Senior Product Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Collaborate with engineering and product teams to enhance existing and create new product features through threat modeling, assurance, and secure implementation.

• Identify security vulnerabilities and gaps within ClickHouse Cloud and OSS.

• Manage vulnerabilities reported via bug bounty programs, responsible disclosure, and GitHub Issues across web, API, server-client, and low-level memory assets.

• Enhance and develop security assurance activities, which include penetration tests, vulnerability assessments, bug bounty programs, and fuzzing.

• Lead the implementation and utilization of engineering security tools, such as static and dynamic code analysis, dependency checks, and compliance with code licensing.

• Foster the relationship between engineering and security teams while implementing process and technology enhancements.

• Address information security events and incidents related to ClickHouse products and services.

• Create processes, tooling, and automation to scale security procedures and reduce business risks.

⛳️ Requirements

• Proven experience supporting engineering and product implementation efforts through threat assessments, assurance activities, advisory roles, and execution across distributed systems.

• Strong expertise in one or more cloud service providers, such as AWS, GCP, or Azure.

• Familiarity with Kubernetes, Cilium, and Crossplane.

• Experience in implementing and managing engineering security tools and processes, including static and dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, and fuzzing tools for clients and networks.

• Significant experience in development and automation.

• Preferred ability to work with C++ code.

• A security-as-code mindset with a focus on automation and scalability.

• A BS, MS, or PhD in Computer Science or a related field is a plus.

• Previous contributions to open source projects are advantageous.

• Security or cloud-related certifications, such as those from AWS, GCP, or Azure, are a plus.

🏝️ Benefits

• Flexible work environment.

• Remote-friendly work arrangements.

• Employer contributions towards healthcare.

• Stock options available for every new team member.

• Flexible time off in the US.

• Generous time-off entitlement for employees in other countries.

• USD$500 home office setup allowance for remote employees.

• Opportunities to connect with colleagues during company-wide offsite events.