The Wikimedia Foundation is looking for a Senior Software Engineer to join the Product Safety and Integrity team and build new security features to protect Wikipedia and our other projects from attacks and abuse.
Requirements
- 5+ years of experience as a software engineer, ideally with focus on security
- Ability to work effectively in a modern PHP and JavaScript codebase
- Experience in developing secure software or security-related product features
- Experience working on anti-abuse mechanisms such as CAPTCHA and bot detection
- Previous experience building security countermeasures against attacks on technologies at the web, backend, and database level
- Experience finding and fixing security bugs and reviewing code for security gaps
- A working knowledge of threat modeling and secure design patterns
Responsibilities
- Helping design, develop, and deliver security features, with safety and security in mind
- Working with other engineering teams to ensure that they make safe architectural and implementation choices
- Developing, reviewing, and deploying security features developed by the Foundation and community members
- Performing security maintenance and addressing technical debt in security-critical components
- Providing support for application security incidents and operations
- Driving technical quality and operational excellence by defining and reinforcing standards in testing, observability, and system reliability
- Comfortably and autonomously creating proofs of concept, writing design documents, and breaking down complex projects into actionable tasks to support less experienced team members
Other
- Timezone preference: GMT-5 through GMT+1
- Leading by example in code review, decision-making, and team culture — fostering transparency, empathy, and collaboration
- A strong interest in working with a talented security team and learning more specialist security skills such as exploiting and mitigating application-level vulnerabilities
- Ability to explain complex security issues and their implications on privacy and risk to non-technical audiences
- Sensitivity to the security challenges faced by participants in a large, international project
