Staff Product Security Engineer, Crunchyroll
$221-277k
+ Annual performance bonus earning potential
Streaming service for anime and manga
Be an early applicant
Streaming service for anime and manga
1001+ employees
Be an early applicant
$221-277k
+ Annual performance bonus earning potential
1001+ employees
Company mission
To create experiences for anime and manga fans, and to enable them to connect through the content they love.
Role
Who you are
- Binary Application Construction: Solid understanding of how applications are constructed, including compilers, linkers, dynamic loaders, ABI interaction, and executable formats (ELF, Mach-O, PE)
- Game Engine & Anti-Cheat Security: Solid understanding of Unity (IL2CPP) and Unreal Engine security architectures. Experience designing defenses against game-specific attacks: memory editors (GameGuardian), speed hacks, wallhacks, and protecting asset integrity (AssetBundles)
- Cryptography & Chain of Trust: Comprehensive experience with cryptographic primitives (hashing, digests) and Public Key Infrastructure (PKI), including managing digital certificates and establishing chains of trust for code signing and secure boot
- Anti-Tamper & Ecosystem: Proven track record evaluating and implementing commercial shielding (Promon, Guardsquare, Verimatrix) and platform attestation (Google Play Integrity, Apple App Attest) for both apps and games
- Content Protection & DRM: Experience with Google Widevine, Apple FairPlay, and Microsoft PlayReady, including HDCP enforcement and screen recording prevention
- Reverse Engineering & Analysis: Hands-on experience with tools (IDA Pro, Ghidra, Frida, Il2CppDumper) to simulate attacks, analyze game logic, and validate the resilience of binary protections
- TBD: Mobile Security Standards: Relevant certifications OWASP MASVS and the OWASP Mobile Top 10, with the ability to map these standards to engineering roadmaps
- Web & Network Security: Experience securing web standards within application contexts, including HTTPS/TLS, cookie security (Secure, HttpOnly, SameSite), local storage, and Content Security Policy (CSP)
- Hybrid App & WebView Security: Expert handling of WebView bridges (WKWebView), ensuring secure data exchange between native and web contexts
- Hardware-Backed Security: Experience utilizing TEEs (Secure Enclave, TrustZone, TPM) for secure key storage, cryptographic operations, and offline license management
- DevSecOps & Supply Chain: Experience automating security (SAST/DAST) within CI/CD pipelines and managing third-party SDK risks (supply chain attacks)
What the job involves
- Crunchyroll is growing and changing, presenting unique challenges and opportunities to support millions of anime fans around the world
- The Fan Experiences Services & Tools team provides seamless help to our partners and internal stakeholders, ensuring an exceptional experience for all Crunchyroll fans
- Our charter is focused on helping our internal and external teams around the world integrate, test, and deploy the Crunchyroll applications quickly and with the highest levels of quality
- We do this with tools and infrastructure that optimize the developer experience
- We tie it all together with sophisticated automated testing and productivity solutions designed to support our culture of experimentation, autonomy and ownership
- Our goal is to focus on delivering the best possible anime fan experience
- Security Strategy & Leadership: Lead, mentor, and grow the Application Security team. Define the long-term roadmap for Mobile, Desktop, and Game security to proactively mitigate reverse engineering, piracy, and cheating
- Binary Defense Architecture: Oversee the design and implementation of binary protection strategies. Direct the evaluation and integration of anti-tamper, obfuscation, and RASP solutions (e.g., Promon, Guardsquare) ensuring minimal impact on game FPS, app performance and user experience
- Game Integrity & Anti-Cheat: Collaborate with game studios to design "server-authoritative" economies and implement client-side detections for memory manipulation, touch macros, and modded APKs
- Trust & Identity Management: Architect robust chains of trust for the ecosystem. Manage code signing certificates, secure boot processes, and the integration of hardware-backed storage (TEE) for sensitive keys
- Vulnerability Research & Validation: Lead internal or external "red team" initiatives using reverse engineering tools (IDA Pro, Frida) to simulate attacks against our apps and games. Validate the effectiveness of binary defenses and attestation checks before release
- Content Protection Engineering: Collaborate with media engineering to harden DRM implementations (Widevine, FairPlay). Ensure secure handling of media keys and enforce output protection (HDCP)
- In the role of Staff Product Security Engineer, you will report to the Senior Director of Fan Experience Engineering Service & Tools
Our take
In recent decades, anime - encompassing Japanese, Korean, and Chinese animation 0 has transitioned from a niche interest to a formidable industry, boasting a global market worth approximately $30B. Despite this growth, distribution has historically posed challenges, with series and films often reaching overseas audiences through disparate channels, if at all. Crunchyroll emerged to address this issue by consolidating the largest collection of anime into a single streaming service.
Sony's acquisition of Crunchyroll in 2021 for $1.75B expanded the platform's reach, integrating Sony's extensive animation library into its offerings. this move also positioned Crunchyroll for heightened competition against streaming giant Netflix, known for its substantial investments in anime production and acquisition. Currently, Crunchyroll maintains an unrivaled library of anime content, boasting over 44,000 episodes that have attracted over 0M paying subscribers.
While Crunchyroll initially offered a free, ad-supported tier to its vast community, it appears poised to phase out this option, transitioning to a subscription-based model for all new series. Despite this shift, the platform has implemented a global reduction in fees to stimulate subscription uptake. The success of this strategy remains to be seen, but past experiences with companies like Hulu suggest that it may drive subscription growth and mitigate piracy
Steph
Company Specialist at Welcome to the Jungle
Insights
Company
Funding (2 rounds)
Mar 2010
$0.8m
EARLY VC
Feb 2008
$4.1m
SERIES A
Total funding: $4.9m
Company benefits
- Receive a great compensation package including salary plus performance bonus earning potential, paid annually
- Flexible time off policies allowing you to take the time you need to be your whole self
- Generous medical, dental, vision, STD, LTD, and life insurance
- Health Saving Account HSA program
- Health care and dependent care FSA
- 401(k) plan, with employer match
- Employer paid commuter benefit
- Support program for new parents
- Pet insurance and some of our offices are pet friendly!
Company HQ
Miracle Mile, Los Angeles, CA
Leadership
Kun Gao
(Co-Founder & CEO)Co-founded Crunchyroll in 2006 and served as CEO/General Manager/Board Member until 2018. Previously the founder and CTO of Frappr.com as well as a Product Engineer at HOT or NOT.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 31 more jobs at Crunchyroll