Senior Security Engineer, DFIR

This is a fully remote position, open to applicants in United States.

📋 Description

• Conduct investigations into threats that impact the ClickUp platform and internal systems, gathering and analyzing pertinent evidence to determine what occurred and its implications.

• Lead investigations by evaluating findings, coordinating responses, and identifying root causes, collaborating with responsible teams to ensure remediation is fully executed.

• Detect and respond to misuse of the ClickUp platform.

• Identify threat indicators and recurring patterns, generate actionable threat intelligence, and leverage insights to enhance detection capabilities and prevent future abuse.

• Develop and refine AI-assisted and agentic workflows for incident response, digital forensics, and continuous audits.

• Automate repetitive investigative tasks, verify outputs against evidence, and uphold human oversight and suitable access controls concerning critical actions.

• Design, create, and implement controls that safeguard the product and internal systems.

• Translate investigation results into software modifications, response tools, and automated checks to address fundamental issues.

• Collaborate directly with engineering, product, data, and operations teams in a security player-coach capacity.

• Communicate observed threats with compelling evidence, assist teams in developing practical defenses, and mentor others.

⛳️ Requirements

• Several years of experience in technology or software development, including the creation and maintenance of tools or automation that address operational challenges.

• Hands-on experience with AI-assisted development or agentic workflows for engineering or security tasks, with the capability to validate their outcomes and discern when human review is necessary.

• Background in investigating security threats or platform misuse: analyzing logs and other forms of evidence, pinpointing threat indicators, and articulating findings and their significance.

• Proficiency in converting security findings into actionable software design modifications, response enhancements, or automated controls.

• Familiarity with cloud or SaaS systems, including utilizing their application, identity, or audit data to scrutinize suspicious activities.

• Strong written communication skills: creating findings and recommendations that other teams can implement, all backed by evidence.

• Ability to cultivate relationships and mentor peers on technical subjects, particularly security matters.

• Experience utilizing AI agents in a SOC or alternative incident response workflows.

• Knowledge of agent security risks, including the confused deputy problem and the lethal trifecta.

• Over 3 years of software development experience and at least 1 year focused on security.

• Proficient with security tools such as SAST, DAST, RASP, dependency checkers, and SIEM.

• At least 1 year of AWS experience, encompassing IAM and least-privilege architectures.

🏝️ Benefits

• Equity

• 401k

• Health, Dental, and Vision insurance

• Spending accounts

• Life & Disability

• Paid parental leave

• Flexible paid time off

• Enhanced employee assistance program

• Employee wellness stipend

• Professional development stipend