Security Engineer

Role overview

Security Engineer responsible for security design and reviews across Zoom products and services. You’ll collaborate with engineering teams as a trusted security advisor to design, implement, and validate secure solutions, with a focus on new features and security enhancements.

Responsibilities

• Guide engineering teams in end-to-end secure system design and implementation as a subject-matter expert
• Perform threat modeling, architecture reviews, security code reviews, security assessments, and security testing across:
  • web applications
  • native applications
  • web services
  • cloud-based services
  • infrastructure
• Conduct cloud infrastructure security reviews, with primary focus on AWS permissions/configuration (e.g., IAM and S3)
• Perform in-depth security reviews of new Zoom features and functionality, including identifying risks such as:
  • OWASP Top Ten issues
  • common issues from NVD
  • vulnerabilities like RCE
• Review Java and/or Python code and validate security posture through manual and automated testing, using tools such as Burp Suite and Coverity
• Identify gaps in existing cloud security architecture design/configuration and recommend improvements (e.g., authentication, authorization, network segmentation, container configuration, bastion host setup)
• Provide hands-on security training and teach secure coding best practices to engineering teams

Requirements

• Bachelor’s degree (Computer Science/InfoSec/Cybersecurity/etc.) or equivalent experience
• 5+ years of security experience
• Extensive experience in security testing across web applications, native applications, distributed systems, and cloud infrastructure (AWS)
• Strong foundation in software security architecture, secure design, threat modeling, secure code review, cryptography, and SDLC
• Ability to communicate application security best practices and mitigations, including SDLC exceptions
• Hands-on experience with AWS and core AWS services/components
• Ability to identify security gaps at both design and configuration levels
• In-depth knowledge of network/system/application-layer attacks and mitigations
• Knowledge of network and application security (including OWASP), infrastructure hardening, security baselines, web server/database security, and applied cryptography
• Development experience in Java (required) and/or other languages/platforms

Compensation

• $98,900 – $228,700 USD / year (base/OTE range as stated)
• Additional Total Direct Compensation includes base salary, bonus, and equity value