Application Security Engineer

A World-Changing Company

Palantir builds the world’s leading software for data-driven decisions and operations. By bringing the right data to the people who need it, our platforms empower our partners to develop lifesaving drugs, forecast supply chain disruptions, locate missing children, and more.

The Role

Our products support some of the most important and impactful work in the world, including defence, intelligence, and commercial applications. We are trusted by our customers to protect their mission-critical information in the face of advanced persistent threats.

As an Application Security Engineer, you will be hands-on and have wide-ranging impact for the security of Palantir:

• Product security reviews. You will perform full-scope security reviews of our current and future product and service portfolio. This includes whitebox, greybox, and blackbox assessments. You will work with offensive security teams, engineering teams, and other members of the InfoSec organisation to harden our products against our dedicated adversaries.

• Architecture and design. You will be the security subject matter expert for product architects and engineers. You will threat model, assess risks, and help implement security controls and mitigations to address identified issues. You will directly steer the design of our products to ensure we are secure-by-default.

• Strategic security initiatives. You will be empowered to own transformational security initiatives that impact the whole company. Members of the Application Security Team have implemented software supply chain security controls (e.g., in-toto), implemented hardware-backed GPG key signing for commits, developed new security services, implemented security automation, or worked on massive-scale security problems.

• Vulnerability identification and analysis. You will be responsible for finding new and novel ways to identify and resolve security vulnerabilities in our products. This includes static and dynamic code analysis, security scanning, investigation of security reports from InfoSec, our bug bounty programme, or other trusted partners, and direct work with our incident response team on product security issues and incidents.

This role has wide-reaching impact, strong autonomy, and the resources and empowerment to make significant security improvements across all Palantir.

Core Responsibilities

• Perform deep architecture and security reviews on highly complex products to identify vulnerabilities

• Lead engineering teams in feature design, threat modelling, and security-critical code and architecture

• Develop and implement automation to eliminate entire classes of weaknesses across the organisation

• Drive decision-making by determining the trade-offs between security and product design

• Lead implementation of strategic security initiatives that improve security across Palantir

What We Value

• Self-motivated, experience in solving complex problems

• History and experience designing and shipping production-ready software

• Strong communication and collaboration skills who feels comfortable working closely with engineering teams

• Ability to learn and apply new technologies quickly and in complex deployments

What We Require

• Development or software engineering experience and a deep passion for information security

• Experience with a modern high-level programming language (e.g. Java, Golang, Javascript, Python, etc.)

• Demonstrated experience evaluating code for vulnerabilities and weaknesses

• Experience with complex architectures and codebases (e.g. SOA or micro-services)

• Experience utilising/with CodeQL or other static code analysis platforms

• Experience performing black-box testing of web applications

Additional Information

The estimated salary range for this position is estimated to be $135,000 - $200,000/year. Total compensation for this position may also include Restricted Stock units, sign-on bonus and other potential future incentives. Further note that total compensation for this position will be determined by each individual’s relevant qualifications, work experience, skills, and other factors. This estimate excludes the value of any potential sign-on bonus; the value of any benefits offered; and the potential future value of any long-term incentives.