Mattermost provides secure, workflow-centric collaboration for technical and operational teams that need to meet nation-state-level security and trust requirements. We serve technology, public sector, national defense, and financial services industries with customers ranging from tech giants to the world’s largest banks, to the U.S. Department of Defense and governmental agencies around the world. Our self-hosted and cloud offerings provide integrated workflow automation, AI-acceleration, ChatOps with team messaging, audio calling and screen share on an open core platform vetted and deployed by the world’s most secure and mission critical organizations. We co-build the future of collaboration with over 4,000 open source project contributors who’ve provided over 30,000 code improvements towards our shared product vision, which is translated into 20 languages. To learn more, visit www.mattermost.com Mattermost is seeking a result-driven and analytical Staff Product Security Engineer to help ensure the security of our product and services across the company. As part of our Security team you will work closely with a globally distributed team to support in all the different aspects of the software development life cycle. You will be responsible for the implementation of additional application security tooling and/or processes across the company and coordinate with relevant stakeholders, gather requirements, and lead the implementation.
Responsibilities
Support the application vulnerability management and mitigation approaches.
Engage in threat modeling and design reviews of in-house developed software components.
Conduct application security reviews through manual code review or static/dynamic code analysis.
Educate technical teams on DoD security requirements/architecture and support R&D fulfilling federal compliance requirements, e.g. FIPS.
Provide security guidance and training to internal development teams.
Promote the Mattermost brand and build awareness through blog posts and public speaking on security subjects.
Validate ideas and share insights with Product Management/Marketing on product direction and industry trends for security audiences
Requirements
Deep understanding of web application security and secure development practices.
Deep understanding with common security libraries, security controls, and common security flaws.
Experience building and shipping software fulfilling federal and DoD requirements.
Experience with Threat Modeling applications.
Experience with static/dynamic analysis, and common exploit tools and methods.
Experience in one or more programming languages, ideally Go or Javascript.
Excellent written and verbal communication skills, including prior experience on public speaking engagements or published research.
Demonstrable teamwork skills and resourcefulness.
Preferred Background / Skilset
Experience working in open source communities.
Experience running a bug bounty program.
Certifications in the domain of penetration testing or application security (e.g. OSCP, OSWE, GWAPT, …).
Experience with Electron, React or React Native.
Experience with Linux / AWS.
Experience with Kubernetes / Docker.
Participation in Bug Bounties, CTFs or similar activities
