Our security team supports the unwritten fourth tenet of Slack’s mission: make people’s working lives more secure. We’re serious about protecting our infrastructure, operations, and most importantly, our customers’ data. We take a systemic approach to security and strive to ensure that we provide low friction, high-impact security across everything we do. We’re looking for a developer to help contribute to our Security Engineering team. Relevant in-field experience is absolutely not a requirement but an interest in security, curiosity and a deep desire to learn is paramount.
A significant part of this job is meant to attract a multidisciplinary engineer; you probably feel skeptical of any job posting with the word “DevOps” in it, or even “SecDevOps,” but that is what you do. While we don’t work directly on hardening systems (there’s a vulnerability management team which does that), we would ask for your help in evaluating tooling pragmatically—particularly when the right choice is to spend some money or when months of development would be advantageous.
In a typical day, we might review the infrastructure security aspects of a new bit of software to be deployed in concert with AWS native services, add some alerting rules for a newly learned IOC, and work to scale out some of our core authn/authz services. We work across large swaths of the engineering organization, and look to bring on someone interested to talk to a lot of people about how to do things more securely.
Slack has a positive, diverse, and supportive culture—we look for people who are curious, inventive, and work to be a little better every single day. In our work together we seek to be smart, humble, hardworking and, above all, collaborative. If this sounds like a good fit for you, why not reach out?
What you will be doing
- Develop novel software that helps Slack be more secure in its production infrastructure.
- Creatively scale and operate the infrastructure and tools that handle millions of events per second, as well as participate in an on-call rotation to support these tools
- Write some go: we developed the novel alerting mechanism go-audit which turns out to be quite an interesting scaling problem and focused on a pre-containerized world.
- Work on networking software: This team also is responsible for the production, development and ongoing extensions to the Nebula overlay network.
- Get excited about some “ops” things - terraform, ansible, ubuntu are all keywords for our daily work.
What you should have
- Curiosity and creativity. We’re looking for individuals to join the team who very much want to know why something happened in addition to just that it happened. We have a lot of ideas, but are hopeful that your perspective will push us all forward together to deeper understanding.
- Proficiency both in a practical systems programming language and the shell of your choice. We write Go and shell, but are interested to see where you shine.
- Motivation to solve problems, not to patch over quick fixes. This is at the root of our goal to be on-call for our own services. Being on-call shouldn’t be a burden to team members. If it ever is, fixing it is our highest priority.
- We seek a candidate eager to collaborate across the company as we further our approachable and inclusive team ethos. As a software development team first, we are actively aligned and working with the rest of engineering.
- Broad exposure to various security approaches and deeper understanding of models and principles behind core security concepts such as MFA and securely managing secrets or tokens.
- A few years of experience - at this level, 2-5 years of experience is a typical guidepost, but in no way a requirement.
- Golang—we’ve written wide-reaching tools in Golang, but we aren’t wedded to it.
- Ansible—it’s not that bad, and helps us move quickly, but any configuration management tool is applicable.
- Elasticsearch / Kibana—you can readily access information and love metrics.
Slack is registered as an employer in many, but not all, states. If you are not located in or able to work from a state where Slack is registered, you will not be eligible for employment. Visa sponsorship may not be available in certain remote locations.
Visa sponsorship is not available for candidates living outside the country of this position.
For Colorado-based roles: Minimum annual salary of $121,800. This base pay is for illustrative purposes only. This position is eligible for additional compensation and benefits including: incentive compensation; health benefits; flexible spending account; retirement benefits; life insurance; commuter benefits; paid time off (including PTO, emergency time off, paid sick leave, medical leave, volunteer time off, civic duty leave, bereavement leave, floating holidays and paid holidays); parental leave and benefits; mobile phone and internet allowance; perks stipend; and other employee perks and benefits.
The actual offer, reflecting the total compensation package and benefits, will be at the company’s sole discretion, and determined by a myriad of factors including, but not limited to, years of experience, depth of experience, and other relevant business considerations. The company also reserves the right to amend or modify employee perks and benefits at any time.
At Salesforce we believe that the business of business is to improve the state of our world. Each of us has a responsibility to drive Equality in our communities and workplaces. We are committed to creating a workforce that reflects society through inclusive programs and initiatives such as equal pay, employee resource groups, inclusive benefits, and more. Learn more about Equality at Salesforce and explore our benefits.
Salesforce.com and Salesforce.org are Equal Employment Opportunity and Affirmative Action Employers. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender perception or identity, national origin, age, marital status, protected veteran status, or disability status. Salesforce.com and Salesforce.org will not pay any third-party agency or company that does not have a signed agreement with Salesforce.com or Salesforce.org.
Salesforce welcomes all.