To add a few details to the people section of this: If you want to see a great résumé, check out Michal Zalewski's - it's on his website. He is also responsib

To add a few details to the people section of this: If you want to see a great résumé, check out Michal Zalewski's - it's on his website. He is also responsible for American Fuzzy Lop, which is an incredible fuzzing tool for application software[1]. In fact, read his book, The Tangled Web as well, because that should be on every developer's shelf, security engineer or otherwise. It has security best practice checklists covering how the internet and browser works with enough technical detail for developers to safeguard themselves against the most common pitfalls. Google also employs Eduardo Vela Nava on their security team, who is known for his research in browser encodings, legacy compatibility settings and how these lead to serious security flaws (see Web Application Obfuscation). If there is a way to trigger cross-site scripting on a web application, Vela Nava can achieve it (and he can find it as well). He is a leading expert on web browsers and their various (in)security mechanisms. Then you have Chris Evans, who leads the Chrome Security team and singlehandedly wrote vsftpd, the primary ftp server shipped with Red Hat and SuSE. He built the Chrome security team into what it is today by hiring the best talent from around the world. This list goes on, and on, and on. Google has attracted many of the greatest minds of this generation in information security. [1]: http://lcamtuf.coredump.cx/afl/ http://lcamtuf.coredump.cx/afl/