Software Engineer II - Product Security

About this role

<div class="content-intro"><p>StubHub is on a mission to redefine the live event experience on a global scale. Whether someone is looking to attend their first event or their hundredth, we’re here to delight them all the way from the moment they start looking for a ticket until they step through the gate. The same goes for our sellers. From fans selling a single ticket to the promoters of a worldwide stadium tour, we want StubHub to be the safest, most convenient way to offer a ticket to the millions of fans who browse our platform around the world.</p></div><p><span class="TextRun SCXW40244755 BCX0" lang="EN-US" data-contrast="auto"><span class="NormalTextRun SCXW40244755 BCX0"><span class="TextRun SCXW249813186 BCX0" lang="EN-US" data-contrast="none"><span class="NormalTextRun SCXW249813186 BCX0">StubHub's Product Security Engineering Team is seeking a Software Engineer II to enhance our security posture within the end user and services product domain. The perfect candidate will&nbsp;</span><span class="NormalTextRun SCXW249813186 BCX0">possess</span><span class="NormalTextRun SCXW249813186 BCX0"> experience in CI/CD pipeline security, product and application architecture reviews, contextualized vulnerability management processes, and automation.</span></span><span class="EOP SCXW249813186 BCX0" data-ccp-props="{"201341983":0,"335559739":160,"335559740":279}">&nbsp;</span></span></span></p> <p><span class="EOP SCXW40244755 BCX0" data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}"><em data-start="36" data-end="89">Location: Hybrid (3 days in office/2 days remote) – New York, NY or Century City, CA&nbsp;</em></span></p> <p><strong><span class="TextRun SCXW40244755 BCX0" lang="EN-US" data-contrast="auto"><span class="NormalTextRun SCXW40244755 BCX0">About the team:&nbsp;</span></span></strong></p> <p><span class="TextRun SCXW40244755 BCX0" lang="EN-US" data-contrast="auto"><span class="NormalTextRun SCXW40244755 BCX0">StubHub’s Product Security Engineering Team plays a critical role in securing the platforms that power the world’s largest ticket marketplace. This team</span><span class="NormalTextRun SCXW40244755 BCX0"> works hands-on with&nbsp;</span><span class="NormalTextRun SCXW40244755 BCX0">cutting-edge</span><span class="NormalTextRun SCXW40244755 BCX0"> tools and cloud-native technologies to embed security into every layer of the software development lifecycle—from architecture to automation. If </span><span class="NormalTextRun SCXW40244755 BCX0">you're</span><span class="NormalTextRun SCXW40244755 BCX0"> passionate about offensive security, CI/CD hardening, and driving real impact across modern product teams, this is your opportunity to lead and innovate at </span><span class="NormalTextRun ContextualSpellingAndGrammarErrorV2Themed SCXW40244755 BCX0">global</span><span class="NormalTextRun SCXW40244755 BCX0"> scale.</span></span></p> <div class="section page-centered" data-qa="job-description"> <div class="section page-centered" data-qa="job-description"> <div> <p><strong>What You’ll Do:</strong></p> <ul> <li><span data-contrast="auto">Conduct security assessments, code reviews, and penetration tests on web applications, APIs, and mobile apps to identify vulnerabilities and flaws.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}">&nbsp;</span></li> <li><span data-contrast="auto">Collaborate with development teams to embed security into CI/CD pipelines, including the implementation of automated code scanning tools.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}">&nbsp;</span></li> <li><span data-contrast="auto">Develop and maintain secure coding guidelines and conduct security awareness training for developers.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}">&nbsp;</span></li> <li><span data-contrast="auto">Respond to security incidents, perform root cause analyses, and recommend effective remediations.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}">&nbsp;</span></li> <li><span data-contrast="auto">Stay current on emerging security threats, vulnerabilities, and mitigation strategies; proactively share insights across teams.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}">&nbsp;</span></li> <li><span data-contrast="auto">Help develop and enforce application security policies, standards, and procedures aligned with industry regulations and best practices.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}">&nbsp;</span></li> <li><span data-contrast="auto">Conduct architectural reviews to ensure the security of new technologies and controls.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}">&nbsp;</span></li> <li><span data-contrast="auto">Build and maintain robust product vulnerability management processes and procedures.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}">&nbsp;</span></li> <li><span data-contrast="auto">Write and maintain production-grade APIs to automate security processes and streamline infrastructure and developer workflows.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"335559739":240,"335559740":279}">&nbsp;</span></li> <li><span data-contrast="auto">Triage and respond to findings from StubHub’s enterprise Bug Bounty program.</span><span data-ccp-props="{"134233117":false,"134233118":false,"201341983":0,"335559738":240,"3