Security Developer
at Python Software Foundation

Work with the Python Security Response Team, Python core team, and PyPI administrators to keep Python secure. Drive vulnerability reports to remediation and advisories, mitigate malware on PyPI, and develop solutions to scale the response capacity.

Core responsibilities:

• Triage and remediate vulnerabilities in CPython and related projects in coordination with the Python core team.
• Remediate malware and supply-chain attacks for projects on the Python Package Index (PyPI).
• Maintain and operate infrastructure for the Python Security Response Team, PSF CVE Numbering Authority, and security tools used by Python such as OSS-Fuzz.
• Propose and develop improvements to security workflows to scale response to future demand.

Standards/documentation/communications:

• Develop and refine vulnerability and secure development practices with the Python Security Response Team and Python core team.
• Work with the Python core team to document security/threat models for Python, the standard library, and related projects.
• Research, author, and publish public communications about security metrics, impact, and potential future work.

Qualifications:

• 3–5 years experience with Python or C.
• Knowledge of vulnerabilities affecting C programs (e.g., memory safety issues).
• Strong asynchronous and written communication skills; ability to manage and prioritize multiple concurrent threads.
• Open source/community experience is a plus.
• Desired: secure development practices for Python/C; vulnerability disclosure/CVE/threat models; experience with fuzz-testing and address/memory sanitizers; technical documentation; open source/pubic collaboration.

Logistics:

• Global remote; regular collaboration with US time zones required.
• Travel: one trip per year to PyCon US.
• Term: 1 year with possibility of renewal.