Senior Application Security Engineer
Shutterfly · Charlotte, NC · 1 mo ago
On-siteInformation Technology$128k–$181k/yrFull-time
We need to output HTML fragment with headings for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. Must not include Job ID etc. Remove boilerplate like EEO, diversity statement, application instructions, etc. Must preserve all substantive info.
We need to parse the posting.
Key sections:
- Intro paragraph about Shutterfly and role description: could be "About the role" maybe. The posting includes description of role, responsibilities, etc. We'll need to separate.
We have "What You'll Do Here" with bullet points (list). Those are responsibilities.
Then "Required Qualifications" list.
Then "Preferred Qualifications" list.
Then "Supporting a diverse and inclusive workforce..." is EEO/diversity statement; we should remove.
Then compensation details: base pay ranges per location, mention bonus incentive, health benefits, 401K, other perks, link to benefits. This is Pay and Benefits.
Also mention remote eligibility: "This opportunity can be remote, but candidates must reside in a state in which Shutterfly is registered to do business." That's maybe Schedule? Actually schedule not mentioned. Could be location/remote info; but we only create Schedule section if posting actually states schedule (e.g., full-time, part-time, shift). Not present. So we omit Schedule.
Benefits: mention health benefits, 401K program, other employee perks, link to benefits. Also maybe mention bonus incentive. So we can have Benefits section.
Pay: base pay ranges per location.
We also have "Required Qualifications" and "Preferred Qualifications". According to rules, we can have Requirements and Qualifications sections. Possibly combine? The instruction: use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to decide which headings to use.
We have responsibilities list (What You'll Do Here). So we can have
for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. Must not include Job ID etc. Remove boilerplate like EEO, diversity statement, application instructions, etc. Must preserve all substantive info.
We need to parse the posting.
Key sections:
- Intro paragraph about Shutterfly and role description: could be "About the role" maybe. The posting includes description of role, responsibilities, etc. We'll need to separate.
We have "What You'll Do Here" with bullet points (list). Those are responsibilities.
Then "Required Qualifications" list.
Then "Preferred Qualifications" list.
Then "Supporting a diverse and inclusive workforce..." is EEO/diversity statement; we should remove.
Then compensation details: base pay ranges per location, mention bonus incentive, health benefits, 401K, other perks, link to benefits. This is Pay and Benefits.
Also mention remote eligibility: "This opportunity can be remote, but candidates must reside in a state in which Shutterfly is registered to do business." That's maybe Schedule? Actually schedule not mentioned. Could be location/remote info; but we only create Schedule section if posting actually states schedule (e.g., full-time, part-time, shift). Not present. So we omit Schedule.
Benefits: mention health benefits, 401K program, other employee perks, link to benefits. Also maybe mention bonus incentive. So we can have Benefits section.
Pay: base pay ranges per location.
We also have "Required Qualifications" and "Preferred Qualifications". According to rules, we can have Requirements and Qualifications sections. Possibly combine? The instruction: use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we need to decide which headings to use.
We have responsibilities list (What You'll Do Here). So we can have Responsibilities
with .
We have Required Qualifications: could be Requirements
(or Qualifications). The list includes bachelor's degree, experience, etc. That's qualifications.
We have Preferred Qualifications: could be Preferred Qualifications
but not in allowed headings list? The allowed list includes Qualifications (maybe we can have both Required and Preferred under Qualifications? But we need to preserve all info. Could make a single Qualifications section with subheadings? But we cannot add extra headings beyond allowed? The instruction: "use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It gives examples but not exclusive; we can use other headings? It says use for section headings (e.g. ...). Likely we should stick to those examples. But we have both required and preferred qualifications; we could combine them under Qualifications and differentiate with
or
with labels. Or we could have Requirements for required, Qualifications for preferred. That seems plausible: Requirements = required qualifications; Qualifications = preferred qualifications. That matches the examples.
