[All remote jobs](https://jobicy.com/jobs.md)[![ClickUp logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/cd5be0ef-221.jpg)](https://jobicy.com/company/clickup.md)[ClickUp](https://jobicy.com/company/clickup.md) # Senior Security Engineer, DFIR AI Summary ClickUp is hiring a senior security engineer focused on digital forensics, incident response, platform-abuse investigations, and security automation. The role investigates threats across cloud and SaaS systems, establishes root cause and impact, and drives remediation with engineering and product partners. It also involves building AI-assisted and agentic workflows for repeatable investigations, audits, and security controls while retaining human review for consequential actions. Candidates need software-development and security-investigation experience, strong evidence-based communication, and familiarity with cloud identity, audit data, and tools such as SIEM, SAST, DAST, and RASP. This is a remote, full-time US role with an advertised annual base-pay range of $160,000 to $210,000 USD.[Apply for this job](#job-application)[View company](https://jobicy.com/company/clickup.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 160k–210k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished9 Nov 2026Apply before9 Dec 2026Listing views35Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. At [ClickUp](https://jobicy.com/company/clickup.md), we’re building the future of work: the first truly converged AI workspace unifying tasks, docs, chat, calendar, and enterprise search, all supercharged by context-driven AI. We are an AI-native company. Every team member is expected to leverage AI daily, and we evaluate AI fluency as part of our hiring process. Join us and help redefine what’s possible. 🚀 Security at ClickUp Security at ClickUp is engineering-focused. We partner with teams across the company to protect our platform, our internal systems and our customers through secure design, defensive controls, detection and response. We build tooling and automation, including AI-powered workflows, to turn what we learn into lasting improvements. About the team Application Security at ClickUp investigates threats, platform abuse and security incidents affecting our product and internal systems. We turn investigation findings into response tooling, automation and stronger product defenses, partnering with engineering and product teams to prevent repeat issues. This is an engineering-first team that uses AI tools and agentic workflows to improve how we investigate and respond. You will support this mission by thinking like a developer, breaking down a problem that we face, testing a method to approach it with automation, and implementing solutions that yield compounding value. Your skills to uncover threat indicators will be the foundation of this work. The role * Digital forensics and incident response. Investigate threats affecting the ClickUp platform and internal systems, collect and analyze relevant evidence, and establish what happened and its impact. Lead investigations through findings, response and root cause, working with the owning teams to follow remediation through to completion. * Platform abuse investigations. Identify and respond to abuse of the ClickUp platform. Uncover threat indicators and recurring patterns, develop actionable threat intelligence, and use the findings to improve detection and prevent repeat abuse. * Agentic security tooling. Build and improve AI-assisted and agentic workflows for incident response, digital forensics and ongoing audits. Automate repeatable investigation work, validate outputs against evidence, and keep human review and appropriate access controls around consequential actions. * Product defenses and security controls. Design, develop and deploy controls that protect our product and internal systems. Turn investigation findings into software changes, response tooling and automated checks that address the underlying issue rather than just the individual incident. * Engineering partnership. Work directly with engineering, product, data and operations teams as a security player-coach. Explain observed threats with clear evidence, help teams design practical defenses, and mentor others so the improvements last beyond a single investigation. Qualifications * Multiple years of experience in technology or software development, including building and maintaining tooling or automation that solves operational problems. * Practical experience using AI-assisted development or agentic workflows for engineering or security work, with an ability to validate their output and recognize when human review is needed. * Experience investigating security threats or platform abuse: analyzing logs and other evidence, identifying threat indicators, and explaining findings and impact. * Ability to translate a security finding into a practical software design change, response improvement or automated control. * Experience working with cloud or SaaS systems, including using their application, identity or audit data to investigate suspicious activity. * Clear written communication: findings and recommendations that another team can act on, supported by evidence. * Ability to build relationships and mentor others on technical topics, including security. Desirable * Experience using