Offensive Security Engineer

Stack

Responsibilities

• ▹Identify security gaps and vulnerabilities across all ClickHouse offerings
• ▹Triage vulnerabilities reported via the bug bounty program, responsible disclosure, and GitHub Issues, covering web, API, and server-client assets including low-level memory issues
• ▹Improve and develop security assurance activities: pentests, vulnerability assessments, bug bounty programs, fuzzing
• ▹Plan and execute internal red team assessments and penetration tests against ClickHouse infrastructure and cloud environments
• ▹Assess AI/LLM-specific attack surface across ClickHouse's own AI-powered features, including prompt injection and model/data exfiltration risks
• ▹Build and operate agentic tooling for reconnaissance, exploit-chaining, and attack-path discovery
• ▹Handle information security events and incidents across ClickHouse products and services

Requirements

• ▹7+ years of experience in pentesting, red teaming, and product security
• ▹Experience performing threat assessments, assurance activities, and advisory work across distributed systems: web, API, client/server assets
• ▹Hands-on experience in offensive security engagements: internal red teaming, penetration testing, and adversary simulation across cloud, network, and application environments
• ▹Ability to design adversary scenarios grounded in real threat intelligence
• ▹Strong written and verbal communication skills

Soft skills

About the company

ClickHouse is a leading cloud company in real-time analytics, data warehousing, observability, and AI workloads, with over 4,000 customers.