Sr Product Security Engineer | Remote | Europe

h3The AI orchestration of your wildest imagination. /h3 pn8n is the open workflow orchestration platform built for the new era of AI. We give technical teams the freedom of code with the speed of no-code, so they can automate faster, smarter, and without limits. Backed by a fiercely inventive community and 500+ builder-approved integrations, we’re changing the way people bring systems together and scale ideas for impact. /p pSince our founding in 2019, we’ve grown into a diverse team of over 260 - working across Europe and the US, connected by a shared builder spirit and with our centre of gravity in Berlin. Along the way, we’ve: /p ul liCultivated a community of more than 650,000 active developers and builders /li liEarned 190K+ GitHub stars, making us one of the world’s Top 40 most popular projects /li liBacked by top investors, from Sequoia’s first German seed to our SAP's recent strategic investment - bringing us to a $5.2bn valuation /li /ul pThat’s the company we’ve built. Now we’d love to see what you can build. /p pWe’re in a defining moment of an incredible journey. Come and build with us. /p h3Your main goal will be to bidentify and reduce security risks across n8n's product and internal systems /b, using threat modelling, hands- on security expertise, and cross-functional collaboration to help teams design, build, and operate more secure systems. /h3 pYou’ll join our growing security team at a pivotal stage, acting as a trusted security partner to teams across the business. You’ll help us build a move from reactive security management to a proactive, scalable security practice. /p h3Here’s what you’ll be driving: /h3 h3Threat Modelling, Risk Assessment Security Design /h3 ul liConduct threat modelling and risk assessments across product features, AI agents, cloud infrastructure, corporate IT, internal applications, and data systems, identifying vulnerabilities and recommending practical mitigations. /li liPartner with Engineering, Cloud, IT, and Data teams to review security designs, define actionable security requirements, and influence the implementation of appropriate controls. /li liHelp teams embed security into their development processes through secure coding guidance, design reviews, documentation, and security tooling that enables them to identify and address risks independently. /li /ul h3Vulnerability Management Coordinated Disclosure /h3 ul liParticipate in the security triage rotation, assessing incoming vulnerability reports, validating findings, and prioritising remediation based on severity and business impact. /li liCollaborate with engineering teams to coordinate vulnerability remediation, verify fixes, and support secure patch and release processes. /li liHelp manage our vulnerability disclosure and bug bounty programmes, including engagement with security researchers, coordinated disclosures, and GitHub Security Advisories. /li /ul h3Security Operations Incident Readiness /h3 ul liHelp establish and improve logging, detection, and protective monitoring capabilities across our infrastructure, corporate systems, and internal applications. /li liDevelop and improve incident response processes, runbooks, and exercises to strengthen our ability to detect, investigate, and respond to security incidents. /li liWork closely with system owners to identify security gaps, prioritise remediation, and verify that implemented controls effectively reduce risk. /li /ul h3Customer Trust Compliance Engineering /h3 ul liSupport SOC 2 compliance by helping establish continuous control monitoring, automated evidence collection, and processes that make security assurance part of everyday operations. /li liCollaborate with Sales, Solutions Engineering, and Customer Success to respond to customer security assessments and build reusable resources that streamline future requests. /li liPartner with Legal, Finance, IT, and other stakeholders to assess security risks, improve security policies and controls, and strengthen trust with enterprise customers. /li /ul pWe're hiring two Security Engineers with complementary strengths, so you don't need to be an expert in every security domain. /p h3Requirements /h3 h3Must-haves /h3 ul liThreat Modelling Risk Assessment: You have hands- on experience assessing real- world systems, identifying security risks, determining defensible severity levels, and recommending practical controls that teams can implement. /li liTechnical Security Expertise: You can validate security findings, reproduce vulnerabilities, develop proof- of- concept, and write code or automation when needed to demonstrate risks or improve security processes. /li liSecurity Engineering Experience: You've worked hands- on in infrastructure, product, or application security within a product- focused organisation, with a strong understanding of how modern systems are designed and secured. /li liCross- functional Influence: You're comfortable acting as an internal security consultant, advising teams, challenging technical decisions constructively, and influencing stakeholders without direct authority. /li liRisk Remediation Ownership: You've helped secure systems you don't directly own, translating security findings into actionable requirements and working with responsible teams to ensure effective remediation. /li liAI LLM Fluency: You're comfortable using LLM- assisted tooling and understand its limitations, security implications, and potential failure modes. /li liClear Communication: You can explain complex security risks, document technical findings, and provide practical guidance that engineers and non- technical stakeholders can confidently act on. /li /ul h3You also bring deep expertise in at least two of the following areas: /h3 ul liApplication Security: You've developed security checks, engineering guardrails, tooling, or guidance that helps product teams build and ship secure software. /li liPlatform Security: You have experience securing a major cloud provider and Kubernetes environments, including areas such as sandboxing, multi- tenancy, or identity. /li liCorporate Security: You've worked on identity and access management, endpoint security, employee access lifecycles, or data access controls across corporate environments. /li liSecurity Monitoring: You've implemented logging, protective monitoring, or security detection capabilities that support effective investigation and incident response. /li liSecurity Assurance Compliance: You've supported SOC 2 or ISO 27001 from an engineering /li /ul #J-18808-Ljbffr