WordPress Security Analyst

As a WordPress Security Analyst, you're responsible for Making Stuff Secure. You will work directly with our product teams to secure networks, applications and data inside a fast-paced organization with numerous high traffic systems and large scale products in a multi-cloud environment.

In this role, you will be involved in the full security lifecycle from design, maintenance, implementation, monitoring, detection, incident response and remediation, post-mortem analysis and research. You'll help manage relationships with outside security vendors that we employ and ecosystem partners that we work with, as well as contribute to the security of OSS systems that our products rely on, including WordPress Core. This exciting and rewarding role plays a critical part in protecting tens of millions of websites worldwide and giving back to the greater WordPress & OSS communities we built upon.

💡 Interested in applying?

🔍 Please read/follow the next steps outlined in "How to Apply" at the bottom of this listing.

Attention to detail is one of our core values! This is your chance to stand out :)

To love this role, here’s the type of person you are:

• You’re a self-starter who loves taking initiative and seeing things through from conception to completion.
• You're an excellent communicator, fluent in both verbal and written English, who makes sure nothing slips through the cracks. We believe communication is critical and there is no such thing as over communicating or asking for help when needed.
• You have the curiosity and desire to learn and grow your skills.
• You're a team player who is comfortable working along side and helping developers, and you don't take critical feedback personally.
• You're comfortable advising and implementing remediation fixes, including writing PHP and JavaScript.
• You're happy working on tasks of all sizes - from quick code snippet reviews to auditing large features/rewrites.
  

Common responsibilities include (but are not limited to):

• Reviewing and testing existing plugin, website and API code, from planning through execution, and remediation as necessary
• Handle communication with ecosystem partners for inbound and outbound security disclosures
• Coordinating external security reviews
• Advise and in cases, help implement, security remediation fixes for code (which may involve you writing PHP and/or Javascript)
• Advising product developers on security best practices
• Performing application penetration testing, plugin code static and dynamic analysis
• Providing feedback and peer review for developers (Github PRs).
• Communicating with the team and supporting your peers using chat, audio, and video.
• Assist with network administration and security, onboarding & offboarding contractors/employees, maintaining operations and security documentation.

Requirements

• Previous experience with security testing, vulnerability research/finding and/or plugin code auditing.
• Professional experience with WordPress plugin development, architecture, and standards.
• Good understanding of PHP including modern PHP practices (OOP, autoloading, namespacing, traits, interfaces, etc), MySQL and JavaScript (vanilla JS, jQuery, ES6, etc), as well as WordPress/PHP sanitization, validation and escaping functions.
• Thorough understanding of regex expressions.
• Competent with version control through git, SVN and GitHub.
• Must be familiar with industry standards like OWASP Top 10 and CVSS scoring systems
  
• Exceptional troubleshooting skills.
• Ability to keep complex ideas and features simple. (Simplicity is a core value!)
• Previous freelance or remote work experience.
• Personal Computer with Internet Access
• A minimum daily EST overlap

Bonus points if you also have:

• Experience working on a WordPress or adjacent PHP and/or JavaScript security group, such as the WordPress Core Security Team
• Amazon Web Services (AWS) and/or Google Cloud and/or DigitalOcean infrastructure architecture, design and implementation, particularly in the areas of VPCs, Security Groups, Network ACLs, CloudFormation and EC2 (or platform equivalents on Google Cloud and/or DigitalOcean) and experience using the AWS (and/or alternative Cloud Provider) CLI
• Experience with database types beyond MySQL and MariaDB such as MySQL-compatible databases like AWS Aurora or Vitess or non-MySQL-compatible ones like Elasticsearch, MongoDB, DocumentDB, PostgreSQL or Redis.
• Experien