Description:

As a member of our security team, you will build secure-by-default, defense-in-depth, and least privilege mechanisms throughout our product lifecycle.
You will work closely with engineering teams on security best practices from design and architecture to implementation and monitoring.
You will have the opportunity to build from the ground up to experiment and innovate with modern software security practices.
Responsibilities include creating paved roads for engineers to develop securely by default and building guardrails for when we veer off course.
You will conduct regular architecture reviews and code audits to detect potential threats, risks, and vulnerabilities.
You will harden our CI/CD pipelines and improve the integrity of Clerk’s software artifacts.
You will contribute to and improve Clerk’s vulnerability management program including vulnerability disclosure, security scans, and penetration tests.
You will provide guidance and training to teammates on security best practices and building resiliency into our systems.
You will collaborate with our Infrastructure team to establish secure infrastructure-as-code modules and minimal base container images.
You will document secure development policies and practices.

Requirements:

Proven experience in a software security, application security, or product security role with 7+ years of hands-on experience.
Strong empathy with the ability to enable engineers to move quickly and securely, ideally having previously worked as a software engineer.
Expertise in proactive secure coding practices such as encryption, secrets management, and eliminating vulnerability classes (e.g. in the OWASP Top 10).
Experience with reading and writing code in Go, TypeScript, or similar languages with the ability to dive into codebases, debug, and suggest fixes.
Experience with application security tooling (SAST/SCA/DAST/etc.) and building custom queries using Semgrep/CodeQL/etc.
Experience with authentication and authorization protocols such as OAuth, OpenID Connect, and SAML.
Familiarity with Supply-chain Levels for Software Artifacts (SLSA).
Familiarity with Cloud infrastructure platforms, preferably GCP.

💰 Competitive Salary – We value the skills and experience you bring to the table and ensure that you feel fairly compensated.
📈 Equity Ownership – We offer a stock option plan so that everyone can benefit from the growth and prosperity of the company.
⚕️ Health Coverage – We provide top-tier health insurance to ensure that your health needs are fully met.
🎧 Work Gear - You can set up your ideal home office with the gear of your choice to perform at your best.
🏖️ Flexible Vacation Policy – We believe in work-life balance and trust you to take the time you need, with a recommendation of 25 days per year and an unlimited vacation policy in addition to national holidays.
🌍 Diverse and Inclusive Team – Join our exceptional, diverse, and globally distributed team committed to fostering an inclusive environment.