Senior Product Security Engineer

This is a fully remote position, open to applicants in Netherlands, +7 more countries.

📋 Description

• Collaborate with engineering and product teams on both existing and new product features, with an emphasis on threat modeling, assurance, and secure implementation.

• Identify security vulnerabilities and gaps within ClickHouse Cloud and OSS.

• Manage vulnerabilities reported via bug bounty programs, responsible disclosure, and GitHub Issues across web, API, and server-client assets.

• Address low-level memory issues, including heap or buffer overflows.

• Enhance and develop security assurance initiatives, such as penetration tests, vulnerability assessments, bug bounty programs, and fuzzing.

• Lead the implementation and application of engineering security tools for static and dynamic code analysis, dependency checks, and code licensing compliance.

• Foster a strong relationship between engineering and security, implementing process and technology enhancements.

• Manage information security events and incidents across ClickHouse products and services.

• Create processes, tooling, and automation to scale security operations and reduce business risks.

⛳️ Requirements

• Proven experience in supporting engineering and product implementation through threat assessments, assurance activities, advisory, and implementation tasks across distributed systems, including web, API, and client/server assets.

• Strong expertise with one or more cloud service providers, such as AWS, GCP, or Azure.

• Familiarity with Kubernetes and Cilium.

• Experience in implementing and managing engineering security tools and processes, including static/dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, and client/network fuzzing tools.

• Significant background in development and automation.

• Capability to work with C++ code.

• A security-as-code mindset focused on automation and scalability.

• A BS, MS, or PhD in Computer Science or a related field is a plus.

• Previous contributions to open source projects are a bonus.

• Security or cloud-related certifications are a bonus.

• Ability to meet work authorization sponsorship requirements for the Netherlands.

🏝️ Benefits

• Flexible work environment and remote-friendly work arrangement.

• Employer contributions towards healthcare.

• Stock options available for every new team member.

• Flexible time off in the US.

• Generous time-off entitlement in other countries.

• USD$500 home office setup allowance for remote employees.

• Opportunities to connect with colleagues at company-wide offsite events.