Join forces with Kendal to make YNAB Even More Secure™.
Implementing security controls and processes.
Configure and maintain security tooling across the organization.
Implement and optimize access controls and data protection measures.
Write automation scripts and help maintain security infrastructure.
Collaborate with engineers to integrate security into the development lifecycle.
Conduct security testing of new features and systems.
Monitor security events, analyze threats, and respond to security incidents.
Support bug bounty program activities and coordinate responses to security reports.

Requirements

Have at least two years of hands-on experience in security engineering, software engineering, DevOps, IT security, or a closely related technical field.
Have practical experience with application security (for example: performing code reviews, threat modeling, working with developers on secure design, or using SAST/DAST tools).
Have experience building, maintaining, or monitoring security logs—preferably with DataDog, but similar systems (Splunk, ELK, CloudWatch, etc.) are fine.
Live in the United States, in either the Central (UTC-6) or Eastern (UTC-5) timezone, and be authorized to work here without sponsorship.
Some level of formal technical education and/or a security-related certification (such as CISSP, CEH, Security+, CC, CCSP, Pentest+, or similar) is preferred.
Proficiency in at least one modern programming or scripting language (e.g., Python, Go, Java, JavaScript) is preferred.
Familiarity with security frameworks such as SOC 2, ISO 27001, NIST, or CIS Controls is preferred.
Experience working at a technology and/or SaaS company is preferred.
Exposure to regulated industries (e.g., finance, healthcare) is preferred.
Comfort working cross-functionally with engineering, support, or compliance teams is preferred.

Benefits

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

security engineeringapplication securitycode reviewsthreat modelingSASTDASTautomation scriptingsecurity testingaccess controlsdata protection

collaborationcommunicationproblem-solvingcross-functional teamwork

CISSPCEHSecurity+CCCCSPPentest+