Senior Security Engineer

As a Senior Security Engineer on the Workvivo team, you will play a meaningful role in safeguarding an employee experience platform used by organizations around the world. Your work spans the full Workvivo platform, from web and mobile applications to AWS infrastructure, giving you breadth and depth across modern security disciplines. You will collaborate closely with application engineering teams to embed security from the earliest stages of the development lifecycle, and engage cross-functionally with Zoom Security partners across Bug Bounty, Incident Response, and Vulnerability Management.

This is a role for someone who finds real satisfaction in building security programs alongside great teams, and who is energized by the opportunity to shape how security is practiced across a growing global product.

Workvivo is an employee experience platform built to amplify workplace culture and keep people connected, regardless of where they work. As part of Zoom, Workvivo operates within a broader mission to enable meaningful connections and modern collaboration for businesses and individuals worldwide. The security team supporting Workvivo works across a range of disciplines, from application and infrastructure security to cross-functional engagement with Zoom’s global Security organization.

• Conduct security assessments, code reviews, and penetration testing across the Workvivo platform (Web App, Mobile App, and AWS Infrastructure), identifying and managing vulnerabilities in close collaboration with Security, Infrastructure, and Application Engineering teams.
• Lead threat modeling and risk assessments for new features and infrastructure changes, engaging Application Engineering teams early in the design phase to embed security controls before deployment.
• Advance SDLC security practices by advising on DAST, SAST, and SCA tooling, securing CI/CD pipelines, and building automated security solutions to scale detection and response.
• Contribute to Zoom’s Engineering Security training program and collaborate cross-functionally across Zoom Security functions including Bug Bounty, Incident Response, SOC, Vulnerability Management, and Customer Security Assurance (CSA).

• Proven experience conducting penetration tests focused on web applications, APIs, and mobile platforms, with the ability to move beyond surface-level findings and critically analyze vulnerability and penetration test reports from external partners and customers.
• Experience in application security, software development, or related disciplines, with a solid understanding of secure coding practices and application security frameworks.
• Proficiency in at least one programming language (such as PHP, Go, Java, or C++) and hands-on experience with security tooling including Burp Suite, Invicti (Netsparker), and OWASP ZAP, with familiarity with security protocols and encryption methods.
• Working knowledge of AWS environments and cloud security principles.
• Ability to produce architectural diagrams with a focus on the security control plane.
• Strong written and verbal communication skills, with the ability to explain complex security issues to both technical and non-technical audiences, and a genuine curiosity for emerging security technologies.

Our structured hybrid approach is centered around our offices and remote work environments. The work style of each role, Hybrid, Remote, or In-Person is indicated in the job description/posting.

As part of our award-winning workplace culture and commitment to delivering happiness, our benefits program offers a variety of perks, benefits, and options to help employees maintain their physical, mental, emotional, and financial…