\nAs a Principal Application Security Engineer at Vimeo, you will engage in a variety of activities, either offensive, defensive, or some combination thereof, ultimately aimed at safeguarding our users who entrust Vimeo with their content every day.\n\nYou’ll plan, carry out, and lead security initiatives to monitor and protect sensitive data and systems from infiltration and cyber-attacks.\n\nYou will likely collaborate frequently with and support developers, as well as members of the infrastructure security team, the compliance team, IT, Product, and other teams throughout the organization.\n\nYou love to solve puzzles, and are a great team player.\n\nThis role is remote. The role requires three hours of overlap with the US Eastern time zone (i.e., New York City) daily.\n\nWhat you’ll do:\n\nDepending on your preferences and the current needs of the team, you may either focus on just one or two of the following areas, or you may choose to become involved with many of them.\n\n\n* Security architecture — create a technical plan for partitioning and consolidating our cookies; draft up a sequence diagram for a new middleware to prevent IDOR attacks; implement a POC for leveraging CAPTCHA challenges in cross-origin embedded iframes; draft some code to modify the expiration behavior of our JWTs then pair with our API team to get feedback\n\n* Penetration testing — either hunt for security issues on our production or staged applications during an open-box internal pen test, or help coordinate an engagement with an external firm\n\n* Writing code for internal automated security tools — write some code, usually in Python, Bash, or Go, to support any of our team's various initiatives. Often we strive to facilitate a culture of “paved roads” for our developers, such that it is easy for any developer to incorporate security into their designs and implementations\n\n* Threat modeling — consider how malicious attackers may compromise our systems, and advise developers and product managers on what defenses are needed\n\n* Code reviews — discover weakness in our source code before it reaches production\n\n* Bug bounty program — help triage new incoming reports on a daily basis, plus launch creative initiatives to increase researcher engagement on our programs\n\n* Web Application Firewall and Rate Limiting — expand coverage and tune new rules while coordinating with developers, support team members, and the site reliability team\n\n* Remediation — enable and encourage developers to correctly fix recently discovered security issues in a timely manner, ultimately reducing our Mean Time To Remediate\n\n* Secure Software Development Lifecycle — configure automated tooling (eg. static and dynamic code analysis,, IAST) in our SDLC to detect security issues in our source code before it reaches production\n\n* Developer Education, Security Culture — create fun ways to spread technical security awareness throughout the engineering department\n\n* Incident response — lead or assist in running the various phases of an incident response, including initial detection, triage, containment, recovery, root cause analysis, retrospective, etc.\n\n* Collaboration with the infrastructure security team — pair with members of the infrastructure security team on various projects to secure our cloud instances and employee workstations\n\n* Collaboration with the compliance and privacy team — help ensure that our company complies with industry best practices and standards\n\n* Process improvements — help strengthen our own internal processes and procedures\n\n* A typical day will look like:\n\n\n\n* Engage with one or more product development teams and guide them through a threat model and data flow analysis.\n\n* Review the code for major new functionality to ensure security best practices are followed.  \n\n* Review new tickets in our bug bounty program (http://hackerone.com/vimeo) and use your system design and threat modeling knowledge to reproduce, define risk and mitigating controls and propose a fix., \n\n* A call or two with Development, Product Management teams to discuss security-related issues\n\n* Pen test a new feature in a staging environment with Burp Pro\n\n* Assist the compliance team on a privacy-related project\n\n* Provide technical advice in response to occasional questions from developers and other members of the security team\n\n\n\n\n\n\nSkills and knowledge you should possess:\n\n\n* Required: 5+ years of prior experience in either software development, devops, or site reliability engineering with hands-on coding experience.\n\n* Preferred: prior experience in Application Security\n\n* 7+ total years of relevant experience in Engineering, Application Security, or a similar technical field.\n\n* Strong knowledge of modern web, mobile, and network security\n\n* Strong programming skills with at least one of the following languages, and the ability to read all of them: Python, Go, PHP, Javascript, and Ruby\n\n* Expertise with application pen testing, using tools like Burp or Zap\n\n* Confident working in and across cloud environments like AWS and GCP. Detailed knowledge of at least one cloud environment.\n\n* Confident with shell scripting\n\n* Confident with common SDLC components, like git, Jira, Jenkins, etc\n\n* Confident ability to communicate technical security concepts to developers\n\n* At least an upper-intermediate level of English\n\n\n\n\nBonus points:\n\n\n* Link to a Github repo with security tools/scripts you’ve developed or help maintain\n\n* Full-stack web development experience creating RESTful applications (in any language) is a big plus\n\n* Open source vulnerability research or blog posts is a big plusS\n\n* Experience with system security hardening guidelines and SDLC principles\n\n\n \n\n#Salary and compensation\n No salary data published by company so we estimated salary based on similar jobs related to Design, Cloud, API and Engineer jobs that are similar:\n\n $62,500 — $105,000/year\n
\n\n#Benefits\n 💰 401(k)\n\n🌎 Distributed team\n\n⏰ Async\n\n🤓 Vision insurance\n\n🦷 Dental insurance\n\n🚑 Medical insurance\n\n🏖 Unlimited vacation\n\n🏖 Paid time off\n\n📆 4 day workweek\n\n💰 401k matching\n\n🏔 Company retreats\n\n🏬 Coworking budget\n\n📚 Learning budget\n\n💪 Free gym membership\n\n🧘 Mental wellness budget\n\n🖥 Home office budget\n\n🥧 Pay in crypto\n\n🥸 Pseudonymous\n\n💰 Profit sharing\n\n💰 Equity compensation\n\n⬜️ No whiteboard interview\n\n👀 No monitoring system\n\n🚫 No politics at work\n\n🎅 We hire old (and young)\n\n
\n\n#Location\nTel Aviv, Tel Aviv District, Israel

