About
Meta builds technologies that help people connect, find communities, and grow businesses. Its apps include Messenger, Instagram, and WhatsApp, and it is developing immersive augmented and virtual reality experiences to advance social technology.
Responsibilities
•Conduct security assessments, penetration testing, and vulnerability research across web, mobile, and backend systems to identify and remediate risks
•Perform threat modeling and security architecture reviews for products and infrastructure
•Identify systemic security gaps and drive scalable, cross-functional mitigations
•Develop and improve security tooling, automation, and detection capabilities
•Collaborate with product and infrastructure engineering teams to define security requirements and integrate security controls into the software development lifecycle
•Lead complex security investigations and incident response, coordinating with cross-functional partners to resolve issues and prevent recurrence
•Document security findings as clear, actionable, prioritized recommendations for engineering and leadership audiences
•Mentor engineers on security best practices, contribute to team culture, and support recruiting and onboarding
•Independently manage on-call security responsibilities, triaging and resolving issues with cross-functional support as needed
•Identify and deliver security initiatives for the team roadmap addressing complex, ambiguous risks aligned with broader team strategy
Requirements
•6+ years of security engineering experience, including hands-on penetration testing, vulnerability research, or security assessments of web, mobile, or backend systems
•Experience with threat modeling and security architecture reviews for large-scale software systems
•Experience identifying systemic security risks and driving cross-functional remediation that delivers scalable, durable improvements
•Experience developing or improving security tooling, automation, or detection capabilities for team-level security operations
•Experience communicating security findings and risk assessments in writing to technical and non-technical stakeholders
Nice to have
•Security automation, static or dynamic analysis tooling, building internal security platforms
•Integrating AI tools to optimize or redesign workflows and deliver measurable impact
•Familiarity with security in large-scale distributed systems, iOS or Android, or cloud infrastructure
•Offensive security techniques including exploit development, binary analysis, or red team operations
•Ongoing AI skill development such as prompt/context engineering or agent orchestration
•Proficiency in programming or scripting languages such as Python, C/C++, or Java for security tools or vulnerability analysis
•Responsible and ethical AI practices including risk assessment, bias mitigation, and quality and accuracy reviews
