Senior Application Security Engineer

Airbnb was born in 2007 when two hosts welcomed three guests to their San Francisco home, and has since grown to over 5 million hosts who have welcomed over 2 billion guest arrivals in almost every country across the globe. Every day, hosts offer unique stays and experiences that make it possible for guests to connect with communities in a more authentic way.

The Community You Will Join
Airbnb's Application Security team is focused on making the Airbnb platform safer for millions of users around the world. We are a team covering a broad range of responsibilities from tool development to architectural consulting. We collaborate closely with our product teams, integrate security into every stage of development, and empower them to build secure features without unnecessary friction. Airbnb is a community built on trust, and we are integral to that foundation.

The Difference You Will Make
The Application Security (Appsec) team at Airbnb works with our product teams to ensure we have secure systems and applications. The Appsec team builds close partnerships with key areas in our engineering organization to identify security leverage opportunities and drive high impact security initiatives. Our partner team, the Security Development Engineering team focuses on building paved roads, automation for security self-service, and vulnerability management to reduce security risk.

As a Senior Application Security Engineer, you will own the security partnership with one or more product engineering areas, lead high-impact security initiatives from problem definition through to measurable risk reduction, and be the subject matter expert that product engineers and other security engineers turn to for the hardest application security problems.

A Typical Day

• Lead the identification and elimination of entire classes of application security vulnerabilities by designing and delivering scalable solutions (paved roads, guardrails, and tooling) that strengthen Airbnb's defense-in-depth strategy.
• Own the security partnership with one or more product engineering areas: run threat models, design reviews, and code reviews for complex and high-risk systems, set security requirements early in design, and drive them through to launch.
• Lead security initiatives that span multiple teams, from problem definition to measurable outcome, influencing engineering leaders and partner teams without direct authority.
• Act as a subject matter expert and escalation point for the Appsec team; mentor and coach other security engineers and help onboard new team members.
• Educate and empower software engineers to strengthen their security expertise and foster a culture of security awareness throughout Airbnb.
• Investigate, prioritize, and drive the resolution of application security vulnerabilities, including the most complex and highest-risk findings, ensuring timely remediation across Airbnb products.

Your Expertise

• Deep understanding of web and mobile application security, including common vulnerabilities, attack vectors, and secure development practices, with the depth to be the go-to expert in at least one area (for example authentication and authorization, API security, or mobile security).
• Hands-on software development experience, ideally with Java, JavaScript, Python, and Swift, and a track record of shipping security tooling or paved-road solutions that other engineers adopt.
• Knowledge of modern frameworks like ReactJS, Dropwizard and GraphQL, with the ability to assess their security implications and define secure-by-default patterns for them.
• Track record of leading security initiatives across multiple teams: defining the problem, aligning stakeholders, and delivering measurable risk reduction, working independently with guidance only in the most complex situations.
• Strong communication and leadership skills, with a track record of educating and empowering engineers to adopt security practices, and of mentoring other security engineers.
• 5+ years of experience in application security or a similar field, with a strong focus on threat modeling, architecture reviews, and developing scalable solutions to address security vulnerabilities.

Your Location

This position is US - Remote Eligible. The role may include occasional work at an Airbnb office or attendance at offsites, as agreed to with your manager. While the position is Remote Eligible, you must live in a state where Airbnb, Inc. has a registered entity. Click here for the up-to-date list of excluded states. This list is continuously evolving, so please check back with us if the state you live in is on the exclusion list. If your position is employed by another Airbnb entity, your recruiter will inform you what states you are eligible to work from.

Our Commitment to Inclusion and Belonging

Airbnb is committed to working with the broadest talent pool possible. We believe diverse ideas foster innovation and engagement, and allow us to attract creatively-led people, and to develop the best products, services and solutions. All qualified individuals are encouraged to apply.

We strive to also provide a disability inclusive application and interview process. If you are a candidate with a disability and require reasonable accommodation in order to submit an application, please contact us at: reasonableaccommodations@airbnb.com. Please include your full name, the role you're applying for and the accommodation necessary to assist you with the recruiting process.

We ask that you only reach out to us if you are a candidate whose disability prevents you from being able to complete our online application.

How We'll Take Care of You:

Our job titles may span more than one career level. The actual base pay is dependent upon many factors, such as: training, transferable skills, work experience, business needs and market demands. The base pay range is subject to change and may be modified in the future. This role may also be eligible for bonus, equity, benefits, and Employee Travel Credits.  

Pay Range$196,000—$227,000 USD

 

Reasonable Accommodations: We are committed to providing reasonable accommodations throughout the recruitment process for applicants with disabilities. If you need assistance, or an accommodation, please let your recruiter know once you are contacted about a role.

A Note on Recruiting Scams: Scammers sometimes pose as Airbnb recruiters to get money or personal information from candidates. A few things that will always be true for Airbnb’s hiring process: our open roles are posted on Airbnb’s Career’s Page at careers.airbnb.com, and our recruiters correspond only from @airbnb.com or @ext.airbnb.com email addresses. Our recruiters will never ask for your Social Security number, bank account details, passport, or payment app information while you are interviewing.  We’ll also never ask you to pay a fee, send money, deposit or cash a check, or purchase work-related equipment (such as a company laptop) during the interview process. We encourage candidates to remain vigilant of these recruiting scams and not share sensitive information if you do not believe an individual is actually affiliated with Airbnb.