Security Researcher

🔥 27 minutes ago

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Freedom of the Press Foundation

WebsiteLinkedInAll Job Openings

11 - 50 employees

Founded 2012

🤝 Non-profit

📱 Media

🔒 Cybersecurity

💰 $480k Grant - Freedom of the Press Foundation on 2013-12

Non-profit • Media • Cybersecurity

Freedom of the Press Foundation is a nonprofit organization that protects and defends press freedom by supporting journalists and whistleblowers. It publishes reporting on government secrecy, surveillance, and journalists' rights; develops and maintains open-source security tools for journalists and newsrooms (notably SecureDrop and Dangerzone); runs the U. S. Press Freedom Tracker database documenting press freedom incidents; and provides digital security training and resources. The organization also advocates on issues such as government surveillance and the legal rights of reporters, and solicits donations and public action to support its work.

📋 Description

• Conduct application security reviews across SecureDrop components. • Assist in performing threat modeling for new features and architectural changes. • Review pull requests and design documents with a focus on the security properties of new features and the security implications of architectural changes. • Assist in preparing materials for and reviewing findings from third-party security audits. • Advise on hardening strategies for SecureDrop’s deployment environments. • Review and integrate security automation tooling, such as LLMs, static code analyzers, and other tools that can mitigate or discover security vulnerabilities.

🎯 Requirements

• At least three-plus years experience designing or attacking secure systems (threat modeling, penetration testing, security assessments, protocol design, etc.) • Production coding experience using at least two of the following: Python, Typescript, or Rust. • Strong working knowledge of Linux systems security (kernel hardening, AppArmor, SELinux, etc.) • Experience identifying and reasoning about browser/web vulnerabilities (XSS) and Electron-specific issues (file handling, IPC, etc.) • Comfort working with open source projects in a collaborative, distributed team environment. • One-plus year of professional experience with Qubes OS, Tails, or other high-security desktop environments (preferred). • One-plus year of professional incident response experience (preferred). • Using or developing security monitoring tools (e.g., intrusion detection systems, file integrity monitoring) (preferred). • Familiarity with Tor, onion services, OpenPGP, and other privacy-enhancing technologies (preferred).