Staff Security Engineer, Toast

• Minimum 5+ years of experience in application security
• Experience reading, reviewing, and providing security guidance for complex code in a variety of languages and frameworks (Java/Kotlin, Javascript/ES6, React, and Python are a priority), with a strong emphasis on IAM implementations
• Strong understanding of cloud application architecture and common IAM weaknesses (e.g., insecure authentication, authorization flaws, privilege escalation)
• Experience identifying and helping to resolve common application security flaws (e.g., OWASP, SANS) related to IAM
• Successful history of being a subject matter expert to guide products and lines of business to better security outcomes related to IAM
• Previous security experience working with fintech applications and associated IAM requirements
• Strong understanding of privacy, security, and cryptography patterns and when to apply them, especially within IAM (such as PKIs, access management, data tokenization, and anonymization)
• Deep understanding of IAM concepts (e.g., OAuth, OIDC, SAML)

Desirable

• By joining our Product Security team, you'll be part of the kitchen crew that keeps our customers' trust from going stale
• You'll tackle complex challenges that have real-world impact, helping to serve up a safer, more secure digital experience for businesses that count on Toast every day
• It's not just about finding vulnerabilities – it's about crafting a recipe for digital trust that keeps our customers coming back for more
• Identify, triage, and provide remediation guidance for application vulnerabilities, with a specific focus on IAM-related issues
• Select, implement, design, or build tools to manage and secure identity and access across Toast platforms
• Improve developer tooling and adoption to build a more robust SSDLC with respect to IAM best practices
• Practice a #OneTeam attitude to help other Toast teams make informed, security-conscious decisions when building new software with IAM considerations
• Support and expand the Security Champions program, providing IAM-specific training and guidance
• Assist incident response teams with application security expertise and tools, especially related to IAM incidents
• Build threat models on IAM applications and architecture
• Guide in the design and maintenance of secure authentication and authorization mechanisms
• Provide signals for IAM events to the SOC for better alerting and response