Senior Software Engineer, Application Security

About the role

Discord is seeking a senior engineer to join the Application Security team with the core mission of defending user accounts at scale. In this role, you will own the design and implementation of systems that protect millions of users while ensuring that security remains seamless and integrated into the user experience. You will be responsible for building full-stack security solutions that directly impact the safety and trustworthiness of the platform. The position requires deep collaboration with product and engineering teams to embed security into workflows without disrupting the product journey. You will lead initiatives that strengthen authentication and session security across critical user flows. Your work will involve researching and integrating emerging security features to address the evolving threat landscape of account compromise. Ultimately, you will drive the development of automated, self-service tools that enable the detection and remediation of account vulnerabilities before they can be exploited.

Key facts

What you'll do

• Design and deploy full-stack security solutions for our user base using Python, Go, Java, or Rust.
• Lead initiatives to enhance authentication and session security through robust frameworks and controls.
• Manage and improve security-critical authentication services including support for WebAuthn, passkeys, and FIDO2 standards.
• Collaborate with Product teams to implement account security tools and drive the adoption of strong authentication mechanisms.
• Create strategies to address emerging threats against user accounts by analyzing attack patterns and system weaknesses.
• Research and integrate new security features to maintain resilience in the authentication landscape.
• Develop automated, self-service security tools that detect and resolve account vulnerabilities across cloud environments.
• Harden desktop and native mobile applications to reduce the attack surface and improve overall platform integrity.
• Work within Google Cloud environments to deploy scalable security measures aligned with infrastructure needs.
• Debug and operate production security systems to ensure reliability and performance under real-world conditions.
• Apply knowledge of common application vulnerabilities across various platforms to guide secure development practices.
• Lead cross-functional security projects that require coordination between engineering, product, and operations teams.
• Provide secure design guidance to engineers by analyzing complex systems and identifying potential risks.
• Maintain and evolve security standards and controls that protect user identities and sensitive data.

Requirements

• Possess 5+ years of experience in production application security within high-scale systems.
• Demonstrate 3+ years of programming experience in Python, Go, Java, or Rust.
• Have a proven track record of shipping production software, including security frameworks or controls that are actively maintained.
• Maintain a technical background in account security and authentication, specifically involving WebAuthn, passkeys, FIDO2, MFA, and session management.
• Show the ability to analyze complex systems and provide secure design guidance to other engineers across the organization.
• Demonstrate experience leading cross-functional security projects from conception through execution.
• Have a background in hardening desktop or native mobile applications to mitigate platform-specific vulnerabilities.
• Bring experience working within cloud environments, with a focus on Google Cloud for deploying and managing security services.
• Exhibit strong understanding of security principles and how they apply to modern distributed applications.
• Communicate effectively with both technical and non-technical stakeholders to align security initiatives with business goals.
• Commit to following security best practices and contributing to the continuous improvement of the security posture.
• Adhere to company policies and compliance requirements relevant to application security and data protection.
• Work reliably within a fast-paced environment while maintaining attention to detail and accuracy in security implementations.
• Support on-call responsibilities as needed to respond to security incidents and provide timely remediation.

Nice to have

• Demonstrate proficiency in systems programming languages like C or C++ for performance-sensitive security components.
• Bring experience debugging and operating production systems in live environments with high availability demands.
• Possess knowledge of common application vulnerabilities across various platforms including web, mobile, and desktop.

Practical notes

• Compensation includes base salary, equity, and benefits as part of the total rewards package.
• Discord provides reasonable accommodations during the interview process upon request for candidates with disabilities.
• This role is restricted to candidates based in the United States due to legal and operational requirements.
• The position operates on a full-time engagement basis with standard working hours expected.
• No specific travel requirements are outlined for this role at this time.
• No visa sponsorship information is provided in the current job details.
• Candidates must meet all requirements and demonstrate relevant experience to be considered for the role.
• The hiring process may involve multiple stages including technical assessments and interviews focused on security knowledge.

About the company

Discord is used by over 200 million people every month for many different reasons, but there's one thing that nearly everyone does on our platform: play video games. Over 90% of our users play games, spending a combined 1.5 billion hours playing thousands of unique titles on Discord each month.