Web安全研发工程师/专家（账号安全方向） - 抖音研发
Core
Design and implement Web account security mechanisms, including zero-trust systems, session binding, and anti-replay attacks, to protect user accounts from theft and abuse.
Role type
Senior IC Web Security Engineer (Account Security)
Builds
Web security SDKs, public components, and zero-trust authentication systems for TikTok's ecosystem
Domain
Internet / Web Security / Account Protection
Required skills
JavaScript/TypeScript, Web SDK development, Browser security model expertise, Session management, Request signing, Anti-replay mechanisms, XSS mitigation, Cross-origin resource sharing (CORS) handling, Web Crypto API, Attack chain analysis, Environment detection
Preferred skills
WebAuthn/Passkey implementation, Device binding, Browser debugging, Protocol analysis, Reverse engineering, Anti-automation systems
Technologies
JavaScript, TypeScript, Web Crypto, WebAuthn, Passkey, Zero-trust architecture
Responsibilities
Design and implement session binding and key management mechanisms; Develop and maintain Web security SDKs and public components; Analyze attack vectors like script abuse and headless browsers; Design identity verification and session recovery flows for high availability.
