Security Engineer, YNAB

• If the thought of anchoring our commitment to protecting YNAB and its customers resonates deeply, you’re our target audience—please read on
• Have at least two years of hands-on experience in security engineering, software engineering, DevOps, IT security, or a closely related technical field
• Have practical experience with application security (for example: performing code reviews, threat modeling, working with developers on secure design, or using SAST/DAST tools)
• Have experience building, maintaining, or monitoring security logs—preferably with DataDog, but similar systems (Splunk, ELK, CloudWatch, etc.) are fine
• If you believe you’re a fit for this role, but don’t meet our preferred qualifications, we still encourage you to apply
• You’re passionate about building secure systems and protecting our users
• You’re excited to dig into the technical details. You thrive on solving complex technical problems and aren’t afraid to learn new technologies
• You balance thoroughness with pragmatism—you know when to dig deeper and when to move forward with the information you have
• You communicate well with both technical and non-technical teammates, and enjoy collaborating across different teams. You pride yourself on being approachable and easy to work with
• You enjoy thinking outside of the box when it comes to security and compliance. Rather than blocking progress, you consider all choices before making a decision, adapt when you receive new information, and know the right solution is the one that works best for YNAB
• You’re eager to dive deep into meaningful security challenges, while growing your expertise

Desirable

• You'll work most closely with Kendal (our Security Lead), and Chris (our Systems Administrator), while collaborating with the wider Engineering department (which includes teams of QA analysts, full stack, iOS, and Android engineers)
• Chris is our systems administrator, which is a fancy title for a technology generalist
• Day in and day out, Chris is helping to make sure everyone at YNAB has the tools to do their job, access to the systems needed to do their job, and a little bit of “we’re not sure who should be doing this”
• Outside of YNAB, Chris is a middle grade author writing books for kids who’d rather not be reading
• Regardless of their varied jobs, everyone in Engineering has one thing in common: They are a joy to work with
• You won’t find heated arguments and raised voices here
• We save our competitive spirit for YNAB’s external competitors (or the occasional online game session), but internally we build up our teammates and celebrate their successes
• We all love to solve problems in creative ways, and we regularly take time to geek out and show each other something cool we built or found to make our lives easier
• Though you’ll be embedded in Engineering, you’ll probably cross paths with many people at YNAB at some point
• We can’t list them all, but we can say that we are all excited to get to know you!
• Ou’ll be hands-on with implementing security controls and processes. On a day-to-day basis, you’ll:
• Configure and maintain security tooling across the organization, including monitoring systems, vulnerability management platforms, and automated security processes
• Implement and optimize access controls, authentication systems, and data protection measures
• Write automation scripts, analyze security logs, and help maintain our security infrastructure
• Help maintain security standards, guidelines, and best practices
• You’ll work with our Engineering team to design and implement secure systems and help ensure security is built into our products from the ground up. To do so, you’ll:
• Collaborate with engineers to integrate security into the development lifecycle through activities like secure code reviews, threat modeling, and design consultations
• Conduct security testing of new features and systems, including vulnerability assessments and security reviews
• Perform security assessments to proactively identify potential issues, in line with security by design principles
• You’ll help monitor our security landscape, investigate potential threats, assist with incident response, and contribute to our continuous improvement of security practices. Alongside Kendal, you’ll:
• Monitor security events, analyze threats, and respond to security incidents with appropriate containment and remediation actions
• Support bug bounty program activities and coordinate responses to external security reports
• Research emerging threats and maintain awareness of security trends relevant to our technology stack

• Submit your application (including what’s listed below) by Sunday, January 25th at 11:59pm PT. Firm. It’s a real deadline
• What to include in your application:
• A resume. If you don’t have an updated formal resume, that’s fine! An informal overview of your work history and education is all we’re looking for
• A cover letter and answers to a few specific questions. This isn’t your typical cover letter—skip the fluff and formalities, and just help us get to know you
• On page 1: We’d love for you to tell us a bit about yourself, what drew you to work in security, why you’re interested in this role at YNAB, and why you think you’d be a great fit
• On page 2 onward: Please answer these questions three:
• 1. Tell us about a time when you were convinced you were right about something at work, but later changed your mind. What swayed you? Please answer in 1-2 paragraphs
• 2. How have you honed your craft in security engineering, and how do you see yourself continuing to develop your skills in the future? Feel free to share specific strategies, sources of information or inspiration, and/or your general approach. Please answer in 1-2 paragraphs
• 3. Imagine you’re our Security Engineer. You’ve just discovered a potentially critical vulnerability in a third-party dependency used in our codebase. Now it’s your job to validate the vulnerability and raise it to the engineering team responsible for remediation. Please craft a 1-2 paragraph vulnerability report as though you’re writing directly to them. (Feel free to make assumptions about this scenario to guide your response.)
• Process:
• Application
• Questionnaire
• Interview #1
• Interview #2 [Technical]
• Interview #3
• Offer