below marketmost similar roles pay hereabove market
This role pays more than
98%
of similar roles. Most pay
$148,375–$214,000
— the blue band above.
At the midpoint, this role pays about
$314k
versus about
$181k
for comparable roles.
Based on 240 similar postings.
Employer
About Snap Inc.
Snap Inc. is a technology and camera company, best known for Snapchat, offering visual communication, augmented reality, and advertising products.
Snap Inc. currently has
102 open roles
on FindRole.
Listed pay typically runs
$190,000–$284,000
across 92 roles with salary data.
The Staff Security Engineer, Level 6, Application Security joins the Application Security team to lead security for the runtime powering Snapchat Lenses, Camera Kit, and Spectacles, alongside web clients. This role involves owning the security architecture and roadmap, including threat modeling, JavaScript engine strategy, and hardening script-to-native boundaries. You will design isolation mechanisms like sandboxing and IPC, eliminate web vulnerabilities such as XSS and CSRF, and conduct deep code reviews using AI-assisted fuzzing. Key technical requirements include proficiency in C, C++, and JavaScript, with experience in Python, Go, or Rust. You must possess deep expertise in memory-corruption vulnerabilities, browser architectures, and mobile security models. The work focuses on securing complex runtimes and web-facing code to ensure platform resilience and memory safety.
What does a Security Engineer earn in California?
Median $206450 from 43 postings across 17 companies.
Own the security architecture and roadmap for the Lens runtime, including threat models and JavaScript engine strategy.
Design isolation and containment systems such as sandboxing, process separation, and IPC for the runtime.
Lead web security efforts to eliminate XSS, CSRF, and cross-origin leaks across web clients and embedded content.
Conduct deep code reviews and vulnerability research using AI-assisted testing and fuzzing tools to drive root cause fixes.
Ship memory-safety improvements and exploit mitigations that balance security with performance and developer experience.
Manage the bug bounty program by setting reward criteria, running variant analysis, and building researcher relationships.
Mentor engineers and establish secure design patterns while communicating technical risks to product leadership.
What we're looking for
Bachelor of Science in Computer Science, Engineering, Information Systems, or equivalent years of experience in a related technical field.
9+ years of post-Bachelor’s security engineering experience; or a Master’s degree + 8+ years; or a PhD + 5+ years.
Hands-on experience with native memory-corruption analysis and web security, including shipping security improvements to a browser or embedded runtime.
Strong C and C++ programming, code-review, and debugging skills, plus JavaScript proficiency and experience building security tooling in Python, Go, or Rust.
Deep understanding of memory-corruption vulnerabilities and web-security expertise including XSS, CSRF, CORS, and hardening with CSP and HSTS.
Hands-on vulnerability discovery experience with coverage-guided fuzzing, sanitizers, reverse engineering, and root-cause analysis.
Experience designing or deploying sandboxing, exploit mitigations, compiler hardening, or memory-safe components in performance-sensitive production systems (preferred).
Experience developing, securing, or exploiting browser engines or JavaScript runtimes such as Chromium, V8, WebKit, or Hermes (preferred).