Imagine a world in which the engineers own security. In this world, each pull request has an associated security review. Threat modeling is performed by the engineers, in an automated tool. Each threat has a corresponding security test case. Product Security is involved directly only in 10-20% of the security reviews thanks to a network of security partners - software engineers in their engineering teams.

This is how we run Product Security at Snowflake. We automate everything we can to focus on impactful projects. We store all deliverables in a structured way: threats, mitigations, and security findings. And we keep all JIRA, Github, and scanner output in the same place. We call it the AppSec Data Lake. With one SQL query, we can list all PRs that were merged without a security review. With another SQL query, we can match a security finding to an owner and their manager. With the power of LLMs and Cortex (in Private Preview), we don’t even need to write those SQL queries - you can prompt Snowpilot to write SQL for you and pass the query results to an LLM.

This allows us to focus on pure Product Security. On our team, we work in accordance with our core principles. We implement those principles with policies, processes, and tooling. We have data that guides us - it helps us stay on course and report to all stakeholders whether we are, or not, going in the right direction. Meet the Product Security teams in Warsaw:

Security engineers:

The application Security Assurance team is responsible for almost 20 services - from our Developer-Driven Security, through Program Analysis, SBOM, and Secret Scanning to Vulnerability Management.
Security engineers are the owners of 12-24 month roadmaps for the above services and they execute the projects that span from a quarter to multiple quarters or years of initiatives.
Security engineers provide guidance and consultation for the engineering teams

Pentesters:

Pentesters are directly involved in a lot of high-risk projects. They execute engagements that span from a week to many months, depending on a feature.
Pentesters also have quarterly initiatives that include research, opportunistic pentests, and collaboration with the Red Team.

Cloud Security:

Cloud Security is also structured with services and roadmaps - multiple CloudSec initiatives include Cloud Security Posture Management, Runtime Security, Endpoint Detection and Response, and Cloud Access Management.
Cloud Security Engineers are responsible for the overall cloud security posture. Snowflake is cloud-agnostic - we don’t focus solely on one CSP.

All in all, we are looking for engineers who are passionate about technology, products, and people. We admire individuals who aren't afraid to push the boundaries and make a meaningful impact. If this sounds like a place for you, let's chat! You can find our open roles here.

security_BlogTeamPhoto-BlogOGImage1200x630