Security engineer

n8n GmbH; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Equity

Hackathons

OSS stipend

Visa sponsorship (Germany)

Job summary

n8n GmbH ищет специалиста по безопасности для разработки и обеспечения безопасности облачных сервисов и инфраструктуры. Роль включает угрозор modelling, ревью дизайна и реализацию защитных механизмов в продуктах и внутреннем ПО.

Кандидат будет работать как internal security consultant, взаимодействовать с командами Engineering, Cloud, IT и Data, помогать обеспечению SOC 2/ISO 27001 и поддержке программ Bug Bounty и безопасных выпусков.

Qualifications

• Практический опыт оценки реальных систем и выявления рисков безопасности.
• Умение валидировать находки и разворачивать доказательства концепций.
• Опыт работы в инфраструктуре, Product/CISстраховке и security-командах.

Responsibilities

• Проводить моделирование угроз и оценку рисков для функций продукта, AI-агентов и инфраструктуры.
• Согласование требований безопасности с Engineering, Cloud, IT и Data командами.
• Внедрять контрольные механизмы, обучение сотрудников и руководство по безопасной разработке.

Skills

Threat modelling

Secure coding

Security incident response

Cloud security

Kubernetes security

Identity access management

LLM-based tooling

Tools

Okta

Azure

Drata

Job description

Описание:

The AI orchestration of your wildest imagination. n8n is the open workflow orchestration platform built for the new era of AI. We give technical teams the freedom of code with the speed of no-code, so they can automate faster, smarter, and without limits. Backed by a fiercely inventive community and 500+ builder-approved integrations, we're changing the way people bring systems together and scale ideas for impact.

Задачи:

identify and reduce security risks across n8n's product and internal systems, using threat modelling, hands-on security expertise, and cross-functional collaboration to help teams design, build, and operate more secure systems. Conduct threat modelling and risk assessments across product features, AI agents, cloud infrastructure, corporate IT, internal applications, and data systems, identifying vulnerabilities and recommending practical mitigations. Partner with Engineering, Cloud, IT, and Data teams to review security designs, define actionable security requirements, and influence the implementation of appropriate controls. Help teams embed security into their development processes through secure coding guidance, design reviews, documentation, and security tooling that enables them to identify and address risks independently. Participate in the security triage rotation, assessing incoming vulnerability reports, validating findings, and prioritising remediation based on severity and business impact. Collaborate with engineering teams to coordinate vulnerability remediation, verify fixes, and support secure patch and release processes. Help manage our vulnerability disclosure and bug bounty programmes, including engagement with security researchers, coordinated disclosures, and GitHub Security Advisories. Help establish and improve logging, detection, and protective monitoring capabilities across our infrastructure, corporate systems, and internal applications. Develop and improve incident response processes, runbooks, and exercises to strengthen our ability to detect, investigate, and respond to security incidents. Work closely with system owners to identify security gaps, prioritise remediation, and verify that implemented controls effectively reduce risk. Support SOC 2 compliance by helping establish continuous control monitoring, automated evidence collection, and processes that make security assurance part of everyday operations. Collaborate with Sales, Solutions Engineering, and Customer Success to respond to customer security assessments and build reusable resources that streamline future requests. Partner with Legal, Finance, IT, and other stakeholders to assess security risks, improve security policies and controls, and strengthen trust with enterprise customers.

Требования:

You have hands-on experience assessing real-world systems, identifying security risks, determining defensible severity levels, and recommending practical controls that teams can implement. You can validate security findings, reproduce vulnerabilities, develop proof-of-concepts, and write code or automation when needed to demonstrate risks or improve security processes. You've worked hands-on in infrastructure, product, or application security within a product-focused organisation, with a strong understanding of how modern systems are designed and secured. You're comfortable acting as an internal security consultant, advising teams, challenging technical decisions constructively, and influencing stakeholders without direct authority. You've helped secure systems you don't directly own, translating security findings into actionable requirements and working with responsible teams to ensure effective remediation. You're comfortable using LLM-assisted tooling and understand its limitations, security implications, and potential failure modes. You can explain complex security risks, document technical findings, and provide practical guidance that engineers and non-technical stakeholders can confidently act on. You've developed security checks, engineering guardrails, tooling, or guidance that helps product teams build and ship secure software. You have experience securing a major cloud provider and Kubernetes environments, including areas such as sandboxing, multi-tenancy, or identity. You've worked on identity and access management, endpoint security, employee access lifecycles, or data access controls across corporate environments. You've implemented logging, protective monitoring, or security detection capabilities that support effective investigation and incident response. You've supported SOC 2 or ISO 27001 from an engineering perspective, including implementing technical controls or automating compliance evidence collection. Будет плюсом: You've helped operate bug bounty or coordinated vulnerability disclosure programmes, including publishing security advisories such as GHSAs or CVEs; You have experience assessing or securing LLM-powered applications and AI agents, including risks related to permissions, tool access, prompt injection, or sensitive data; You're familiar with platforms such as Okta, Azure, or Drata and their role in securing corporate systems and supporting compliance; You've worked with open-source or source-available products, contributed to security communities, or are already familiar with n8n; You have practical penetration testing experience and can independently identify, demonstrate, and help remediate security vulnerabilities; You've been an early security hire or helped establish security practices in a startup or rapidly scaling organisation

Условия:

We offer fair and attractive pay. Our core value is to "empower others," and we mean it-you'll get a slice of n8n with equity. We work hard but ensure you have time to recharge: Europe: 30 days of vacation, plus public holidays wherever you are. US: 20 vacation days, 8 sick days, plus public holidays wherever you are. Europe: We provide benefits according to local country norms.* US: Multiple low-premium, low-deductible medical plans with coverage for individuals and families - plus a no-cost premium HDHP option with a pre-seeded HSA - along with dental and vision coverage. Europe: We provide pension contributions according to local country norms.* US: 401(k) retirement plan with a 4% employer match. Europe: We provide benefits according to local country norms.* US: Company-paid short-term and long-term disability insurance, plus life insurance to support you and your loved ones. You'll get €1K (or equivalent) per year to spend on courses, books, events, or coaching to level up your skills. We love our product, and we prove it with regular hackathons where we see who can build the coolest thing with it! Our team works remotely across Europe, with regular off-sites for team bonding. Some roles, like sales in the US, are hybrid-please check the job description. We're big fans of open source, and you'll get $100 per month to support projects you care about. We all know what everyone's working on, how the company is doing—the whole shebang. We can sponsor visas to Germany; for any other country, you need to have existing right to work. Our company language is English. Country and/or State specific details provided in your employment agreement.