Security Engineer II - California, US (Remote)

DreamHost, LLC•Fullerton, CA

39d•$125,000 - $145,000•Remote

About The Position

The Security Engineer II protects DreamHost, its infrastructure, and its customers in a large, multi-tenant Linux hosting environment where untrusted code runs by design. This is a hands-on engineering role involving investigation of live compromises, development of tooling and detections, security reviews of applications and infrastructure, and reduction of long-standing risks across shared hosting, VPS, managed WordPress, dedicated servers, cloud, and email services. The role is part of a small security team whose members own workstreams end to end and partner directly with Systems, Development, Abuse, and Support. The engineer is expected to exercise independent judgment and turn security recommendations into implemented controls. The work also includes reviewing the security and governance of internally adopted AI and agent tooling, while using those tools as part of day-to-day engineering work.

Requirements

3–6 years of experience in security engineering, incident response, application security, offensive security, or systems administration, with demonstrated ability to independently resolve complex security problems.
Depth in at least one of application security, incident response and detection engineering, or offensive security and penetration testing, plus working competence in the other two.
Strong hands-on Linux experience, preferably Debian or Ubuntu, including processes, namespaces, capabilities, filesystems, kernels, and failure modes.
Experience operating long-lived production systems that cannot simply be rebuilt, including repairing hosts in place under load with users on them.
Experience in multi-tenant or customer-facing environments with untrusted users.
Production scripting and automation experience using Python, Go, Bash, Perl, or a similar language, including building and maintaining real tooling.
Experience with log analysis and investigation at scale, and familiarity with intrusion detection and web application firewalls such as mod_security.
Working knowledge of cloud platform security in AWS, GCP, Azure, or OpenStack, including IAM, network controls, and workload isolation.
Familiarity with secrets management and CI/CD security, including Vault or an equivalent, pipeline hardening, and dependency and supply-chain risk.
Fluency with version control and infrastructure as code, such as Git and Ansible or similar tools.
Practical, current fluency with AI tooling in engineering work, including understanding its limitations and setting appropriate boundaries for its use.
Clear written and verbal communication, including the ability to explain technical risk to non-technical stakeholders.
Strong ethics, healthy skepticism, and the ability to remain useful under pressure.

Nice To Haves

Web hosting or WordPress-at-scale experience, as a provider or customer.
Container and orchestration security experience with Podman, Docker, or Kubernetes, including escape and isolation failure modes.
Malware analysis, YARA rule authorship, or reverse engineering experience.
Detection-as-code or SIEM engineering experience.
Hands-on experience securing AI/LLM systems, agent frameworks, or MCP tooling, including prompt injection, tool-permission scoping, or data-boundary work.
Familiarity with PCI DSS, SOC 2, or ISO 27001 as context.
Open-source contributions.

Responsibilities

Lead investigation and resolution of complex security incidents, coordinate across teams, and communicate status clearly while facts are incomplete.
Design and implement safeguards that protect customer sites, accounts, and infrastructure from active and evolving threats.
Conduct vulnerability assessments, security reviews, and risk analyses, and provide actionable remediation guidance.
Build automation and tooling to improve detection, monitoring, response, and operational safety.
Partner with Systems, Development, Abuse, and Support to implement security controls.
Mentor less experienced team members and contribute to shared knowledge and runbooks.
Contribute to security policies, standards, and processes, and support compliance efforts.
Investigate compromises across shared, virtualized, and dedicated Linux hosts, including scoping blast radius, containment, evidence preservation, and write-ups.
Develop malware and webshell signatures and log-based detections, and reduce false positives.
Review the security of in-house applications, infrastructure, third-party code, and open-source dependencies.
Modernize secrets management, including moving static credentials into Vault, adopting dynamic credentials, and eliminating plaintext secrets from code, logs, and CI.
Improve identity and access lifecycle processes, including directory and SSO migration, privileged access reviews, and offboarding.
Manage vulnerabilities and improve patch velocity across a heterogeneous fleet, including remediation of end-of-life operating systems and runtimes.
Automate recurring manual work by building and operating appropriate tooling.
Review and govern internally adopted AI and agent tooling, including data exposure, permission scope, agent identity, and abuse paths.

Benefits

Full health, vision, and dental insurance for the entire family at no cost to the team member.
3% Safe Harbor contribution to 401(k), plus up to 1% employer match.
Opportunities for profit sharing and bonuses.
Generous paid time off, starting at 15 vacation days.
11 paid holidays.
Paid sick leave, with 80 hours accrued.
Tuition reimbursement on a 50/50 basis up to a specific amount.
Pet insurance.
Thrive Pass wellness allowance of $30 per month.
Udemy online learning courses.
Disability insurance.
Generous maternity and paternity leave.
Discounted personal travel through the corporate Egencia booking program.
Laid-back atmosphere.
Monthly company events.
Free web hosting.
Company-issued laptop.
Extensive training and opportunities for growth.