Offensive Security Engineer, Zoom
Workvivo
More information about location
Video-focused online communications platform
Be an early applicant
Video-focused online communications platform
1001+ employees
Be an early applicant
More information about location
1001+ employees
Company mission
To make video communications frictionless and secure.
Role
Who you are
- Have very good experience completing penetration test (focused on Web Applications, API and Mobile)
- Able to critically analyse Vulnerability & Penetration test reports from external partners and customers
- Can go beyond highlighting Security Headers and low hanging fruit as a vulnerability and critically challenge security vulnerabilities
- Have the ability to produce Architectural diagrams with a focus on the security control plane
- Have experience in application security, software development, or related areas with a good understanding of secure coding practices and application security frameworks
- Have good knowledge of AWS
- Comfort with using Burpsuite / Invicti (Netsparker) and similar tooling
- Have proficiency in a programming languages (such as PHP, Laravel, Go, Java, C++, etc.). Knowledge of security tools (e.g., Burp Suite, OWASP ZAP), and familiarity with security protocols and encryption methods
- Can go beyond highlighting Security Headers and low hanging fruit as a vulnerability. Are able to critically analyze Vulnerability & Penetration test reports from external partners and customers
- Have excellent attention to detail, a sense of curiosity and ability to focus, and are comfortable discussing the latest security technology. Written and verbal communication skills, with the ability to explain complex security issues to both technical and non-technical audiences
What the job involves
- In this role, you’ll focus on uncovering and addressing vulnerabilities across the Workvivo platform, including our Web App, Mobile App, Mobile and AWS Infrastructure
- You will be responsible for identifying and mitigating security vulnerabilities within software applications through building security tools, code reviews, penetration testing, and security assessments
- We’re looking for people who will work closely with application engineering teams to ensure secure coding practices are integrated throughout the software development lifecycle, preventing security risks before they emerge. You will also provide security guidance to developers and other stakeholders, fostering a culture of security awareness within the organization
- In this position, you’ll have the opportunity to make a meaningful impact on the security of both Workvivo and Zoom. This includes contributing to our engineering security training program and collaborating cross-functionally within Zoom Security, including teams like Bug Bounty, Incident Response, SOC, Vulnerability Management, and Customer Security Assurance (CSA)
- Conducting regular security assessments, code reviews, and penetration testing to identify vulnerabilities in applications and software associated with the Workvivo Platform. Including, AWS Infrastructure and the Workvivo Application (Web App, Mobile App)
- Discovering vulnerabilities associated with the Workvivo platform and associated infrastructure and work with Workvivo's/ZOOM's internal teams. Working daily with the Security, AWS Infrastructure & Application engineering teams and ensure Security, Scalability and Stability
- Prioritising the threat modeling of new security features before they are deployed. Conduct threat modeling and risk assessments to proactively identify potential risks and develop mitigation strategies. Thus, working with Application engineering (and other teams) as early as possible in the design phase
- Contributing to improving the SDLC such as advising on DAST, SAST, SCA, i.e., securing the Pipeline etc and introduce code automated security solutions
- Contributing to improving security across Workvivo & Zoom, including feeding into the Engineering Security training program
- Working cross functionally within Zoom Security, e.g. Bug Bounty, Incident Response, SOC, Vulnerability Management, Customer Security Assurance (CSA) etc
- Introducing and coding automated security solutions
Application process
- End Date: April 9, 2025
Our take
Zoom reworked video conferencing when most people assumed it was a solved problem, with services from Cisco and Skype already ubiquitous in workplaces and homes. However, its videoconferencing infrastructure was simpler to use, faster and more flexible than any previous solution, and it swiftly took the world by storm.
Its success bred competition, however, and companies such as Microsoft and Google, along with numerous smaller communications firms, have begun making inroads on Zoom's formerly commanding lead. Additionally, as workplaces are mostly adopting a hybrid or flexible working strategy, some of its importance as a workplace tool is wearing off and it is recording a gradual decline in daily usage rates.
To counter these trends, Zoom is expanding its business offerings through product development and strategic aquisitions, such as that of Solvvy (an AI and automation service) in 2022. It remains to be seen if this will be enough to turn things around for Zoom: along with many other large tech companies it has recently engaged in large-scale layoffs to realign itself with a difficult economic situation. Still, it is a profitable company and a household name, and its track record of innovation means it is still very much one to watch in the communications space.
Freddie
Company Specialist at Welcome to the Jungle
Insights
7% employee growth in 12 months
Company
Funding (last 2 of 5 rounds)
Jan 2017
$100m
SERIES D
Feb 2015
$30m
SERIES C
Total funding: $148.5m
Company benefits
- Work from home opportunities
- Retirement benefits
- My-Time-Off (MTO), an extended vacation policy
- Employee Stock Purchase Plan (ESPP) and Restricted Stock Unit (RSU) Equity Program plus Yearly stock grant for all employees
- Wellness and fitness reimbursement, wellness resources, Thrive Global wellness app, TaskHuman wellness coaching app
- Employee Assistance Program (EAP) including emotional support, financial resources and legal guidance
- Paid Parental Leave (both parents) 16 weeks paid leave (or statutory if more generous)
- Employer Matching of Charitable contributions up to $500 USD equivalent/year
- Annual Zoom Store Allowance
- Business Travel Accident Insurance
Company HQ
Downtown San Jose, San Jose, CA
Leadership
Eric Yuan
(CEO)Previously VP Engineering at Cisco and WebEx.
Share this job
View 37 more jobs at Zoom