Product Security Engineer

This is a fully remote position, open to applicants in Netherlands.

📋 Description

• Work collaboratively with engineering and product teams to enhance existing features and develop new ones, emphasizing threat modeling, assurance, and secure implementation. Recent projects include secure key management, passwordless authentication, M2M authentication, sandboxing, and isolation for compute, network, and storage.

• Detect security vulnerabilities and gaps in ClickHouse Cloud and OSS, manage a diverse range of vulnerabilities reported through our bug bounty program, responsible disclosure, and GitHub Issues, addressing issues across web, API, and server-client assets, including low-level memory problems such as heap and buffer overflows.

• Enhance and create security assurance activities, including penetration tests, vulnerability assessments, bug bounty initiatives, and fuzzing.

• Propel the implementation and use of engineering security tools such as static and dynamic code analysis, dependency checks, and code licensing compliance (familiarity with tools like Snyk, Semgrep, GitHub CodeQL is essential).

• Foster the relationship between engineering and security, identifying and executing process and technological enhancements.

• Manage information security incidents and events across ClickHouse products and services.

• Create processes, tools, and automation to scale security measures and alleviate risks to the business.

⛳️ Requirements

• Proven experience in supporting engineering and product implementation by conducting threat assessments, assurance activities, and providing advisory services, as well as performing implementation work across distributed systems involving web, API, and client/server assets.

• Strong expertise in and experience with one or more cloud service providers (such as AWS, GCP, Azure), Kubernetes, and Cilium.

• Experience in implementing and managing engineering security tools and processes, including static/dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, and client and network fuzzing tools.

• Significant development and automation experience, with the ability to work with C++ code.

• A security-as-code mindset focused on addressing challenges through automation and scalability.

🏝️ Benefits

• Flexible work environment - ClickHouse is a globally distributed and remote-friendly company, currently operating in over 20 countries.

• Healthcare - Employer contributions towards your healthcare coverage.

• Equity in the company - All new team members receive stock options upon joining.

• Time off - Flexible time off in the US, with generous entitlements in other countries.

• A $500 home office setup for remote employees.

• Global Gatherings – We value the importance of in-person connections and provide opportunities for engagement with colleagues through company-wide offsites.