AI agents in a SOC or other incident response workflows. * Understanding of agent security risks, including the confused deputy problem and the lethal trifecta. * You can facilitate a conversation rather than dictate it. * 3+ years of software development experience and 1+ year of security-specific experience. * Experience with security tools such as SAST, DAST, RASP, dependency checkers and SIEM. * 1 year of AWS experience, including IAM and least-privilege architectures. Our stack Cloud and SaaS environments, software development and security automation, AI-assisted and agentic workflows, and security investigation tooling. If you are a software engineer who is only starting to learn security, please do apply! Equal Opportunity Employer ClickUp is an Equal Opportunity Employer, and qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, or national origin. Privacy Notice ClickUp collects and processes personal data in accordance with applicable data protection laws. You can find further details by viewing our [Global Candidate Privacy Notice.](https://clickup.com/careers-terms/candidate-privacy-notice) If you are a Philippine Job Applicant, please also see our [Philippine Data Privacy Notice](https://t333.s.clickup-attachments-stg.com/t333/d9a53ce2-6d2c-48cd-84b1-ed4e525f9613/Philippine%20Data%20Privacy%20Notice_2024.pdf?view=open) for further details. Visa Sponsorship Please note we are unable to sponsor or take over sponsorship of an employment visa for roles outside of engineering and product at this time. Sponsorship for engineering and product roles is not guaranteed, but is instead based on the business needs for that specific role at that time. Please reach out to the recruiter with any questions. Fraud Alert ClickUp Talent Acquisition will only initiate contact via an @[clickup.com](http://clickup.com) email or through our official careers portal on [clickup.com](http://clickup.com). We will never request fees, payments, or sensitive personal information. Please disregard any offers received outside these channels and report them to support@clickup.com. AI Processing Notice ClickUp may use artificial intelligence and machine learning technologies to help review and screen candidates’ employment applications against role-related criteria. These tools support, but do not replace, human decision‑making. If you have questions or need an accommodation in the recruitment process, please contact us at AskPeople@ClickUp.com. Show more [Apply now >](https://jobicy.com/jobs/160300-senior-security-engineer-dfir.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThe position combines hands-on DFIR, cloud and product security engineering, abuse detection, and AI workflow design. It requires independently leading investigations and converting technical findings into durable controls across multiple teams. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$185,000US market range (per year)$155k–$225k0$247.50k AI insightThe employer discloses a base salary range of $160,000–$210,000 USD per year, with a midpoint of $185,000. A reasonable estimated US market range for a senior DFIR-focused security engineer is $155,000–$225,000 annually; actual compensation may vary by experience, location, and scope of incident-response ownership. ## Core skills Skills and capabilities most closely associated with this opportunity. [Digital forensics](https://jobicy.com/jobs?search_keywords=Digital%20forensics.md)[Incident response](https://jobicy.com/jobs?search_keywords=Incident%20response.md)[Threat investigation](https://jobicy.com/jobs?search_keywords=Threat%20investigation.md)[Platform abuse detection](https://jobicy.com/jobs?search_keywords=Platform%20abuse%20detection.md)[Security automation](https://jobicy.com/jobs?search_keywords=Security%20automation.md)[AI-assisted security workflows](https://jobicy.com/jobs?search_keywords=AI-assisted%20security%20workflows.md)[Cloud security](https://jobicy.com/jobs?search_keywords=Cloud%20security.md)[AWS IAM](https://jobicy.com/jobs?search_keywords=AWS%20IAM.md)[SIEM](https://jobicy.com/jobs?search_keywords=SIEM.md)[SAST](https://jobicy.com/jobs?search_keywords=SAST.md)[DAST](https://jobicy.com/jobs?search_keywords=DAST.md)[RASP](https://jobicy.com/jobs?search_keywords=RASP.md)[Root cause analysis](https://jobicy.com/jobs?search_keywords=Root%20cause%20analysis.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[Technical communication](https://jobicy.com/jobs?search_keywords=Technical%20communication.md) Sample interview questionsDescribe an incident investigation you led from initial detection through remediation.I would explain how I validated the alert, preserved relevant logs and artifacts, scoped affected identities and systems, established the timeline and root cause, coordinated containment, and tracked corrective actions to completion. I would also describe the automation or control added to prevent recurrence. How would you investigate suspected abuse of a SaaS platform? I would begin by defining the suspected abuse pattern and querying application, identity, audit, and network telemetry for correlated indicators. I would assess account behavior, request patterns, privilege changes, and affected resources, then document confidence and impact before deploying targeted detections and product controls. How do