Application Security Engineer, Proton

• Proven experience in organizing and executing penetration tests/red team operations
• A proactive and creative application security engineer
• A proactive and creative mindset to come up with efficient and effective ways to continuously improve the security of our products
• Expertise in threat modeling
• Experience with at least two of the following:
• IOS
• Android
• Windows
• MacOS
• Linux
• Strong skills in coding and code review for at least two of the following:
• Go
• Rust
• Python

Desirable

• The Security team is tasked with protecting Proton’s and its users against various cyber-security threats
• We ensure the confidentiality, availability and integrity of thousands of assets, necessary to the fulfillment of Proton’s privacy mission
• Since 2018, the team has been providing services to other business units, including security monitoring, risk management, internal advisory, product security, vulnerability management and identity & access management
• Our mandate includes the protection of people, devices, applications, infrastructure, data, software and our products
• We work mainly with on-prem infrastructure and open source tools
• The security team is small yet mighty
• We are a close-knit group of people who work hard to help Proton achieve its mission
• We strongly believe that we cannot protect our users' privacy if we do not protect the company's security
• Proton currently offers the following products: Mail, Calendar, VPN, Pass, Drive, each of which is available on multiple platforms, including Windows, MacOS, iOS and Linux
• Our infrastructure is entirely composed of Linux machines
• Wherever we can, we make use of open-source technologies
• You will be leading our efforts to ensure that Proton's applications are secure:
• Perform penetration tests on Proton products, both those released to the public and not
• Support bug bounty triage by reproducing submissions and assessing their potential impact
• Working with engineering teams to remediate identified bugs
• Identifying and implementing improvements in product security and secure coding
• Work with the wider Security and developer units to create security guidelines
• Demonstrate the value of an “assume breach” mentality
• Perform threat modeling and security reviews: review the design of services from a security perspective to identity vulnerabilities and weaknesses in the architecture and design