SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 160,000 - 225,000 / annual
Metabase is seeking a Security Engineer to embed within the core engineering team and drive security across the product. This is a hands-on role combining deep security expertise with frontier AI tools to identify and remediate vulnerabilities at scale.
You will partner with engineers throughout the feature development lifecycle—from design through implementation, release, and adoption—bringing security expertise to shape decisions early. You'll build security-focused features, lead improvements across the codebase, and implement fixes that address root causes rather than symptoms.
Key responsibilities include:
- Partnering with engineers during feature development to integrate security expertise into design, implementation, release, and adoption
- Building security-focused features and leading security improvements across the codebase
- Using advanced AI tools to scale code analysis, vulnerability research, and secure engineering practices
- Conducting offensive research into Metabase, developing proofs of concept, and validating vulnerabilities
- Assessing findings based on exploitability and real-world impact, defining remediation criteria, and verifying fixes
- Turning individual findings into systemic improvements that prevent entire classes of vulnerabilities
Metabase is a fully distributed, remote-first company with 50% of the team outside the US. The company provides an asynchronous work environment with flexibility to define your own schedule and work from anywhere. Metabase recently raised a $30M Series B and serves tens of thousands of companies globally.
REQUIREMENTS:
- Demonstrated track record of finding and exploiting application vulnerabilities through source code analysis and hands-on research
- Ability to independently navigate unfamiliar codebases, understand complex architectures, and reason about runtime behavior and trust boundaries
- Experience with application security challenges including authentication, authorization, injection, and unsafe handling of untrusted data
- Sound judgment about exploitability and real-world impact; ability to communicate findings and remediation options clearly
- Strong software engineering skills with ability to implement durable security fixes; experience in Clojure or strong desire to learn
- Thoughtful approach to AI-assisted security work, using tools to extend expertise while independently validating output
- Ownership mindset and curiosity; ability to pursue difficult questions, collaborate closely with engineers, and follow findings through to resolution
