Offensive Security Engineer

Stack

Responsibilities

• ▹Identify security gaps and vulnerabilities in all ClickHouse offerings; triage vulnerabilities reported via the bug bounty program, responsible disclosure and GitHub Issues, covering web, API and server/client assets including low-level memory issues like heap or buffer overflows
• ▹Improve and develop security assurance activities: pentests, vulnerability assessments, bug bounty programs, fuzzing
• ▹Plan and execute internal red team assessments and penetration tests against ClickHouse infrastructure and cloud environments, designing realistic adversary scenarios
• ▹Assess AI/LLM-specific attack surface across ClickHouse's own AI-powered features and internal AI tooling, including prompt injection, model/data exfiltration and unsafe agentic tool-use patterns
• ▹Build and operate agentic tooling for reconnaissance, exploit-chaining and attack-path discovery, and apply LLM-assisted fuzzing
• ▹Partner with detection engineering to validate and improve detection coverage during red team exercises
• ▹Handle information security events and incidents across ClickHouse products and services
• ▹Develop processes, tooling and automation to scale security processes and mitigate risks

Requirements

• ▹7+ years of experience in pentesting, red teaming and product security
• ▹Experience supporting engineering and product teams through threat assessments, assurance activities, advisory and implementation work across distributed systems (web, API, client/server)
• ▹Hands-on experience conducting offensive security engagements (internal red teaming, penetration testing, adversary simulation) across cloud, network and application environments
• ▹Ability to design adversary scenarios grounded in real threat intelligence (e.g. ransomware operators, supply chain attackers, insider threats)
• ▹Strong written and verbal communication skills

About the company

ClickHouse, recognized on the 2025 Forbes Cloud 100 list, is a fast-growing private cloud company with more than 4,000 customers and over 250% year-over-year ARR growth, leading the market in real-time analytics, data warehousing, observability and AI workloads. It recently closed a $400M Series D round, with customers including Capital One, Meta, Cursor, Sony and Tesla.