Application Security Vulnerability Management - USDS

ResponsibilitiesAbout TikTok U.S. Data SecurityTikTok is the leading destination for short-form mobile video. Our mission is to inspire creativity and bring joy. U.S. Data Security (“USDS”) is a subsidiary of TikTok in the U.S. This new, security-first division was created to bring heightened focus and governance to our data protection policies and content assurance protocols to keep U.S. users safe. Our focus is on providing oversight and protection of the TikTok platform and U.S. user data, so millions of Americans can continue turning to TikTok to learn something new, earn a living, express themselves creatively, or be entertained. The teams within USDS that deliver on this commitment daily span across Trust & Safety, Security & Privacy, Engineering, User & Product Ops, Corporate Functions and more.Why Join UsCreation is the core of TikTok's purpose. Our platform is built to help imaginations thrive. This is doubly true of the teams that make TikTok possible.Together, we inspire creativity and bring joy - a mission we all believe in and aim towards achieving every day.To us, every challenge, no matter how difficult, is an opportunity; to learn, to innovate, and to grow as one team. Status quo? Never. Courage? Always.At TikTok, we create together and grow together. That's how we drive impact - for ourselves, our company, and the communities we serve.Join us.In order to enhance collaboration and cross-functional partnerships, among other things, at this time, our organization follows a hybrid work schedule that requires employees to work in the office 3 days a week, or as directed by their manager/department. We regularly review our hybrid work model, and the specific requirements may change at any time.Our United States Data Security (USDS) function provides services to TikTok's US market using four principles that guide our strategic and tactical operations. First, we champion trust and transparency, leading the charge in organizational transparency and execution of security and privacy capabilities that drive customer trust. Second, we are a business catalyst and enabler, embodying the DNA of technical innovation. Third, we drive risk-informed and empowered decision-making, giving our business leaders the information needed to make key decisions. Finally, we proactively identify and reduce risk while enabling innovative product development – to consistently build sustainable world-class and trusted security capabilities.The Application Security Compliance Specialist plays a crucial role in validating vulnerability reports from third parties and collaborating with development teams to remediate findings. This role is an excellent opportunity to join a growing team and have an impact on a truly global scale.Responsibilities:• Vulnerability Validation: Thoroughly review and validate vulnerability reports received from third-party security researchers, vendors, or internal sources to determine their legitimacy and impact on our applications.• Collaborative Remediation: Work closely with cross-functional development teams, including software engineers and system administrators, to prioritize and facilitate the remediation of identified vulnerabilities in a timely manner.• Recommendation and Guidance: Provide expert guidance and recommendations to development teams on how to effectively remediate vulnerabilities, including code changes, configuration adjustments, and best practices in secure coding.• Documentation: Maintain accurate records of all vulnerability reports, assessments, and remediation efforts, ensuring clear documentation of findings and resolutions.• Security Awareness: Promote security awareness within the organization by conducting training sessions, sharing insights on emerging threats, and fostering a culture of security consciousness.• Stay Current: Stay up-to-date with the latest security trends, threats, and best practices in application security, and incorporate this knowledge into security processes and procedures.QualificationsMinimum Qualifications:• Proven experience as an Application Security Engineer or in a similar role.• Proven ability to identify, analyze, and solve ambiguous problems.• Strong problem-solving skills and excellent debugging / troubleshooting skills.• In-depth knowledge of web application vulnerabilities (e.g., OWASP Top Ten) and common attack vectors.• Experience with vulnerability assessment tools and penetration testing techniques.• Proficiency in programming languages such as Python, Java, C/C++, Kotlin, Swift, TypeScript, Go, or Python.• Strong communication skills, both written and verbal, for effective collaboration with development teams.TikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.TikTok is committed to providing reasonable accommodations in our recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs or other reasons protected by applicable laws. If you need assistance or a reasonable accommodation, please reach out to us at https://shorturl.at/ktJP6This role requires the ability to work with and support systems designed to protect sensitive data and information. As such, this role will be subject to strict national security-related screening.Job Information【For Pay Transparency】Compensation Description (Annually)The base salary range for this position in the selected city is $98800 - $135400 annually.Compensation may vary outside of this range depending on a number of factors, including a candidate’s qualifications, skills, competencies and experience, and location. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units.Benefits may vary depending on the nature of employment and the country work location. Employees have day one access to medical, dental, and vision insurance, a 401(k) savings plan with company match, paid parental leave, short-term and long-term disability coverage, life insurance, wellbeing benefits, among others. Employees also receive 10 paid holidays per year, 10 paid sick days per year and 17 days of Paid Personal Time (prorated upon hire with increasing accruals by tenure).The Company reserves the right to modify or change these benefits programs at any time, with or without notice.For Los Angeles County (unincorporated) Candidates:Qualified applicants with arrest or conviction records will be considered for employment in accordance with all federal, state, and local laws including the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act. Our company believes that criminal history may have a direct, adverse and negative relationship on the following job duties, potentially resulting in the withdrawal of the conditional offer of employment:• Interacting and occasionally having unsupervised contact with internal/external clients and/or colleagues;• Appropriately handling and managing confidential information including proprietary and trade secret information and access to information technology systems; and• Exercising sound judgment.About USDSTikTok is the leading destination for short-form mobile video. Our mission is to inspire creativity and bring joy. U.S. Data Security (“USDS”) is a subsidiary of TikTok in the U.S. This new, security-first division was created to bring heightened focus and governance to our data protection policies and content assurance protocols to keep U.S. users safe. Our focus is on providing oversight and protection of the TikTok platform and U.S. user data, so millions of Americans can continue turning to TikTok to learn something new, earn a living, express themselves creatively, or be entertained. The teams within USDS that deliver on this commitment daily span across Trust & Safety, Security & Privacy, Engineering, User & Product Ops, Corporate Functions and more.Data Security StatementThis role requires the ability to work with and support systems designed to protect sensitive data and information. As such, this role will be subject to strict national security-related screening.Why Join UsInspiring creativity is at the core of TikTok's mission. Our innovative product is built to help people authentically express themselves, discover and connect – and our global, diverse teams make that possible. Together, we create value for our communities, inspire creativity and bring joy - a mission we work towards every day.We strive to do great things with great people. We lead with curiosity, humility, and a desire to make impact in a rapidly growing tech company. Every challenge is an opportunity to learn and innovate as one team. We're resilient and embrace challenges as they come. By constantly iterating and fostering an "Always Day 1" mindset, we achieve meaningful breakthroughs for ourselves, our company, and our users. When we create and grow together, the possibilities are limitless. Join us.Diversity & InclusionTikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.USDS Reasonable AccommodationUSDS is committed to providing reasonable accommodations in our recruitment processes for candidates with disabilities, pregnancy, sincerely held religious beliefs or other reasons protected by applicable laws. If you need assistance or a reasonable accommodation, please reach out to us at https://tinyurl.com/USDS-RA