Security Engineer

About the role

About PostHog PostHog is your product’s context layer. It ingests and stores your analytics, errors, replays, and business data so you and your agents can query and act on it. We launched out of Y Combinator's W20 cohort . We've since shipped more than a dozen products, including: A suite of analytics and observability tools, including product analytics , replay vision , AI observability , and error tracking PostHog MCP for users and their agents to query and act on their product and business data Data warehouse so users can query product and customer data together using custom SQL insights. W

Requirements

• Transparency: We work in the open. You’ll be able to see (and contribute to) how we handled past incidents, like this NPM package compromise .
• Direct Impact: Your work directly protects the data of thousands of customers. When you improve our security posture, the whole company (and our community) feels it.
• Triage and Tune: You’ll own our Wiz alerts. You’ll be responsible for turning "noise" into "actionable findings" and ensuring we aren't just staring at a dashboard of issues that don't actually matter
• Incident detection, response: You’ll lead the charge on security incidents. Whether it’s a compromised NPM package or a suspicious IAM pattern, you’ll help coordinate the response and lead the post-mo
• Build Observability: You’ll build detection pipelines, and close our network-based observability gaps. We want to be able to trace network requests and suspicious activity all the way back to specific
• Threat Hunting: You’ll proactively hunt for threats in our AWS environment. You won't just wait for an alert; you'll define what "good" looks like and build the telemetry to prove it.
• The VDP: You’ll support our Vulnerability Disclosure Program, triaging reports from researchers and eventually transitioning us toward a formal bug bounty program.
• Enable the Team: You’ll support our product squads with threat modeling and secure design reviews. We don't do "Security says no"; we do "Security says 'here is how to do this safely. '"