Job Description

The mission of TikTok's Global Security Organization is to build and earn trust by reducing risk and securing our businesses and products. Also known as "GSO", this team is the foundation of our efforts to keep TikTok safe, secure, and operating at scale for over 1 billion people around the world. We work to ensure that the TikTok platform is safe and secure, that our users' experience and their data remains safe from external or internal threats, and that we comply with global regulations wherever TikTok operates.

Trust is one of TikTok's biggest initiatives, and security is integral to our success. In whatever ways users interact with us — whether they're watching videos on their For You page, interacting with a Live video, or buying products on TikTok Shop — GSO protects their data and privacy, so they can have a secure and trustworthy experience.

We are seeking a Posture Management Specialist to own and continuously improve our organization's security posture across system infrastructure, cloud, network, endpoint, office environment, identity, and data domains. This is an individual contributor role that bridges deep technical expertise with strategic leadership, ensuring our platforms serving billions of users maintain a world-class defense-in-depth posture.

You will be responsible for defining the security posture management strategy, driving automated remediation, and translating complex technical risks into actionable business insights for executive leadership.

Key Responsibilities

Strategy & Program Leadership

- Define and own the enterprise security posture management roadmap to address risks for threat management.

- Establish OKRs and maturity benchmarks that demonstrate continuous risk reduction and program effectiveness

- Lead cross-functional initiatives to reduce attack surface across cloud, internal platforms, and products

- Drive the "Prevent → Assure → Test → Fix → Prove" lifecycle across the organization

Continuous Monitoring & Risk Assessment

- Monitor security posture across all environments and automate detection of misconfigurations, access drift, and compliance deviations

- Assess and prioritize vulnerabilities and insecure configurations using predictive analytics, and threat intelligence

- Conduct and oversee adversary emulation and leverage red team etc to identify key security risks.

- Lead attack surface reduction initiatives and ensure new technologies are assessed before deployment

Tooling & Automation

- Design and implement PoC projects for new posture management tools and processes

- Integrate/build posture management tooling with CI/CD pipelines and enterprise monitoring/ticketing systems

- Build automation for finding ownership, severity tuning, and auto-remediation to prevent alert fatigue

Stakeholder Communication & Governance

- Translate complex technical vulnerabilities into actionable business risks for executive leadership, Legal, Risk & Compliance, and Engineering

- Define and maintain SOPs and Rules of Engagement for security testing across modern tech stacks (Kubernetes, Serverless, Mobile)

- Collaborate with Blue Teams, Control Owners, and Engineering to track findings through to completion

- Report posture metrics and risk trends to senior leadership on a regular cadence

Team Development

- Mentor, and help grow a specialized team of posture analysts, offensive security engineers, and control assessors

- Foster a culture of continuous research, innovation, and knowledge sharing