Job Description We are the FIS Embedded Finance team, and our mission is to enable developers across all verticals to imagine, create and monetize financial products to profoundly transform the way the entire financial industry consumes services. Today, it's difficult for many businesses to build the financial products they imagine. Whether that's launching a new credit or debit card, a savings account, a lending business, or anything else — there are barriers in the way, that require excessive time and effort. We make it trivially easy for businesses to compliantly offer financial products and innovate on their key differentiators rather than spend all their time building and maintaining financial infrastructure. We are looking for Backend Software Engineers to help us build a brand-new financial technology platform for the future. We look for people who operate like owners, love to learn, have grit, and operate with integrity and empathy. You're encouraged to apply even if your experience doesn't precisely match the job description. Your skills and passion will stand out — and set you apart. We welcome diverse perspectives and people who are not afraid to challenge assumptions. **NOTE: This position is based in the greater Seattle/Bellevue, WA area. We plan to bring the team together regularly for design, ideation, and connection-building. GENERAL DUTIES & RESPONSIBILITIES Deliver high quality code following the best practices of coding standards, efficiency, readability, maintainability, reliability, well tested. Partner closely with product managers, designers, and other stakeholders to fully understand the feature and product vision and provide engineering feedback. Design elegant API interfaces and domain models to provide consistency across multiple downstream vendor integrations. Build secure, robust, scalable, and performant systems for processing transactions and managing customer data. Set and maintain high standards of technical excellence across the team. Achieve operational excellence by participating in the team on-call rotation and owning production issues from root cause analysis to resolution. Collaborate with cross-functional stakeholders to prioritize projects and communicate changes to broader audiences. Estimate project timelines, ensuring that projects you own stay on track and escalating as needed. Mentor junior engineers and help hire new talent to build a stronger team.   QUALIFICATIONS 10+ years of relevant technical experience in software development roles. Bachelor’s degree in computer science or directly related field. Experience leading projects from architectural design to production while setting and maintaining high standards of technical excellence across your team. Strong communication and collaboration skills and a history of working effectively with your team and cross-functional stakeholders. Experience or interest in building FinTech, payment, or banking systems.   PREFERRED QUALIFICATIONS Experience working with service mesh architectures on major Cloud providers like AWS/Azure/GCP. Experience designing and implementing APIs for third-party developers. Experience integrating third-party vendor solutions into backend systems. Experience with Python (Flask & Django) and Kubernetes. Experience with financial standards like ISO 8583/20022 and ACH/NACHA. What we offer you: At FIS, we hire the best. In return, you receive exceptional benefits, including: Opportunities to innovate in FinTech Tools for personal and professional growth Inclusive and diverse work environment Resources to invest in your community Competitive salary and benefits #Platforms FIS is committed to providing its employees with an exciting career opportunity and competitive compensation. The pay range for this full-time position is $136,190.00 - $228,790.00 and reflects the minimum and maximum target for new hire salaries for this position based on the posted role, level, and location. Within the range, actual individual starting pay is determined additional factors, including job-related skills, experience, and relevant education or training. Any changes in work location will also impact actual individual starting pay. Please consult with your recruiter about the specific salary range for your preferred location during the hiring process. Privacy Statement FIS is committed to protecting the privacy and security of all personal information that we process in order to provide services to our clients. For specific information on how FIS protects personal information online, please see the Online Privacy Notice. EEOC Statement FIS is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, marital status, genetic information, national origin, disability, veteran status, and other protected characteristics. The EEO is the Law poster is available here supplement document available here For positions located in the US, the following conditions apply. If you are made a conditional offer of employment, you will be required to undergo a drug test. ADA Disclaimer: In developing this job description care was taken to include all competencies needed to successfully perform in this position. However, for Americans with Disabilities Act (ADA) purposes, the essential functions of the job may or may not have been described for purposes of ADA reasonable accommodation. All reasonable accommodation requests will be reviewed and evaluated on a case-by-case basis. Sourcing Model Recruitment at FIS works primarily on a direct sourcing model; a relatively small portion of our hiring is through recruitment agencies. FIS does not accept resumes from recruitment agencies which are not on the preferred supplier list and is not responsible for any related fees for resumes submitted to job postings, our employees, or any other part of our company. #pridepass \n\n#Salary and compensation\n No salary data published by company so we estimated salary based on similar jobs related to Design, Python, Recruiter, Finance, Cloud, API, Executive, Junior, Engineer and Backend jobs that are similar:\n\n $60,000 — $102,500/year\n
\n\n#Benefits\n 💰 401(k)\n\n🌎 Distributed team\n\n⏰ Async\n\n🤓 Vision insurance\n\n🦷 Dental insurance\n\n🚑 Medical insurance\n\n🏖 Unlimited vacation\n\n🏖 Paid time off\n\n📆 4 day workweek\n\n💰 401k matching\n\n🏔 Company retreats\n\n🏬 Coworking budget\n\n📚 Learning budget\n\n💪 Free gym membership\n\n🧘 Mental wellness budget\n\n🖥 Home office budget\n\n🥧 Pay in crypto\n\n🥸 Pseudonymous\n\n💰 Profit sharing\n\n💰 Equity compensation\n\n⬜️ No whiteboard interview\n\n👀 No monitoring system\n\n🚫 No politics at work\n\n🎅 We hire old (and young)\n\n
\n\n#Location\nUS WA SEA Virtual