you safely use AI agents in incident-response workflows? I use AI for bounded tasks such as evidence summarization, query drafting, enrichment, and runbook assistance, but validate outputs against source evidence. I apply least-privilege access, approval gates for consequential actions, detailed audit logs, and safeguards against prompt injection or confused-deputy risks. Give an example of turning a security finding into an engineering improvement. After identifying the root cause, I translate it into a clear technical requirement with acceptance criteria, such as stronger authorization checks, improved logging, rate limits, or an automated detection. I partner with owners through implementation and verify effectiveness with tests, telemetry, and follow-up reviews. How do you communicate a high-severity security finding to non-security stakeholders? I lead with the business impact, affected scope, evidence quality, and immediate decision needed. I avoid unnecessary jargon, provide a prioritized remediation plan with owners and dates, and keep stakeholders updated until the risk is contained and the underlying issue is resolved. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![1Password logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200909195848-296323.png) 1Password Nov 9 New ### [Security Intern, Threat Operations – Winter 2027](https://jobicy.com/jobs/160317-security-intern-threat-operations-winter-2027.md) 1Password is growing. We’ve surpassed $500M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up… * ![ClickUp logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/cd5be0ef-221.jpg) ClickUp Nov 9 New ### [Senior Security Engineer, Infrastructure Security](https://jobicy.com/jobs/160313-senior-security-engineer-infrastructure-security.md) At ClickUp, we’re building the future of work: the first truly converged AI workspace unifying tasks, docs, chat, calendar, and enterprise search, all supercharged by context-driven AI. We are an… * ![Databricks logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/12/4e3f864ba9cf3c62d471e1c62414d098.jpg) Databricks Nov 9 New ### [Principal Security Field Engineer](https://jobicy.com/jobs/160312-principal-security-field-engineer-2.md) RDQ327R177 While candidates in the listed location(s) are encouraged for this role, candidates in other US locations will be considered. The Security Field Engineering team helps data teams solve the… * ![1Password logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200909195848-296323.png) 1Password Nov 9 New ### [Staff Security Engineer, Security Incident Response](https://jobicy.com/jobs/160301-staff-security-engineer-security-incident-response.md) 1Password is growing. We’ve surpassed $500M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up… * ![HyperHug logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/04d564d3c979-221.webp) HyperHug Nov 9 New ### [Senior Unity Developer (Anti Cheat)](https://jobicy.com/jobs/160267-senior-unity-developer-anti-cheat.md) HyperHug is an international game development studio specializing in the shooter genre. Our main office is based in Cyprus, but our talented team works remotely from around the world. We’re… * ![Liftoff logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c47aea9f-221.png) Liftoff Nov 9 New ### [Security Engineer, Offensive Security](https://jobicy.com/jobs/160030-security-engineer-offensive-security.md) Liftoff is a leading AI-powered performance marketing platform for the mobile app economy. Our end-to-end technology stack helps app marketers acquire and retain high-value users, while enabling publishers to maximize… * ![Instacart logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/fe39c2bc9bb5ebb0b5e24318b1f3b60d.jpeg) Instacart Nov 9 New ### [Detection Engineer II](https://jobicy.com/jobs/160025-detection-engineer-ii.md) We’re transforming the grocery industry At Instacart, we invite the world to share love through food because we believe everyone should have access to the food they love and more… * ![DeleteMe logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c26c546a-221.png) DeleteMe Nov 9 New ### [Solutions Engineer, Cyber Security](https://jobicy.com/jobs/154932-solutions-engineer-cyber-security.md) About DeleteMe: DeleteMe is the leader in proactive privacy protection. We help security teams reduce their human attack surface by continuously monitoring and removing exposed personal data (PII) from the… * ![Caylent logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/9ed8d81b-221.jpg) Caylent Nov 8 New ### [Security Engineer](https://jobicy.com/jobs/159882-security-engineer-5.md) Caylent is an AI-first cloud services company that helps organizations turn ambitious ideas into meaningful business impact. As an AWS Premier Tier Services Partner and a charter member of Anthropic’s… * ![Databricks logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/12/4e3f864ba9cf3c62d471e1c62414d098.jpg) Databricks Nov 8 New ### [Staff Enterprise Security Engineer](https://jobicy.com/jobs/159859-staff-enterprise-security-engineer.md) RDQ227R1176 While candidates in the listed location(s) are encouraged for this role, candidates in other locations (US based) will be considered. Mission Databricks is hiring an L6 Staff Enterprise Security… [Browse all jobs](https://jobicy.com/jobs.md)