Senior Product Security Engineer II

About the Security Team:

The mission of the Security Engineering team at dbt Labs is to provide clear, opinionated security guidance and scalable, secure-by-default offerings to engineers for the purpose of securing software development and enabling pragmatic risk decisions at dbt.

Our small team size and wide scope of responsibilities require that we work intelligently to address the security needs of dbt’s products. We aim to put yesterday’s problems behind us through a mix of OSS/COTS solutions for commodity problems and using ingenuity to solve the rest.

As an Senior Security Engineer II on this central team, you will have the opportunity to own outsized impact on how securely engineers at dbt are able to build software and infrastructure.

In this role, you can expect to:

• Write code:
  • Research, plan, and build solutions to solve security problems at scale.
  • Build and deploy automation tools for security monitoring; vulnerability detection, prevention, and remediation; risk assessment and prioritization; and incident response.
• Be an empathetic partner to Engineering teams:
  • Partner with cross-functional engineering teams to help them understand and prioritize their biggest security risks.
  • Eliminate classes of security problems by building paved paths for engineers to follow.
  • Perform security architecture reviews and threat models early in the design process to help teams build systems that are secure by design.
• Be a leader:
  • Identify new opportunities for improved security posture across the organization and lead those efforts to success.
  • Provide security mentorship to security, software, and infrastructure engineers via 1:1 mentoring, demos, and org-wide security training.
  • Play an influential role in maturing our security programs through tooling and process improvements.
• Be a team player:
  • Be part of the team’s weekly on-call rotation.
  • Conduct security investigations across complex cloud environments in response to incidents or bug bounty submissions.
  • Have a bias for action, a penchant for quality, and never stop learning (we have a training budget of $5k/person/year).

You are a good fit if you:

• Take an engineering approach to solving security problems at scale.
• Use data to assess risk, determine priorities, and measure impact.
• Have strong opinions on security topics ranging from Architecture to Zero Trust, the communication skills to deliver those opinions, and the humility to change them.
• Are a builder, excited to write and review code on a daily basis to automate problems away (we primarily use Python and Terraform).
• Are very comfortable working in a cloud-native, Kubernetes-based environment and building software with good engineering practices (e.g., CI/CD, observability, scalability, security).

You'll have an edge if you:

• Have experience building or securing distributed systems on public clouds (we use AWS and Azure).
• Have experience leading threat models and tabletop exercises.
• Have led security incidents and/or built systems and processes to prepare for and respond to them.

Qualifications

• Have 8+ years of professional experience in security or security-focused software engineering.

Compensation & Benefits

• Salary: $189,000 - $255,000
• Equity Stake
• Benefits - dbt Labs offers:
  • Unlimited vacation (and yes we use it!)
  • 401k w/ 3% guaranteed contribution
  • Excellent healthcare
  • Paid parental leave
  • Wellness stipend
  • Home office stipend, and more!

What to expect in the hiring process (all video interviews unless accommodations are needed):

1. Interview with Talent Acquisition Partner
2. Interview with Hiring Manager
3. Team Interviews
4. Final Interview with VP of Security