Senior Security Engineer, Trail of Bits
Application Security
$150-200k
+ Performance-based bonuses
Relocation assistance
Security engineering firm
Be an early applicant
Security engineering firm
21-100 employees
Be an early applicant
$150-200k
+ Performance-based bonuses
Relocation assistance
21-100 employees
Company mission
To help secure the world's most targeted organizations and products.
Role
Who you are
- Application Security Expertise: Extensive experience in software security, with demonstrated ability to identify and mitigate application and system-level vulnerabilities in code across complex enterprise software and understanding of security controls
- Assessment Experience: Track record of conducting technical security assessments of software, including software and system hardening, security policy analysis, and implementing effective security measures; Experience with Android, iOS, and/or macOS system internals a plus
- Technical Capabilities: Deep understanding of system internals and security boundaries, experience with manual code reviews, static and dynamic analysis tools, expertise in secure development practices, experience with binary analysis and reverse engineering, and understanding of memory corruption vulnerabilities and mitigations
- Programming Proficiency: Strong knowledge of multiple programming languages such as Rust, Golang, Kotlin, Swift, Objective-C, JavaScript/TypeScript, Python, Ruby, C and/or C++ for both security analysis and tool development
- Communication Skills: Ability to effectively communicate complex security concepts to diverse stakeholders and deliver clear, actionable recommendations
What the job involves
- Trail of Bits seeks a Senior Security Engineer, Application Security within our growing Software Assurance practice
- You will conduct comprehensive security assessments of client software with a focus on low-level code analysis, examining system architecture, security boundaries, access controls, and platform security mechanisms
- On any given day, you might analyze vulnerabilities in application code, automate the detection of security misconfigurations in cloud environments, assess privilege escalation capabilities, or review security boundaries in complex systems
- Working alongside other security engineers, you'll contribute to client projects while building impactful tools
- In short, your work will land at the intersection of Vulnerability Research and Application Security
- In addition to working with leading technology companies in the private sector, you will have opportunities to collaborate with our Research & Engineering team to help secure funding from government agencies for advanced security research that bridges vulnerability research and application security, advancing the state of the art both within our team and industry at large
- Security Assessment: Conduct comprehensive low-level code security assessments across applications, examining vulnerabilities in system services, access control implementation, inter-process communication, and platform security controls while developing mitigation strategies
- Security Tool Development: Design and implement custom security tools for automated vulnerability detection, focusing on both application-specific and general security testing needs to bridge the gap between vulnerability research and application security
- Architecture Review: Perform detailed architecture reviews and threat modeling of complex software systems and cloud environments, identifying potential security weaknesses in areas such as data flows, authentication mechanisms, and API security while providing remediation guidance
- Client Engagement: Work directly with industry-leading teams to review their application infrastructure and architecture, helping secure their environments through deep technical analysis and recommendations
- Research & Innovation: Contribute to the advancement of application security, developing new methodologies and tools while staying up to date with the latest security developments in both traditional and emerging technology ecosystems
Our take
As more and more commercial activities go online, companies are increasingly exposed to cybersecurity threats. This requires organizations to get serious about their digital security infrastructure. As a result, the business of cybersecurity auditing has boomed.
Trail of bits is one such auditing firm with a signature method: combining its top-quality research in the cybersecurity field with the approaches of a real-world hacker. Distinguishing itself even further, the company has engaged in a new strategy fit for a new market - blockchain. The cybersecurity firm is now one of the world’s most prominent blockchain code auditors.
It's an exploding niche for which Trail of Bits has also been able to create an entirely new business line. While also auditing on behalf of blockchain software businesses, it is also expanding a service of engaging the government & large financial institutions for work on evaluating the risks of blockchain software.
Trail of Bits is well positioned as a result. Even if, as some commentators predict, the bottom falls out of the blockchain industry, the firm has used the momentum to reinforce its position as a thought leader on cutting-edge technology, establishing important partnerships that will last regardless.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
18% employee growth in 12 months
Company
Funding (last 2 of 5 rounds)
Aug 2023
$4m
SEED
Jan 2018
$0.2m
GRANT
Total funding: $5.4m
Company benefits
- Health Insurance with no-monthly-premiums
- Vision, Dental, Life & Disability Insurance
- Access to Kindbody for gynecology and fertility care
- Access to HealthAdvocate, Teledoc & OneMedical
- 401k with 5% company matching
- Competitive salaries
- Ongoing bonus opportunities
- ConnectYourCare Flex Spending Account (FSA)
- Commuter Benefits
- Fitness stipends
- Four weeks of PTO
- Fifteen company holidays
- 4 months paid parental leave
- End-of-year performance bonus
- Continuing education, public presentations and blog posts
- Recruiting & referrals
- Conferences & off-sites
- Company & team outings
- Virtual events
- Continuing education
- Training sessions & learning courses
- Internal research & development Projects
- Charitable donation matching
- Relocation assistance
- 1Password subscription
- Work from home stipend
- Remote work friendly
Company HQ
Gowanus, NY
Leadership
Dan Guido
(Co-Founder & CEO)Previously a Senior Security Consultant at iSEC Partners. Also worked as Threat Intelligence Lead for the U.S. Federal Reserve System. Former NSA Analyst.
Share this job
View 2 more jobs at Trail of Bits