Senior DFIR Engineer: AI-Driven Incident Response

Royper Royco LLC; United States; Remoto; USD 150.000 - 210.000; Tempo pieno

Descrizione del lavoro

ClickUp is seeking an experienced security engineer to join the Application Security team, protecting our AI-native platform. You will investigate threats, prevent abuse, and build agentic tooling that speeds response while keeping humans in the loop.

You will partner with engineering, product, and data teams to translate findings into robust controls, tests, and automated checks that endure beyond a single incident.

Competenze

• Multiple years of experience in technology or software development, including building and maintaining tooling or automation that solves operational problems.
• Practical experience using AI-assisted development or agentic workflows for engineering or security work, with an ability to validate their output and recognize when human review is needed.
• Experience investigating security threats or platform abuse: analyzing logs and other evidence, identifying threat indicators, and explaining findings and impact.
• Ability to translate a security finding into a practical software design change, response improvement or automated control.
• Experience working with cloud or SaaS systems, including using their application, identity or audit data to investigate suspicious activity.
• Clear written communication: findings and recommendations that another team can act on, supported by evidence.
• Ability to build relationships and mentor others on technical topics, including security.
• Experience using AI agents in a SOC or other incident response workflows.
• Understanding of agent security risks, including the confused deputy problem and the lethal trifecta.
• You can facilitate a conversation rather than dictate it.
• 3+ years of software development experience and 1+ year of security-specific experience.
• Experience with security tools such as SAST, DAST, RASP, dependency checkers and SIEM.
• 1 year of AWS experience, including IAM and least-privilege architectures.

Mansioni

• Digital forensics and incident response. Investigate threats affecting the ClickUp platform and internal systems, collect and analyze relevant evidence, and establish what happened and its impact.
• Platform abuse investigations. Identify and respond to abuse of the ClickUp platform. Uncover threat indicators and recurring patterns, develop actionable threat intelligence, and use the findings to improve detection and prevent repeat abuse.
• Agentic security tooling. Build and improve AI-assisted and agentic workflows for incident response, digital forensics and ongoing audits. Automate repeatable investigation work, validate outputs against evidence, and keep human review and appropriate access controls around consequential actions.
• Product defenses and security controls. Design, develop and deploy controls that protect our product and internal systems. Turn investigation findings into software changes, response tooling and automated checks that address the underlying issue rather than just the individual incident.
• Engineering partnership. Work directly with engineering, product, data and operations teams as a security player-coach. Explain observed threats with clear evidence, help teams design practical defenses, and mentor others so the improvements last beyond a single investigation.

Conoscenze

Software development

AI-assisted workflows

Threat investigation

Cloud/SaaS

Communication

Mentoring

AI agents in SOC

Agent security risks

Facilitation

AWS IAM access

Strumenti

SAST

DAST

RASP

Dependency checkers

SIEM

Descrizione del lavoro

ClickUp is seeking an experienced security engineer to join the Application Security team, protecting our AI-native platform. You will investigate threats, prevent abuse, and build agentic tooling that speeds response while keeping humans in the loop.

You will partner with engineering, product, and data teams to translate findings into robust controls, tests, and automated checks that endure beyond a single incident.