Security Engineer, Android Product Security

About the role

In this role you will join the Android Product Security Engineering (APSE) team, a cross‑functional group tasked with ensuring Android is the most secure operating system in the world and protecting an ecosystem of three billion devices. You will collaborate with internal partners across Android Security, Development, and Partner Engineering, as well as stakeholders outside of Android such as Chrome, and engage with external partners including SoC manufacturers and telecom carriers. Your work will focus on leading the Android Vulnerability Reward Program (VRP) and pioneering AI‑driven security engineering projects to advance vulnerability research and mitigation at scale. As a Security Engineer you will build AI/LLM‑driven tooling, participate in VRP triage rotations, conduct deep‑dive security research, and provide expert security consultation for new Android features.

Responsibilities

• Build cross‑functional AI and Large Language Model (LLM) tooling to scale advanced vulnerability research, defensive engineering, and mitigation strategies across the organization.
• Participate in the Android and Device VRP program, analyzing and triaging incoming vulnerabilities, working with cross‑functional teams for vulnerability management and tool building, and proactively incorporating AI/LLMs into the VRP pipeline.
• Conduct deep‑dive security research into Android vulnerabilities and threat vectors, converting VRP reports into prioritized platform mitigation solutions and partnering with product/feature teams to implement them.
• Embed security by design by providing expert product security consultation and conducting comprehensive security design reviews for new Android features.

Minimum qualifications

• Bachelor's degree or equivalent practical experience.
• 2 years of experience with security assessments, penetration testing, or vulnerability research on the Android platform or Android applications.
• 2 years of experience with security engineering, computer and network security, and security protocols.
• 2 years of coding experience in one or more general‑purpose languages.

Preferred qualifications

• Experience designing and building LLM‑based agentic workflows, frameworks, or automation tools specifically targeted at vulnerability research and remediation.
• Direct experience participating in, triaging, or receiving rewards from high‑impact Vulnerability Reward Programs (VRPs).
• Experience in Android platform security research, demonstrated by public CVEs, published whitepapers, or presentations at reputable security conferences (e.g., DEF CON).
• Familiarity with Artificial Intelligence (AI) and Large Language Model (LLM) concepts, with a demonstrated interest in applying them to security domains.
• Foundational understanding of the Android operating system architecture, security model, and common attack surfaces.

Benefits

• Health, dental, vision, life, and disability insurance.
• Retirement benefits: 401(k) with company match.
• Paid Time Off: 20 days of vacation per year, accruing at 6.15 hours per pay period for the first five years of employment.
• Sick Time: 40 hours/year (increased to 69 hours/year for Seattle) plus 5 discretionary sick days per instance.
• Maternity Leave (Short‑Term Disability + Baby Bonding): 28–30 weeks.
• Baby Bonding Leave: 18 weeks.
• Holidays: 13 paid days per year.

Location options: New York, NY, USA; Kirkland, WA, USA.

Pay

US: $147,000 – $210,000 (USD) plus a 15 % bonus target, equity, and benefits.