We also have Skills: maybe we can extract skills from responsibilities? But we may not need a separate Skills section if not explicit. The posting mentions "Proficient in one modern programming language (preferably Java) and able to review code in most major languages." etc. That's skill. Could be placed under Skills. But we already have Requirements covering many skill items. Might be redundant. The instruction: Prefer a few substantive sections over many thin ones. So we could combine skill items into Requirements or Qualifications. Probably better to have Requirements (required) and Qualifications (preferred). No separate Skills.
About the role: we can have an introductory paragraph summarizing role and mission. Use About the role
with .
Responsibilities: list from "What You'll Do Here". We'll need to capture each bullet as
- . Ensure we preserve all details.
Let's extract responsibilities bullets:
- Plan and lead offensive engagements against Shutterfly's applications and supporting infrastructure using established offensive and testing techniques — manual web penetration testing, exploitation, fuzzing, and adversary emulation supported by industry-standard offensive tooling — and coordinate with third-party testers when engagements call for it.
- Work hand-in-hand with the Blue Team throughout every engagement. Share tactics, techniques, and procedures in real time, validate and improve detection and alerting coverage, run collaborative exercises, and convert offensive findings into concrete defensive improvements.
- Augment conventional offensive techniques with AI and LLM-based tooling to accelerate and extend offensive and testing work — reconnaissance, payload and test-case generation, code and configuration review, and exploitation. Maintain a working understanding of how threat actors are weaponizing AI, and fold that knowledge into engagements and defensive recommendations to keep pace with a rapidly changing threat landscape.
- Manage the bug bounty program end to end — triage, impact assessment, risk scoring (CVSS), locating vulnerable code, providing mitigation guidance, thorough re-testing, and refining program policy and scope as needed.
- Identify, triage, and drive remediation of application vulnerabilities through manual testing and exploitation, escalating systemic issues to the appropriate engineering teams.
- Lead threat modeling exercises and perform risk assessments for new and existing applications, using offensive insight to prioritize the risks that matter most.
- Collaborate with incident response and Blue Team partners to investigate application-related security incidents, applying offensive expertise to scope, reproduce, and understand attacker activity.
- Help define and reinforce secure development practices, including code reviews and integration of security checks into the CI/CD pipeline.
- Perform and lead security reviews of critical PRs and code changes, and review code in most major languages.
- Partner with engineering and architecture teams to advise on secure systems and applications design, ensuring security is built in from the ground up.
- Serve as a top technical resource to engineers across the organization. Help them reproduce vulnerabilities, understand impact, document issues, and validate the effectiveness of fixes.
- Mentor junior security engineers and developers on offensive techniques, secure coding practices, and security principles. Build relationships with stakeholders and business leaders across the organization.
- Work closely with product, engineering, DevOps, defensive security, and compliance teams to align security with business goals.
- Maintain up-to-date knowledge of relevant offensive techniques, threats, mitigations, security best practices, and the evolving role of AI in both offensive operations and adversary activity.
- Make effective use of the existing security tooling stack (e.g., SAST, SCA, DAST, IAST) to support offensive and defensive work.
That's a lot; we need to keep all.
Now Required Qualifications bullets:
- Bachelor's degree in computer science, cybersecurity, or a related technical field, or comparable hands-on experience in lieu of a degree.
- Demonstrated experience leading or performing offensive security work, such as web application penetration testing or Red Team engagements, with hands-on proficiency in conventional offensive and testing techniques and industry-standard offensive tooling.
- Hands-on experience using AI/LLM tools for offensive security or testing, with an understanding of how threat actors are leveraging AI in a rapidly evolving threat landscape.
- Proficient in one modern programming language (preferably Java) and able to review code in most major languages.
- Strong analytical and problem-solving abilities with a risk-based security approach.
- Advanced user of Burp Suite Pro; bonus if you have created custom extensions in Java or Python or have used or modified existing extensions.
- Excellent communication and collaboration skills, with the ability to work across offensive and defensive teams, IT, engineering, and business stakeholders.
