Discord is looking to advance its mission of protecting users and systems by hiring a Staff Security Engineer to reduce security risk across Engineering, focusing on identity and access management, code shipping, cloud infrastructure configuration, and service operations.
Requirements
- You have 7+ years of experience building and operating production systems and infrastructure.
- You have 5+ years of experience writing software in at least one general-purpose programming language (we mainly use Python and Rust).
- You have 4+ years of experience securing systems with millions of users.
- You have designed and built user-facing software for customers beyond your immediate team.
- You have experience securing cloud-based environments (e.g. GCP, Cloudflare).
- You have experience with technologies for defining and orchestrating containers (e.g. OCI, Docker, Distroless, Kubernetes).
- You understand modern authentication and authorization protocols and concepts (e.g. RBAC, OAuth 2.0, OIDC/SAML, Zero Trust network architectures, mTLS).
Responsibilities
- Guide strategy and lead software engineering projects on a small, highly-autonomous, horizontally-integrated security team with a lot of leverage.
- Consult on risk assessments, architectural designs, threat models, code reviews, and more—pragmatically balancing security with other business considerations.
- Develop and apply best-in-class secure baselines for cloud and bare-metal resources.
- Secure our first- and third-party software supply chains, from a developer’s laptop through version control and CI/CD and into production.
- Build and own IAM systems that are user-friendly and promote least privilege.
- Manage third-party vulnerabilities while supporting rapid growth for Product Engineering.
- Partner cross-functionally for security monitoring and incident response.
Other
- You have been the tech lead for projects involving 3+ engineers and spanning multiple quarters.
- You have experience with build and CI/CD technologies (e.g. Bazel, Buildkite, Terraform).
- You have a system to discover industry tools that can multiply your team’s impact.
- You have experience securing multi-cloud environments.
- You have led complex migrations or risk management programs across an engineering organization.
