Security Engineer, Sourcegraph

• Equal parts engineer and security professional, you are excited about joining a team that is building a world class security system trusted by some of the biggest tech companies in the world
• You and your teammates are Sourcegraph’s first line of defense against bad actors using all the newest and dirtiest tricks to hack us and (more importantly) our customers
• You want to be a part of the foundational team, the first steps we are taking to build something big, something trusted, something critical to software and our customers
• Practical experience securing SaaS applications, including infrastructure security, application security, and/or compliance
• Experience using and automating a wide range of defensive security tools
• Experience developing software as an engineer (i.e., writing code and contributing directly to applications)
• Experience working across engineering teams to support secure coding across the organization
• You are high agency
• You communicate effectively in writing and documentation

Desirable

• As a Security Engineer, you will join our exceptional security team tasked with building world-class security into our product offerings by working on vulnerability management, application security testing and vulnerability scanning automation, bug bounty programs, and security reviews for both application and infrastructure security
• You will proactively improve the security of our codebase, our product, our cloud, and our customers' on-premise deployments
• Within one month, you will…
• You will contribute to the team's goals and deliverables for securing the largest deployment of Sourcegraph (sourcegraph.com), enabling customers to upload private code repositories
• You will discover, fix, and mitigate infrastructure vulnerabilities by updating libraries, base images, and analyzing containers
• You will enhance our application security with audits, best practices, code fixes, and continuous education
• You will perform reactive incident response if a security event occurs
• Within three months, you will…
• You will enhance our security measures and policies to support organizations on sourcegraph.com and ampcode.com
• You will work with other teams to triage, troubleshoot and mitigate customer concerns and questions about our security
• You and your manager will work together on a career plan with actionable goals
• Within six months, you will…
• You will work with other teams and engineers to implement secure coding guidelines and best practices
• You will perform proactive research to detect new attack vectors
• You will perform threat modeling for existing and future applications
• You will assess and integrate new tools and technologies to improve our operational efficiencies
• You will help maintain compliance with SOC 2, ISO 27001 & GDPR standards
• This job is an IC2-IC3

• We expect the interview process to take <5 hours in total
• 👋 Introduction Stage - we have initial conversations to get to know you better…
• [20m] Recruiter Screen
• [30m] Hiring Manager Screen
• [60m] Resume Deep Dive / Technical Screen
• 🧑‍💻 Team Interview Stage - we then delve into your experience in more depth and introduce you to members of the team, including cross-functional partners…
• [60m] Technical Interview: General
• [60m] Technical Interview: Complex Problem Deep Dive
• [45m] Cross-functional Team Collaboration / Values
• 🎉 Final Interview Stage - we move you to our final round, where you gain a better understanding of our business and values holistically…
• [15m] Leadership with co-founder
• We check references and conduct your background check