Preferred Qualifications bullets:
- Experience running Purple Team exercises or otherwise collaborating directly with defensive/Blue Team functions to improve detection and response.
- Full stack web development experience within an active security program.
- Experience managing a bug bounty program.
- A security certification that demonstrates proficiency in offensive security, network/web/mobile/AD assessments, secure coding, and professional report creation (for example: OSCP, OSEP, CRTO, OSWA, OSWE, GWAPT, GWEB).
- Submitted reports to bug bounty programs or VDPs, and you've found a CVE along the way.
- Strong command-line and scripting skills (bash, zsh, Python) on Linux and Mac.
- Enjoy attending security conferences and occasionally participate in CTFs.
- Spend time on cyber security training platforms (HackTheBox, TryHackMe).
- Have worked with engineering teams to develop secure code libraries.
- Capable of rapidly learning and integrating emerging tools and platforms with minimal supervision.
Now Pay and Benefits:
Pay: base pay ranges per location:
- California : [$128,000-181,250]
- Connecticut and New York: [$128,000-165,750]
- Colorado, Illinois, Minnesota and Washington: [$128,000-153,000]
- Nevada: [$120,250-165,750]
- Maryland and New Jersey: [$138,250-165,750]
- Hawaii : [$120,250-144,750]
Also mention: "This position may be eligible for a bonus incentive, health benefits, a 401K program, and other employee perks. More details about our company benefits can be found at https://shutterflyinc.com/benefits/."
Also remote eligibility: "This opportunity can be remote, but candidates must reside in a state in which Shutterfly is registered to do business. This includes all US states except District of Columbia, North Dakota, Mississippi, Rhode Island, Vermont, and Wyoming."
That could be placed under Benefits or maybe under About the role? But we have Benefits section for health benefits, 401K, etc. Remote eligibility maybe not a benefit but a location requirement; could be placed under About the role or maybe under Pay? Probably better to include in Benefits as part of "other employee perks" but remote work is a work arrangement; maybe we could add a short paragraph under Benefits about remote eligibility. However the instruction: only create Benefits section if posting actually states them. It does state health benefits, 401K program, other employee perks. So we can include those. Remote eligibility is not a benefit but a condition; we could include it in About the role or maybe under a separate section like "Location/Remote" but not in allowed headings. Safer to include in About the role paragraph.
Thus About the role paragraph will include intro about Shutterfly, role description, and remote eligibility note.
Now we need to output HTML fragment only, no or . Use
for each section heading, - for lists,
for prose.
We must not repeat job title as heading. No Job ID etc.
We must not include boilerplate like diversity statement, EEO, etc. Remove that.
Now craft HTML.
Structure:
About the role
At Shutterfly, we make life’s experiences unforgettable. We believe there is extraordinary power in the self‑expression. That’s why our family of brands helps customers create products and capture moments that reflect who they uniquely are. This is an exciting time for Shutterfly, and we are looking for a Senior Application Security Engineer (Offensive / Red Team) to join our team. In this role you will help shape an evolving offensive security practice, leading Red Team engagements against Shutterfly's critical applications while partnering closely with our Blue Team throughout each engagement to produce Purple Team outcomes — stronger detections, faster response, and measurably improved defenses. We're looking for someone who is as passionate about uncovering and exploiting a vulnerability as they are about working alongside defenders to make sure it can be detected, contained, and remediated. Just as important, you'll partner with developers and engineering teams to educate them on how to prevent and avoid vulnerabilities in the first place, and guide them on how to fix issues once identified. Your focus will be on building an
Requirements
(or Qualifications). The list includes bachelor's degree, experience, etc. That's qualifications. We have Preferred Qualifications: could bePreferred Qualifications
but not in allowed headings list? The allowed list includes Qualifications (maybe we can have both Required and Preferred under Qualifications? But we need to preserve all info. Could make a single Qualifications section with subheadings? But we cannot add extra headings beyond allowed? The instruction: "use for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." It gives examples but not exclusive; we can use other headings? It says use for section headings (e.g. ...). Likely we should stick to those examples. But we have both required and preferred qualifications; we could combine them under Qualifications and differentiate with
or
- with labels. Or we could have Requirements for required, Qualifications for preferred. That seems plausible: Requirements = required qualifications; Qualifications = preferred qualifications. That matches the examples.
