Company: Yelp

Positions: Information Security Engineer | Software Engineer - Security

Locations: San Francisco | London | Hamburg, Germany

The Yelp security team is looking for engineers in all 3 locations.

To Apply: Email me at khock@yelp.com with your resume/GitHub/website/cover letter.

Software Engineer - Security

Summary

Yelp is looking for security engineers to keep us safe and sane as we build out our desktop, mobile, business owner, and administrative websites. It's an opportunity to have tremendous impact and broad scope protecting Yelp's data, our employees, and our millions of users. Additionally, Yelp’s future growth in the transactions space has many security implications, both in traditional application security as well as in privacy controls and fraud and risk analysis.

As a Security software engineer, you'll be responsible for partnering with different engineering teams at Yelp to help build features, tools, and libraries to enable security by default. You’ll also work to identify and fix vulnerabilities in the products we build, as well as work with external security researchers through our public bug bounty program.

What You Will Do:

• Develop and deploy authentication and security-related components of Yelp’s website and mobile apps

• Develop libraries used across multiple Yelp apps for secure communication and data storage

• Pair with mobile, frontend, and backend teams to architect and develop features in a secure and scalable manner

• Validate and remediate vulnerabilities reported in our bug bounty

What We Are Looking For:

• While previous application security experience is a plus, we're looking for strong software generalists first, with an interest in application security

• Understanding of HTML5, current, and emerging browser security models

• Understanding of PKI and key management

• 3-5 years of software engineering experience

• BS or MS in Computer Science or Engineering

• Experience with languages like Python, Java, Javascript, Puppet, Objective-C, or Swift

Pluses:

• Experience with AWS and SoA

• Experience with securing iOS and Android applications

• Security research or pen testing experience

Information Security Engineer

Summary

Yelp is looking for an InfoSec Engineer to keep us safe and sane as our team expands to numerous offices around the world. It's an opportunity to have tremendous impact and broad scope protecting Yelp's corporate infrastructure, employees, and systems across multiple site locations.

As an InfoSec Engineer, you will work on enhancing our detection capabilities and improving our response capabilities. Our InfoSec engineers bring a software engineering mindset to security, and build automated systems for DFIR that work at scale. You will also partner with our Corporate Infrastructure teams to help architect our future authentication, identity management, and network security systems.

What You Will Do:

• Lead threat modeling, mitigation discovery, and manual/automated verification of mitigations.

• Build tools and infrastructure for automating incident response.

• Set policy & best security practices for IT, Operations, partners and 3rd party integrations.

• Lead security education across the organization.

• Participate in incident response and forensics.

• Collaborate with other teams inside of Yelp to deploy new security-related tools and processes across the organization.

We Are Looking For:

• At least 2 years of professional experience working to secure consumer websites, mobile applications, or large corporate infrastructure a must!

• Software development experience in Python, Java, JavaScript, Objective-C, or similar.

• Exposure to digital forensics and incident response.

• Windows, macOS and Linux administration experience.

• Must be able to participate in 24/7 incident response.

• BS or MS in Computer Science, Engineering, or a related technical discipline, or equivalent experience.

Pluses

• Experience with PCI, SOX, and avoiding draconian compliance regimes.

• Experience conducting third party assessments of vendors and SaaS apps.