Security Engineer

The role

You will work inside Metabase's core engineering team on security from design through release. The role is hands-on: you will find and validate vulnerabilities, build fixes and use AI tools to scale code analysis.

What you will do

• Partner with engineers on security across feature development, design, implementation, release and adoption.
• Build security-focused features and lead security improvements across the codebase.
• Implement fixes that address root causes.
• Use and evaluate advanced AI tools for code analysis, vulnerability research and secure engineering.
• Conduct offensive research into Metabase, develop proofs of concept and validate vulnerabilities.
• Assess findings by exploitability and real-world impact, define remediation criteria and verify fixes.
• Turn individual findings into broader improvements that prevent entire classes of vulnerabilities.

Required qualifications

• Demonstrated track record of finding and exploiting application vulnerabilities through source code analysis and hands-on research.
• Ability to independently navigate unfamiliar codebases and reason about runtime behavior and trust boundaries.
• Experience with application security challenges, including authentication, authorization, injection and unsafe handling of untrusted data.
• Sound judgment about exploitability and real-world impact, and clear communication of findings and remediation options.
• Strong software engineering skills, including implementing durable security fixes.
• Experience in Clojure, or a strong desire to learn.
• Thoughtful approach to AI-assisted security work, validating tool output independently.
• Ownership and curiosity: follow difficult questions and findings through to resolution.

Benefits

• Meaningful equity.
• Fully employer-covered medical, dental and vision insurance.
• 75% coverage for dependents.
• 401(k) with employer match, available after the first 30 days.
• Flexible and unlimited paid time off, including sick time.
• Asynchronous, remote-first environment.
• Autonomy and flexibility in defining your schedule.
• Environment that fosters growth, learning and development.

Before you apply

• For U.S. applicants, Metabase participates in the federal E-Verify program, which is initiated only upon hire and not used to pre-screen candidates.

About the company

Metabase makes data insights easy to get for companies of all sizes, from startups to large corporations. Its open source data tools are used by tens of thousands of companies.