Staff Application Security Engineer

Role Overview: As a Staff Application Security Engineer at Chegg, you will play a crucial role in shaping how security integrates into the product lifecycle, development pipelines, and developer onboarding. Your primary responsibility will be to define, lead, and evolve application security practices alongside product and infrastructure engineering teams. Key Responsibilities: - Perform secure design and code reviews, identifying and prioritizing risks, attack surfaces, vulnerabilities, and providing mitigation strategies. - Drive the remediation of critical vulnerabilities and effectively communicate risks and solutions to stakeholders. - Proactively eliminate entire vulnerability classes through security architecture improvements and secure coding practices. - Continuously enhance Chegg's security posture with software and service platforms like Hackerone, Cobalt.io, and Wiz.io. - Mentor and guide junior security engineers and cross-functional teams on secure software development best practices. Qualifications Required: - 8+ years of experience in application security, secure software development, and cloud infrastructure security. - Experience securing APIs, microservices architectures, and addressing modern infrastructure security challenges. - Deep understanding of authentication and authorization protocols such as OAuth, OIDC, SAML, and JWT. - Hands-on experience with static application security testing (SAST) and software composition analysis (SCA) tools. - Developer-level proficiency in at least one programming languagepreferably Python, Java, JavaScript, or Golang. - Familiarity with front-end and back-end technologies such as React, Next.js, TypeScript, Node.js, GraphQL, and/or Java. - Creative, resourceful, and adaptive problem-solving capabilities. - Excellent communication skills, both written and oral, with the ability to effectively engage with stakeholders at all levels. - Strong ability to work independently and collaboratively across various teams, linking tactical initiatives to long-term strategic outcomes. - A genuine passion for security and continuous learning. Role Overview: As a Staff Application Security Engineer at Chegg, you will play a crucial role in shaping how security integrates into the product lifecycle, development pipelines, and developer onboarding. Your primary responsibility will be to define, lead, and evolve application security practices alongside product and infrastructure engineering teams. Key Responsibilities: - Perform secure design and code reviews, identifying and prioritizing risks, attack surfaces, vulnerabilities, and providing mitigation strategies. - Drive the remediation of critical vulnerabilities and effectively communicate risks and solutions to stakeholders. - Proactively eliminate entire vulnerability classes through security architecture improvements and secure coding practices. - Continuously enhance Chegg's security posture with software and service platforms like Hackerone, Cobalt.io, and Wiz.io. - Mentor and guide junior security engineers and cross-functional teams on secure software development best practices. Qualifications Required: - 8+ years of experience in application security, secure software development, and cloud infrastructure security. - Experience securing APIs, microservices architectures, and addressing modern infrastructure security challenges. - Deep understanding of authentication and authorization protocols such as OAuth, OIDC, SAML, and JWT. - Hands-on experience with static application security testing (SAST) and software composition analysis (SCA) tools. - Developer-level proficiency in at least one programming languagepreferably Python, Java, JavaScript, or Golang. - Familiarity with front-end and back-end technologies such as React, Next.js, TypeScript, Node.js, GraphQL, and/or Java. - Creative, resourceful, and adaptive problem-solving capabilities. - Excellent communication skills, both written and oral, with the ability to effectively engage with stakeholders at all levels. - Strong ability to work independently and collaboratively across various teams, linking tactical initiatives to long-term strategic outcomes. - A genuine passion for security and continuous learning.