Scope of work

In coordination with FPF’s other engineers and researchers, the contractor will:

Conduct application security reviews across SecureDrop components.
Assist in performing threat modeling for new features and architectural changes.
Review pull requests and design documents with a focus on the security properties of new features and the security implications of architectural changes.
Assist in preparing materials for and reviewing findings from third-party security audits.
Advise on hardening strategies for SecureDrop’s deployment environments.
Review and integrate security automation tooling, such as LLMs, static code analyzers, and other tools that can mitigate or discover security vulnerabilities.

Desired qualifications

At least three-plus years experience designing or attacking secure systems (threat modeling, penetration testing, security assessments, protocol design, etc.).
Production coding experience using at least two of the following: Python, Typescript, or Rust.
Strong working knowledge of Linux systems security (kernel hardening, AppArmor, SELinux, etc.).
Experience identifying and reasoning about browser/web vulnerabilities (XSS) and Electron-specific issues (file handling, IPC, etc.).
Comfort working with open source projects in a collaborative, distributed team environment.

Preferred skills

One-plus year of professional experience with Qubes OS, Tails, or other high-security desktop environments.
One-plus year of professional incident response experience.
Using or developing security monitoring tools (e.g., intrusion detection systems, file integrity monitoring).
Familiarity with Tor, onion services, OpenPGP, and other privacy-enhancing technologies.

Terms of contract

This is a part-time, hourly contract — the contractor will be paid at a rate of USD $80 per hour, up to 30 hours per week, invoiced on a monthly basis. The contractor will be solely responsible for paying any and all taxes incurred as a result of their compensation.

The contract will commence on a mutually agreeable date no later than Aug. 1 for an initial duration of six months, with the possibility of renewal.

Proposal requirements

If you would like to be considered for this opportunity, please submit the following:

A brief statement of interest (one-page maximum), which includes your availability (hours per week in U.S. Eastern time and any known constraints). Please do so by including that text in the space labeled “Cover Letter.”
- Please be sure to include relevant experience or examples of prior work (links to GitHub, write-ups, audits, etc.).
A CV/résumé.

Freedom of the Press Foundation (FPF) remote jobs

RFP -- DigiSec Trainer

RFP -- Security Researcher