We also have Skills: maybe we can extract skills from responsibilities? But we may not need a separate Skills section if not explicit. The posting mentions "Proficient in one modern programming language (preferably Java) and able to review code in most major languages." etc. That's skill. Could be placed under Skills. But we already have Requirements covering many skill items. Might be redundant. The instruction: Prefer a few substantive sections over many thin ones. So we could combine skill items into Requirements or Qualifications. Probably better to have Requirements (required) and Qualifications (preferred). No separate Skills.
About the role: we can have an introductory paragraph summarizing role and mission. Use
- . Ensure we preserve all details.
Let's extract responsibilities bullets:
- Plan and lead offensive engagements against Shutterfly's applications and supporting infrastructure using established offensive and testing techniques — manual web penetration testing, exploitation, fuzzing, and adversary emulation supported by industry-standard offensive tooling — and coordinate with third-party testers when engagements call for it.
- Work hand-in-hand with the Blue Team throughout every engagement. Share tactics, techniques, and procedures in real time, validate and improve detection and alerting coverage, run collaborative exercises, and convert offensive findings into concrete defensive improvements.
- Augment conventional offensive techniques with AI and LLM-based tooling to accelerate and extend offensive and testing work — reconnaissance, payload and test-case generation, code and configuration review, and exploitation. Maintain a working understanding of how threat actors are weaponizing AI, and fold that knowledge into engagements and defensive recommendations to keep pace with a rapidly changing threat landscape.
- Manage the bug bounty program end to end — triage, impact assessment, risk scoring (CVSS), locating vulnerable code, providing mitigation guidance, thorough re-testing, and refining program policy and scope as needed.
- Identify, triage, and drive remediation of application vulnerabilities through manual testing and exploitation, escalating systemic issues to the appropriate engineering teams.
- Lead threat modeling exercises and perform risk assessments for new and existing applications, using offensive insight to prioritize the risks that matter most.
- Collaborate with incident response and Blue Team partners to investigate application-related security incidents, applying offensive expertise to scope, reproduce, and understand attacker activity.
- Help define and reinforce secure development practices, including code reviews and integration of security checks into the CI/CD pipeline.
- Perform and lead security reviews of critical PRs and code changes, and review code in most major languages.
- Partner with engineering and architecture teams to advise on secure systems and applications design, ensuring security is built in from the ground up.
- Serve as a top technical resource to engineers across the organization. Help them reproduce vulnerabilities, understand impact, document issues, and validate the effectiveness of fixes.
- Mentor junior security engineers and developers on offensive techniques, secure coding practices, and security principles. Build relationships with stakeholders and business leaders across the organization.
- Work closely with product, engineering, DevOps, defensive security, and compliance teams to align security with business goals.
- Maintain up-to-date knowledge of relevant offensive techniques, threats, mitigations, security best practices, and the evolving role of AI in both offensive operations and adversary activity.
- Make effective use of the existing security tooling stack (e.g., SAST, SCA, DAST, IAST) to support offensive and defensive work.
That's a lot; we need to keep all.
Now Required Qualifications bullets:
- Bachelor's degree in computer science, cybersecurity, or a related technical field, or comparable hands-on experience in lieu of a degree.
- Demonstrated experience leading or performing offensive security work, such as web application penetration testing or Red Team engagements, with hands-on proficiency in conventional offensive and testing techniques and industry-standard offensive tooling.
- Hands-on experience using AI/LLM tools for offensive security or testing, with an understanding of how threat actors are leveraging AI in a rapidly evolving threat landscape.
- Proficient in one modern programming language (preferably Java) and able to review code in most major languages.
