Senior Application Security Engineer

At Webflow, our mission is to bring development superpowers to everyone. Webflow is the leading visual development platform for building powerful websites without writing code. By combining modern web development technologies into one platform, Webflow enables people to build websites visually, saving engineering time, while clean code seamlessly generates in the background. From independent designers and creative agencies to Fortune 500 companies, millions worldwide use Webflow to be more nimble, creative, and collaborative. It’s the web, made better. 

 

We’re looking for a Senior Security Compliance Analysis on Webflow's new Security and Compliance team, you will work with the Security Compliance Manager and Director of Product Security to help us meet current and future compliance and certification needs. 

 

About the role 

• Location: Remote-first (United States; BC & ON, Canada) 
• Full-time 
• Permanent
• Exempt 
• The cash compensation for this role is tailored to a
• lign with the cost of labor in different geographic markets. We've structured the base pay ranges for this role into zones for our geographic markets, and the specific base pay within the range will be determined by the candidate’s geographic location, job-related experience, knowledge, qualifications, and skills.
  • United States  (all figures cited below in USD and pertain to workers in the United States)
    • Zone A: $137,000
    •  
    • Zone C: $143,00 - $190,150 
  • Canada  (All figures cited below in CAD and pertain to workers in ON & BC, Canada)
    • CAD 184,600 - CAD 245,500

• Please visit our Careers page for more information on which locations are included in each of our geographic pay zones. However, please confirm the zone for your specific location with your recruiter.

• Reporting to the Manager, AppSec

 

As a Senior Application Security Engineer, you’ll … 

• Collaborate with the Webflow engineering team to secure Webflow’s web application platform and ecosystem.
• Bring security best practices to the software development lifecycle.
• Work as part of a team to champion security standards while balancing business strategies and requirements.
• Support Webflow’s security current and future compliance frameworks
• Work to find security vulnerabilities through grey-box techniques, and propose solutions at the architecture and code level to mitigate findings.
• Contribute code and architecture improvements to enable security within Webflow’s application for engineers.
• Cross-train entry and mid-level application security engineers

 

In addition to the responsibilities outlined above, at Webflow we will support you in identifying where your interests and development opportunities lie and we'll help you incorporate them into your role.

 

About you 

You’ll thrive as a Senior Application Security Engineer  if you:

• Have 2+ years of software development experience in security
• Are passionate about security in general, and always hungry to learn
• Have expertise in evaluating application/software with an eye to improve security design, continuous commitment to risk reduction and sustainable security.
• Have experience fully rolling out secure code development lifecycle (SDLC) processes improvements, tools, and automation including planning, communication, and deployment of such tools.
• Have solid experience penetration testing, finding and developing medium complexity application vulnerabilities
• Have experience supporting software supply chain risks
• Have experience with Threat Modeling 
• Love to share knowledge, and the gift of explaining complex security concepts with your colleagues.
• Have a solid understanding of web application security, secure software design, and secure coding, and insecure engineering practices.
• Have set-up or supported bug bounty programs.

 

Our Core Behaviors:

• Obsess over customer experience. We deeply understand what we’re building and who we’re building for and serving. We define the leading edge of what’s possible in our industry and deliver the future for our customers.
• Move with heartfelt urgency. We have a healthy relationship with impatience, channeling it thoughtfully to show up better and faster for our custome