SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
n8n is an open workflow orchestration platform built for the AI era, enabling technical teams to automate faster with the freedom of code and speed of no-code. The company has grown to 260+ employees across Europe and the US, with 650,000+ active developers in its community, 190K+ GitHub stars, and a $5.2bn valuation backed by Sequoia and SAP.
As a Senior Product Security Engineer, you will identify and reduce security risks across n8n's product and internal systems through threat modelling, hands-on security expertise, and cross-functional collaboration. You'll join a growing security team at a pivotal stage, acting as a trusted security partner to teams across the business and helping move from reactive to proactive, scalable security practices.
Key responsibilities include:
**Threat Modelling, Risk Assessment & Security Design:** Conduct threat modelling and risk assessments across product features, AI agents, cloud infrastructure, corporate IT, internal applications, and data systems. Partner with Engineering, Cloud, IT, and Data teams to review security designs, define actionable security requirements, and influence control implementation. Help teams embed security into development processes through secure coding guidance, design reviews, documentation, and security tooling.
**Security Operations & Incident Readiness:** Establish and improve logging, detection, and protective monitoring capabilities across infrastructure, corporate systems, and internal applications. Develop and improve incident response processes, runbooks, and exercises. Work closely with system owners to identify security gaps, prioritize remediation, and verify that implemented controls reduce risk.
**Vulnerability Management & Coordinated Disclosure:** Participate in security triage rotation, assessing vulnerability reports, validating findings, and prioritizing remediation. Collaborate with engineering teams to coordinate vulnerability remediation and support secure patch and release processes. Help manage vulnerability disclosure and bug bounty programmes, including engagement with security researchers and GitHub Security Advisories.
**Customer Trust & Compliance Engineering:** Support SOC 2 compliance by establishing continuous control monitoring, automated evidence collection, and processes that make security assurance part of everyday operations. Collaborate with Sales, Solutions Engineering, and Customer Success to respond to customer security assessments. Partner with Legal, Finance, IT, and other stakeholders to assess security risks and strengthen trust with enterprise customers.
Note: n8n is hiring two Security Engineers with complementary strengths, so you don't need to be an expert in every security domain.
**REQUIREMENTS**
Must-Haves:
- Threat Modelling & Risk Assessment: Hands-on experience assessing real-world systems, identifying security risks, determining defensible severity levels, and recommending practical controls that teams can implement.
- Technical Security Expertise: Ability to validate security findings, reproduce vulnerabilities, develop proof-of-concepts, and write code or automation when needed to demonstrate risks or improve security processes.
- Security Engineering Experience: Hands-on work in infrastructure, product, or application security within a product-focused organization, with strong understanding of how modern systems are designed and secured.
- Cross-functional Influence: Comfortable acting as an internal security consultant, advising teams, challenging technical decisions constructively, and influencing stakeholders without direct authority.
- Risk Remediation & Ownership: Experience helping secure systems you don't directly own, translating security findings into actionable requirements and working with responsible teams to ensure effective remediation.
- AI & LLM Fluency: Comfortable using LLM-assisted tooling and understanding its limitations, security implications, and potential failure modes.
- Clear Communication: Ability to explain complex security risks, document technical findings, and provide practical guidance that engineers and non-technical stakeholders can confidently act on.
Deep expertise in at least two of the following areas:
- Application Security: Developed security checks, engineering guardrails, tooling, or guidance that helps product teams build and ship secure software.
- Platform Security: Experience securing a major cloud provider and Kubernetes environments, including sandboxing, multi-tenancy, or identity.
- Corporate Security: Worked on identity and access management, endpoint security, employee access lifecycles, or data access controls across corporate environments.
- Security Monitoring: Implemented logging, protective monitoring, or security detection capabilities that support effective investigation and incident response.
- Security Assurance & Compliance: Supported SOC 2 or ISO 27001 from an engineering perspective, including implementing technical controls or automating compliance evidence collection.
Nice-to-Haves:
- Vulnerability Disclosure: Helped operate bug bounty or coordinated vulnerability disclosure programmes, including publishing security advisories such as GHSAs or CVEs.
- AI & Agent Security: Experience assessing or securing LLM-powered applications and AI agents, including risks related to permissions, tool access, prompt injection, or sensitive data.
- Corporate IT Tooling: Familiarity with platforms such as Okta, Azure, or Drata and their role in securing corporate systems and supporting compliance.
- Open-source Ecosystems: Worked with open-source or source-available products, contributed to security communities, or are already familiar with n8n.
- Penetration Testing: Practical penetration testing experience and ability to independently identify, demonstrate, and help remediate security vulnerabilities.
- Early-stage Security Experience: Been an early security hire or helped establish security practices in a startup or rapidly scaling organization.
