Senior Product Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Collaborate with engineering and product teams to enhance existing features and develop new product functionalities through threat modeling, assurance, and secure implementation.

• Identify security vulnerabilities and gaps within ClickHouse Cloud and Open Source Software (OSS).

• Manage the triage of vulnerabilities reported via bug bounty programs, responsible disclosures, and GitHub Issues across web, API, server-client, and low-level memory assets.

• Enhance and establish security assurance activities, such as penetration testing, vulnerability assessments, bug bounty initiatives, and fuzz testing.

• Lead the adoption and implementation of engineering security tools, including static and dynamic code analysis, dependency checks, and compliance with code licensing.

• Foster the relationship between engineering and security while implementing process and technology enhancements.

• Manage information security events and incidents across all ClickHouse products and services.

• Develop processes, tools, and automation to scale security operations and mitigate business risks.

⛳️ Requirements

• Experience in supporting engineering and product implementation through threat assessments, assurance activities, advisory roles, and implementations across distributed systems.

• Strong knowledge and hands-on experience with one or more cloud service providers, such as AWS, GCP, or Azure.

• Familiarity with Kubernetes, Cilium, and Crossplane.

• Experience in implementing and operating engineering security tools and processes, including static and dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, and client and network fuzzing tools.

• Extensive development and automation expertise.

• Preferred ability to work with C++ code.

• A security-as-code mindset with a focus on automation and scalability.

• A BS, MS, or PhD in Computer Science or a related field is advantageous.

• Previous contributions to open-source projects are a plus.

• Security or cloud-related certifications, such as those from AWS, GCP, or Azure, are beneficial.

🏝️ Benefits

• Flexible work environment.

• Remote-friendly work arrangement.

• Employer contributions towards healthcare.

• Stock options available for every new team member.

• Flexible time off in the US.

• Generous time-off entitlement for employees in other countries.

• USD$500 home office setup allowance for remote workers.

• Opportunities to connect with colleagues at company-wide offsites.