About TikTok
TikTok is the leading destination for short-form mobile video. At TikTok, our mission is to inspire creativity and bring joy. TikTok's global headquarters are in Los Angeles and Singapore, and we also have offices in New York City, London, Dublin, Paris, Berlin, Dubai, Jakarta, Seoul, and Tokyo.
Why Join Us
Inspiring creativity is at the core of TikTok's mission. Our innovative product is built to help people authentically express themselves, discover and connect – and our global, diverse teams make that possible. Together, we create value for our communities, inspire creativity and bring joy - a mission we work towards every day.
We strive to do great things with great people. We lead with curiosity, humility, and a desire to make impact in a rapidly growing tech company. Every challenge is an opportunity to learn and innovate as one team. We're resilient and embrace challenges as they come. By constantly iterating and fostering an "Always Day 1" mindset, we achieve meaningful breakthroughs for ourselves, our company, and our users. When we create and grow together, the possibilities are limitless. Join us.
Diversity & Inclusion
TikTok is committed to creating an inclusive space where employees are valued for their skills, experiences, and unique perspectives. Our platform connects people from across the globe and so does our workplace. At TikTok, our mission is to inspire creativity and bring joy. To achieve that goal, we are committed to celebrating our diverse voices and to creating an environment that reflects the many communities we reach. We are passionate about this and hope you are too.
About the team
PDPO(Privacy and Data Protection Office) is the organization to lead, supervise, and empower all TikTok's privacy work in an accountable and industry leading way. This team is the expert in the landscape of privacy risks and passionate about consulting across the company on implementing the proper safeguards and technical mitigations to ensure that our users’ privacy is honored across the TikTok's products and platforms.
Job Responsibilities/ What you’ll do:
- Conduct in-depth technical assessments focused on finding privacy issues in internal and external facing systems, products, and services.
- Collaborate closely with engineering and product teams to integrate privacy-preserving security measures throughout the software development lifecycle (SDLC).
- Research and analyze emerging threats in privacy, proactively identifying mitigation strategies and testing methodologies to protect user data.
- Automate privacy-focused assessments through tooling, scripts, and frameworks to enhance scalability and efficiency.
- Support the development of practices, processes, mechanisms, and the documentation for these activities, both internally and with working groups.
Knowledge, Skills & Abilities:
- Strong Computer Science, Security engineering and Privacy engineering fundamentals
- Deep understanding of privacy engineering concepts (such as data minimization, anonymization, secure data processing)
- Strong foundation in penetration testing / red teaming
- Strong foundation in manual secure code review, with the ability to identify privacy vulnerabilities, security flaws, and data leakage risks in applications and services.
- Able to collaborate, prioritize duties, and work well on your own
- Excellent interpersonal and communication skills, with the ability to work cross-functionally with engineering, legal, and compliance teams.
Minimum Qualifications:
- 4+ years work experience in web security or data security
- Experience in Penetration Testing or Red Team exercises
- Strong ability to analyze complex systems for privacy risks and provide actionable privacy recommendations.
- Ability to understand and apply privacy foundational concepts
Preferred Qualifications:
- Experience making contributions to the security or privacy community, such as public research, blogging, presentations, bug bounties, CVEs, etc.
- Experience with common testing frameworks, such as the MITRE ATT&CK framework
- 2+ years work experience with scripting language including code maintenance and review
- Experience implementing or assessing the implementation of GDPR, CCPA, or equivalent privacy regulation
- Experience with tools used to perform Dynamic Application Security Testing (DAST) or Static Application Security Testing (SAST)
