Software Engineer, Security

Job Description

About Harvest

Harvest is an industry-leading, independent software company that makes tools to help businesses run more smoothly. We believe that businesses only succeed by using their time intentionally. Our products support our customers through time tracking, reporting, and forecasting features.

Harvest started in 2006 as a team of three and has grown to today’s current team of almost 70 with Harvesters working from around the globe. We’ve worked as a remote team since the beginning and we continue to hire the right people for the job no matter where they call home.

We strive to create a workplace culture where everyone feels valued, included, and heard. One important aspect of this is continuing to create spaces for diverse life experiences and work histories. If you are a member of a group that is historically underrepresented and disadvantaged in tech, business, and society in general, we want to meet you and we encourage you to apply.

At Harvest, you’ll be working with a team of honest and respectful engineers who value giving and receiving feedback and trust that they can count on each other.

The Harvest Engineering Department consists of four divisions: Software Engineering, Site Reliability Engineering, Data & Security Engineering, and Quality Engineering.

Our Security team works with all the Engineering departments to keep our web, mobile, and desktop applications safe and secure while helping the rest of the company to maintain a secure work environment.

Security at Harvest previously existed as a shared responsibility between different teams at Harvest. We are now taking an important step to create a dedicated Security team within the Engineering organization. The Security Engineer would be a founding member of this brand new team at Harvest.

As a Security Engineer at Harvest, you’ll be working to improve our security stance in all areas. Here are some real examples of the work we’ve done lately that might help you get a better idea of what this job entails:

• Develop alerts to keep tabs on suspicious activity in our applications.
• Monitor external credential breaches and force a password reset for users that could be affected.
• Automate our security audits on work machines.
• Deal with spam, credential stuffing, and fraud attempts.
• Field a security researcher’s reports of security issues, from validation to fix and bounty award.
• Improve our external and internal security documentation.

What You’ll Do

• Contribute to the development of security tooling, security policy, and product security.
• Help manage our public bug bounty program: triaging, fixing and coordinating with affected teams to address valid findings.
• Work side-by-side with cross-functional development teams, bring awareness of secure coding practices, and teach developers application security fundamentals.
• Dive into spam, fraud, and other security related investigations, combing through large volumes of logs to identify anomalies or patterns, and develop protections based on them.
• Monitor third-party dependency vulnerability reports and apply fixes and mitigations
• Work with a diverse, remote-first team of kind humans that span the globe.

Who You Are

• You are a great communicator who can explain technical issues and security risks to a broad, non-technical audience. You work well with engineering, support, product, legal, and the executive team. You tailor your communication style, level of detail, and approach based on the audience.
• You operate effectively across teams and disciplines and have a strong background in engineering.
• You are able to empathize with a diverse range of engineers.
• You balance reaching out for help from others with researching solutions on your own. You know where to find answers and when to ask for assistance.
• You care about the details, but not at the cost of the big picture. You believe finishing and shipping a good project is better than waiting for perfection.
• You believe feedback is a gift, seek it out, and act on it.

What You’ve Done

• You know what makes browsers, web, and native applications secure and have knowledge of common security vulnerabilities and mitigations.
• You've written robust and reliable production code in a modern language or framework such as JavaScript, Node.js, Ruby on Rails, or have a strong interest in learning these technologies.
• You've worked in a security role in the past or have equivalent experience and interest in learning modern security standards.

At Harvest, our compensation consists of three main components:

• A competitive base pay: Every Harvester with the same role expectations receives the same base pay. And we aim to pay at the top of the market (informed by third-party data) for all roles.
• Individual and company performance bonus plans: We believe in rewarding performance, so all Harvesters are eligible to receive an individual and company performance bonus after working with Harvest for a period of time.
• Competitive benefits*: We offer a number of benefits, including
  • 15 days of vacation in your first year, plus company holidays and a week off for winter break. And you’ll get an additional two days per year until you reach twenty days.
  • 100% coverage of health insurance premiums across our medical, dental, and vision plan offerings for you, your spouse, and your dependents
  • A yearly budget for your professional learning and development goals
  • 401k plan with a 6% company match after three months with the company
  • 16 weeks of paid family leave to all new parents with the option to use it all at once or throughout the baby’s first year as well as a virtual platform providing support across fertility, pregnancy, adoption, and through your first year of parenting
  • A charitable giving matching program to support your contributions to your favorite charitable organizations
  • And much more...

*Some of the benefits described are only available to U.S.-based Harvesters. Benefits information for non-U.S.-based Harvesters will be provided to individuals who interview for those roles.