- Strong analytical and problem-solving abilities with a risk-based security approach.
- Advanced user of Burp Suite Pro; bonus if you have created custom extensions in Java or Python or have used or modified existing extensions.
- Excellent communication and collaboration skills, with the ability to work across offensive and defensive teams, IT, engineering, and business stakeholders.
Preferred Qualifications bullets:
- Experience running Purple Team exercises or otherwise collaborating directly with defensive/Blue Team functions to improve detection and response.
- Full stack web development experience within an active security program.
- Experience managing a bug bounty program.
- A security certification that demonstrates proficiency in offensive security, network/web/mobile/AD assessments, secure coding, and professional report creation (for example: OSCP, OSEP, CRTO, OSWA, OSWE, GWAPT, GWEB).
- Submitted reports to bug bounty programs or VDPs, and you've found a CVE along the way.
- Strong command-line and scripting skills (bash, zsh, Python) on Linux and Mac.
- Enjoy attending security conferences and occasionally participate in CTFs.
- Spend time on cyber security training platforms (HackTheBox, TryHackMe).
- Have worked with engineering teams to develop secure code libraries.
- Capable of rapidly learning and integrating emerging tools and platforms with minimal supervision.
Now Pay and Benefits:
Pay: base pay ranges per location:
- California : [$128,000-181,250]
- Connecticut and New York: [$128,000-165,750]
- Colorado, Illinois, Minnesota and Washington: [$128,000-153,000]
- Nevada: [$120,250-165,750]
- Maryland and New Jersey: [$138,250-165,750]
- Hawaii : [$120,250-144,750]
Also mention: "This position may be eligible for a bonus incentive, health benefits, a 401K program, and other employee perks. More details about our company benefits can be found at https://shutterflyinc.com/benefits/."
Also remote eligibility: "This opportunity can be remote, but candidates must reside in a state in which Shutterfly is registered to do business. This includes all US states except District of Columbia, North Dakota, Mississippi, Rhode Island, Vermont, and Wyoming."
That could be placed under Benefits or maybe under About the role? But we have Benefits section for health benefits, 401K, etc. Remote eligibility maybe not a benefit but a location requirement; could be placed under About the role or maybe under Pay? Probably better to include in Benefits as part of "other employee perks" but remote work is a work arrangement; maybe we could add a short paragraph under Benefits about remote eligibility. However the instruction: only create Benefits section if posting actually states them. It does state health benefits, 401K program, other employee perks. So we can include those. Remote eligibility is not a benefit but a condition; we could include it in About the role or maybe under a separate section like "Location/Remote" but not in allowed headings. Safer to include in About the role paragraph.
Thus About the role paragraph will include intro about Shutterfly, role description, and remote eligibility note.
Now we need to output HTML fragment only, no or . Use
for each section heading,
- for lists,
for prose. We must not repeat job title as heading. No Job ID etc. We must not include boilerplate like diversity statement, EEO, etc. Remove that. Now craft HTML. Structure:
About the role
At Shutterfly, we make life’s experiences unforgettable. We believe there is extraordinary power in the self‑expression. That’s why our family of brands helps customers create products and capture moments that reflect who they uniquely are. This is an exciting time for Shutterfly, and we are looking for a Senior Application Security Engineer (Offensive / Red Team) to join our team. In this role you will help shape an evolving offensive security practice, leading Red Team engagements against Shutterfly's critical applications while partnering closely with our Blue Team throughout each engagement to produce Purple Team outcomes — stronger detections, faster response, and measurably improved defenses. We're looking for someone who is as passionate about uncovering and exploiting a vulnerability as they are about working alongside defenders to make sure it can be detected, contained, and remediated. Just as important, you'll partner with developers and engineering teams to educate them on how to prevent and avoid vulnerabilities in the first place, and guide them on how to fix issues once identified. Your focus will be on building an
- for lists,
About the role
with. Responsibilities: list from "What You'll Do Here". We'll need to capture each bullet as