Staff Product Security Software Engineer, Quora
$155.7-267.6k
Salary applies to US based candidates + Equity. For Canada based applicants, the salary range is $188,760 - $278,168 CAD + Equity
A place to share knowledge
Be an early applicant
A place to share knowledge
1001+ employees
Be an early applicant
$155.7-267.6k
Salary applies to US based candidates + Equity. For Canada based applicants, the salary range is $188,760 - $278,168 CAD + Equity
1001+ employees
Company mission
To share and grow the world's knowledge.
Role
Who you are
- Sweat The Right Details: you thrive in understanding the details but will also know to ruthlessly prioritize the critical issues
- Right-Size The Solution: you recognize guidelines and framework do not always fit the problem and know how to adjust the solution for scalability not always at-scale
- Ownership: you are outcome focused and can deftly navigate obstacles, decompose complexities, manage your time and can communicate your vision to peers and management
- An Ideal Candidate Would be a capable software engineer while also possessing the following domain expertise:
- Secure Web Application Development: You are proficient in developing secure web applications and APIs, with a strong understanding of OWASP Top 10 and other common web vulnerabilities such as XSS, CSRF, SQL Injection, and clickjacking. You have experience implementing mitigations such as Content Security Policies (CSP), SameSite cookies, and secure HTTP headers. You are adept at building secure authentication and authorization mechanisms, including OAuth, OpenID Connect, SAML, and JWTs
- Client-Side Security: You have expertise in improving the security posture of client-side web applications. You understand the nuances of browser extensions, sandboxing, and JavaScript security. You are knowledgeable about secure JavaScript frameworks. You can identify and mitigate attacks like DOM-based XSS and other client-side vulnerabilities
- Cross-Browser Compatibility and Privacy: You are familiar with the intricacies of cross-browser compatibility and the security implications of browser-specific features. You are passionate about advancing privacy-respecting features in web applications, such as implementing proper cookie handling, using privacy-preserving APIs, and reducing fingerprinting risks. You follow developments in browser security policies like SameSite, Secure, and HttpOnly cookies
- Performance and Security Tradeoffs: You understand the fine balance between performance optimization and security requirements in web applications. You can implement advanced security measures,You are skilled in analyzing and mitigating the impact of security features on page load times, caching, and scalability
- Security Testing and Tooling: You have hands-on experience with security testing tools such as Burp Suite, ZAP, or browser developer tools for identifying vulnerabilities in web applications. You can write custom scripts to automate browser-level security testing and have experience with fuzzing and penetration testing for browsers and web technologies
- Emerging Web Standards and Protocols: You stay ahead of the curve by following developments in emerging web standards and protocols like HTTP/3, WebAuthn, and the latest advancements in TLS. You are excited about contributing to the evolution of secure web technologies and implementing these advancements in production environments
What the job involves
- You will be a key member of the newly created Security Engineering Team, with a mission to keep Quora safe from security problems by building robust protections around our products, infrastructure and people
- Our small engineering team works on challenging problems every day. We have a culture that's rooted in constantly learning and improving, and our engineers are encouraged to think big and experiment with new ideas
- Availability for meetings and impromptu communication during Quora's "coordination hours" (Mon-Fri: 9am-3pm Pacific Time)
- Provide security guidance to engineering teams and work with privacy, product and engineering teams on securing customer data
- Perform security software architecture review and integrate threat modeling and abuse cases into the SDLC; Advise and implement secure software architecture patterns
- Drive the development and implementation of standard security review processes across the company that result in effective methods for reducing security risks before product releases
- Build features or application security tools within existing development, build, and deployment processes to ensure strong security in Quora product
- Conduct dynamic & static code scan reviews and run-time tests
- Assist with the planning and execution of application penetration tests
- Conduct initial incident triage; determine scope, urgency, and potential impact of security incidents; lead and coordinate the incident response process
Our take
The vast majority of human knowledge is still not on the internet. Most of it is trapped in the form of experience in people's heads, or buried in books and papers. Quora is changing this.
For a decade now, Quora has been carefully cultivating an intelligent question-and-answer community; it’s quietly becoming a database of some of the most thoughtful and useful content on the web.
With its steadily increasing number of monthly users and a revenue stream funded by advertising and subscriptions, Quora is now worth over a billion dollars. It is further building on this success with the introduction of AI functionality, which allows subscribers to ask questions to bots powered by OpenAI and Anthropic models.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
7% employee growth in 12 months
Company
Funding (last 2 of 6 rounds)
Jan 2024
$75m
LATE VC
May 2019
$60m
SERIES E
Total funding: $361m
Company HQ
Old Mountain View, Mountain View, CA
Leadership
Adam D'Angelo
(Founder & CEO)Previously studied Computer Science at Caltech before working for Facebook, becoming CTO in 2006 until he co-founded Quora in 2009.
Share this job
View 14 more jobs at Quora