Senior Security Engineer, DFIR

ClickUp

2d • $160,000 - $210,000

About The Position

ClickUp is hiring a Senior Security Engineer to support its engineering-focused security organization. The role centers on digital forensics and incident response, platform abuse investigations, security tooling, product defenses, and close partnership with engineering, product, data, and operations teams. The engineer will investigate threats affecting ClickUp’s platform and internal systems, collect and analyze evidence, determine what happened and the impact, and work with owning teams to complete remediation.

The role also develops actionable threat intelligence from abuse investigations and turns findings into stronger defenses, software changes, response tooling, and automated controls. The engineer will build and improve AI-assisted and agentic workflows for incident response, digital forensics, and audits, validating outputs against evidence and maintaining human review and appropriate access controls for consequential actions. ClickUp expects team members to use AI daily and assesses AI fluency in its hiring process.

As a security player-coach, this engineer will explain threats and recommendations with clear evidence, help teams design practical defenses, and mentor colleagues. The position works across cloud and SaaS environments and uses software development, security automation, AI-assisted and agentic workflows, and security investigation tooling. ClickUp welcomes software engineers who are beginning to learn security.

Requirements

• Multiple years of experience in technology or software development, including building and maintaining tooling or automation that solves operational problems.
• Practical experience using AI-assisted development or agentic workflows for engineering or security work, and ability to validate their output and recognize when human review is needed.
• Experience investigating security threats or platform abuse, including analyzing logs and other evidence, identifying threat indicators, and explaining findings and impact.
• Ability to translate a security finding into a practical software design change, response improvement, or automated control.
• Experience working with cloud or SaaS systems, including using application, identity, or audit data to investigate suspicious activity.
• Clear written communication, with findings and recommendations supported by evidence and actionable by another team.
• Ability to build relationships and mentor others on technical topics, including security.

Nice To Haves

• Experience using AI agents in a SOC or other incident response workflows.
• Understanding of agent security risks, including the confused deputy problem and the lethal trifecta.
• Ability to facilitate a conversation rather than dictate it.
• At least 3 years of software development experience and at least 1 year of security-specific experience.
• Experience with security tools such as SAST, DAST, RASP, dependency checkers, and SIEM.
• At least 1 year of AWS experience, including IAM and least-privilege architectures.

Responsibilities

• Investigate threats affecting the ClickUp platform and internal systems; collect and analyze evidence, establish what happened and its impact, and lead investigations through findings, response, and root cause.
• Work with owning teams to follow remediation through to completion.
• Investigate platform abuse, identify threat indicators and recurring patterns, develop actionable threat intelligence, and improve detection to prevent repeat abuse.
• Build and improve AI-assisted and agentic workflows for incident response, digital forensics, and ongoing audits.
• Automate repeatable investigation work, validate outputs against evidence, and maintain human review and appropriate access controls around consequential actions.
• Design, develop, and deploy controls that protect ClickUp’s product and internal systems.
• Translate investigation findings into software changes, response tooling, and automated checks that address underlying issues.
• Partner with engineering, product, data, and operations teams to explain observed threats with clear evidence and help design practical defenses.
• Mentor others so security improvements last beyond a single investigation.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed