide remediation efforts.
• Develop and maintain automated security tests within CI/CD pipelines to catch vulnerabilities early.
• Partner with engineers to integrate security throughout the software development lifecycle.
• Provide security guidance, develop secure solutions, and facilitate secure releases.
• Help define and enforce security policies and provide security guidance to development teams.
• Help shape Mozilla's security culture through collaboration, guidance, and education.

What We Are Looking For

• Expertise in secure coding practices, application security tools (SAST, DAST), and a strong understanding of modern architecture, cloud environments (AWS, Azure, GCP), and various programming languages.
• 5+ years of experience in security engineering, with a focus on application security and secure coding practices.
• Strong understanding of cloud security, including AWS, Azure, and GCP.
• Experience with security testing, including penetration testing and vulnerability assessments.
• Excellent communication and collaboration skills, with the ability to work effectively with cross-functional teams.
• Strong problem-solving skills, with the ability to analyze complex security issues and develop effective solutions.
• Experience with automated security testing and CI/CD pipelines.

Nice to Have

• Experience with machine learning and artificial intelligence security.
• Knowledge of privacy engineering and data protection.
• Familiarity with containerization and container orchestration (e.g., Docker, Kubernetes).
• Experience with security compliance and regulatory frameworks (e.g., GDPR, HIPAA).

Benefits and Perks

• Competitive salary and benefits package.
• Opportunity to work on high-impact projects that make a difference in the lives of millions of users.
• Collaborative and dynamic work environment with a talented team of professionals.
• Flexible working hours and remote work options.
• Professional development opportunities, including training and conference sponsorships.
• Access to the latest technologies and tools.
• Recognition and rewards for outstanding performance.

• Develop a strong foundation in secure coding practices, including knowledge of common web application vulnerabilities and secure coding guidelines.
• Build a portfolio of your security work, including examples of secure code, vulnerability assessments, and penetration testing reports.
• Stay up-to-date with the latest security trends and technologies, including cloud security, containerization, and machine learning.
• Practice your communication and collaboration skills, as security engineers must work effectively with cross-functional teams.
• Consider obtaining security certifications, such as CISSP or CEH, to demonstrate your expertise and commitment to the field.
• Be prepared to provide specific examples of your security experience and skills during the interview process.
• Research the company's security culture and be prepared to discuss your thoughts on security best practices and how you can contribute to the company's security posture.