Senior Application Security Engineer at Shutterfly — Remote, USA | Base Career

Full Job Posting

At Shutterfly, we make life’s experiences unforgettable.

We believe there is extraordinary power in the self-expression.

That’s why our family of brands helps customers create products and capture moments that reflect who they uniquely are.

Here

Red Team Operations: Plan and lead offensive engagements against Shutterfly's applications and supporting infrastructure using established offensive and testing techniques — manual web penetration testing, exploitation, fuzzing, and adversary emulation supported by industry-standard offensive tooling — and coordinate with third-party testers when engagements call for it.
Purple Team Collaboration: Work hand-in-hand with the Blue Team throughout every engagement. Share tactics, techniques, and procedures in real time, validate and improve detection and alerting coverage, run collaborative exercises, and convert offensive findings into concrete defensive improvements.
AI-Driven Offensive Security: Augment conventional offensive techniques with AI and LLM-based tooling to accelerate and extend offensive and testing work — reconnaissance, payload and test-case generation, code and configuration review, and exploitation.
Maintain a working understanding of how threat actors are weaponizing AI, and fold that knowledge into engagements and defensive recommendations to keep pace with a rapidly changing threat landscape.
Bug Bounty Program Management: Manage the bug bounty program end to end — triage, impact assessment, risk scoring (CVSS), locating vulnerable code, providing mitigation guidance, thorough re-testing, and refining program policy and scope as needed.
Vulnerability Management: Identify, triage, and drive remediation of application vulnerabilities through manual testing and exploitation, escalating systemic issues to the appropriate engineering teams.
Threat Modeling & Risk Assessment: Lead threat modeling exercises and perform risk assessments for new and existing applications, using offensive insight to prioritize the risks that matter most.
Incident Response: Collaborate with incident response and Blue Team partners to investigate application-related security incidents, applying offensive expertise to scope, reproduce, and understand attacker activity.

Experience running Purple Team exercises or otherwise collaborating directly with defensive/Blue Team functions to improve detection and response.
Full stack web development experience within an active security program.
Experience managing a bug bounty program.
A security certification that demonstrates proficiency in offensive security, network/web/mobile/AD assessments, secure coding, and professional report creation (for example: OSCP, OSEP, CRTO, OSWA, OSWE, GWAPT, GWEB).
Submitted reports to bug bounty programs or VDPs, and you've found a CVE along the way.
Strong command-line and scripting skills (bash, zsh, Python) on Linux and Mac.
Enjoy attending security conferences and occasionally participate in CTFs.
Spend time on cyber security training platforms (HackTheBox, TryHackMe).
Have worked with engineering teams to develop secure code libraries.
Capable of rapidly learning and integrating emerging tools and platforms with minimal supervision.

Supporting a diverse and inclusive workforce is important to Shutterfly not only because it directly reflects our value of Embracing our Differences, but also because it’s the right thing to do for our business and for our people.

We welcome all applicants and evaluate them based on their qualifications.

Learn more about our commitment to Diversity, Equity, and Inclusion on our Career Site.

The compensation package for this role is based on multiple factors, such as job level, responsibilities, location, and candidate experience.

The base pay ranges included below are specific to the locations listed, and may not be applicable to other locations.

California : [$128,000-181,250]

Connecticut and New York: [$128,000-165,750]

Colorado, Illinois, Minnesota and Washington: [$128,000-153,000]

Nevada: [$120,250-165,750]

Maryland and New Jersey: [$138,250-165,750]

Hawaii : [$120,250-144,750]

This position may be eligible for a bonus incentive, health benefits, a 401K program, and other employee perks.

More details about our company benefits can be found at https://shutterflyinc.com/benefits/.

This opportunity can be remote, but candidates must reside in a state in which Shutterfly is registered to do business.

This includes all US states except District of Columbia, North Dakota, Mississippi, Rhode Island, Vermont, and Wyoming.

This position will accept applications on an ongoing basis until filled.

#SFLYTechnology

Senior Application Security Engineer

Job Fit Check

Key Skills for This Role

Full Job Posting

Here

Apply for this job in 1 click

More jobs at Shutterfly