Staff Application Security Engineer

WHAT YOU'LL DO

Braze is seeking a Staff Application Security engineer to join our team. Braze is a modern, cloud-first, SaaS application company with no classical “legacy” systems. We are seeking a Staff Application Security engineer to work with our existing Application Security team to better protect our production applications and their related application infrastructure, as well as provide expert level guidance to development teams around secure architecture for their systems.

You are a person who is comfortable with, and excels in an environment where you are the sole point of technical escalation for complex, large scale software security projects. You are able to effectively, accurately, and holistically identify security issues in application architecture, in code, and in application running states.

You are an expert at communicating security requirements to developers, technical teams, and non-technical parties. You have developed your tone of delivery for all categories of recipients and have a track record of ensuring mutual understanding for your security implementation requests and assessment of risk. You have a deep understanding of SaaS software development lifecycles. You have strong, pre-formed opinions on how to ensure security in the development cycle while simultaneously creating a condition where technical teams are not burdened by controls. You have experience in both successes and failures in implementation of security controls in both the development cycle and post-production environments, and can articulate implementation importance and reasoning to both high-level engineers, academics, and management.

You are able to handle complex security incidents and escalations as a technical incident commander, and make determinations quickly, accurately, and with a cool head. You have experience with medium to large scale incident response and can process several simultaneous technical and administrative inputs while consistently working towards clear goals for remediation and containment. You are familiar with not only garden variety attack patterns, but have studied and understand TTP’s of advanced threat actors and can visually pattern match data points in order to make accurate predictions about unknowns during incidents.

WHO YOU ARE

An good candidate will have:

• 10+ years of experience securing an application at a company at an IC level or higher
• Demonstrable experience in consistently locating novel security vulnerabilities in web software
• 5+ years experience conducting penetration tests both as a single tester and on a team
• 5+ years of experience in application incident response
• Experience with active testing against AI/LLM integrated web applications and APIs
• Experience with scripting languages and automation
• Direct experience in the triage/validation of vulnerabilities in systems they may not be familiar with, and the ability to properly articulate risk and provide accurate mitigation recommendations
• Ability to read and understand Javascript, Ruby, and Kotlin (Development level proficiency not required)
• 5+ years of experience as an Application Security leader or sole responsible party

An excellent candidate will have:

• Experience with Mail Delivery systems/experience in the MarTech space
• Experience managing a public bug bounty program
• CVE’s or published vulnerabilities, and corresponding conference talks
• Involvement with an open source project
• Experience with the review and risk evaluations of 3rd party integrations
• Experience with mobile application penetration testing (including testing methodologies that include location of security vulnerabilities in applications with pinned certificates)

For candidates based in the United States, the pay range for this position at the start of employment is expected to be between $189,000 and $215,000/year with an expected On Target Earnings (OTE) between $210,000 and $245,000/year (including bonus or commission). Your exact offer may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. In addition to cash compensation, Braze offers full and part-time employees a comprehensive Total Rewards package that includes equity grants of restricted stock (RSUs) so that all Braze employees own a piece of our company.

#LI-Hybrid