Security Engineer at Metabase | RemoteWork

Metabase is the easiest way for people to get insights from their data, from tiny startups who get up and running quickly to major corporations with tens of thousands of users. That's why people love us.

We bring data tools with the elegance and simplicity of consumer products to the crufty world of enterprise business intelligence. We provide an opinionated open source starting point for how companies should measure, analyze and share their data, which is used by tens of thousands of companies.

About the Role

We’re looking for a Security Engineer with deep expertise in source code analysis and offensive product security research. You’ll dig into complex software architectures, trace how code behaves at runtime, uncover subtle vulnerabilities, and address the systemic flaws behind them.
Embedded in our core engineering team, you’ll help shape security decisions from early design through release and adoption. This is a hands-on engineering and research role: you’ll combine your security expertise with frontier AI tools to find vulnerabilities, develop fixes, and make Metabase secure by default across its product, dependencies, and runtime.

Things you’ll do

Partner with engineers throughout feature development, bringing security expertise to design, implementation, release, and adoption.
Build security-focused features, lead security improvements across the codebase, and implement fixes that address root causes.
Use and evaluate advanced AI tools to scale code analysis, vulnerability research, and secure engineering practices.
Conduct offensive research into Metabase, develop proofs of concept, and validate vulnerabilities.
Assess findings based on exploitability and real-world impact, define clear remediation criteria, and verify that fixes are effective.
Turn individual findings into broader improvements that prevent entire classes of vulnerabilities.

What you bring

A demonstrated track record of finding and exploiting application vulnerabilities through source code analysis and hands-on research.
The ability to independently navigate unfamiliar codebases, understand complex architectures, and reason about runtime behavior and trust boundaries.
Experience with application security challenges, including authentication, authorization, injection, and unsafe handling of untrusted data.
Sound judgment about exploitability and real-world impact, and the ability to communicate findings and remediation options clearly.
Strong software engineering skills, including the ability to implement durable security fixes. Experience in Clojure, or a strong desire to learn.
A thoughtful approach to AI-assisted security work, using these tools to extend your expertise while independently validating their output.
Ownership and curiosity: you pursue difficult questions, collaborate closely with engineers, and follow findings through to resolution.

Ready to apply?

Your application goes straight to Metabase, on their own hiring page.

Apply for this job

About Metabase

Metabase is an open-source analytics and BI tool that grounds answers in a semantic layer. The team is fully remote and async-first across 30+ countries, and hires for roles posted as Global Remote.

San Francisco, United States

Metabase company profile metabase.com

Security Engineer

Can you do this job from Nigeria?

About the Role

Things you’ll do

What you bring

About Metabase

Similar security roles

Senior Manager, Application Security