← All roles

Senior Security Engineer

Kestra· Security
Apply on company site
Hybrid (Europe)full-timePosted 4w ago

About the role

Senior Security Engineer to own and elevate the end-to-end security posture of Kestra's platform, infrastructure, and open-source ecosystem. Hands-on role combining offensive security (penetration testing) and defensive remediation, with responsibilities spanning code, infrastructure, and supply chain security in a fast-growing open-source SaaS environment.

Responsibilities

  • Conduct hands-on penetration testing and threat modeling across web application, APIs, control plane, and cloud environments.
  • Manage end-to-end vulnerability tracking across codebases, software dependencies (SCA), container images, and cloud infrastructure.
  • Proactively fix security flaws by writing patches, submitting Pull Requests (PRs), or collaborating with product teams to guide remediation.
  • Audit and harden cloud infrastructure (GCP, Kubernetes clusters, networking configurations) against external and internal threats.
  • Automate security tooling into CI/CD pipelines (SAST, DAST, dependency scanners) to catch CVEs before code reaches production.
  • Perform security code reviews and evaluate third-party dependencies, open-source integrations, and supply-chain risks.
  • Lead incident response efforts and establish continuous monitoring, detection, and mitigation strategies.
  • Own public security posture as an open-source project: vulnerability disclosure process, CVE handling, security advisories, and trust model of plugin ecosystem.

Qualifications

  • 5+ years of experience in Security Engineering, Product Security, DevSecOps, or a combined Offensive/Defensive role.
  • Strong hands-on penetration testing background, with proven ability to discover application, API, and network-level vulnerabilities.
  • Builder/fixer mindset: ability to read code, understand exploits, write fixes, or provide remediation steps to engineers.
  • Deep familiarity with cloud security (AWS or GCP) and containerized environments (Kubernetes, Docker).
  • Experience with dependency and supply-chain security (CVE management, open-source licensing, SCA tools).
  • Fluent in English and comfortable working autonomously in a fully remote environment.
  • Adaptability to a fast-paced open-source startup environment where pragmatism and execution speed matter.

Skills

Required:Penetration testingThreat modelingVulnerability managementCloud securitySupply-chain security

Benefits

  • Work from anywhere (remote-first, plus coworking access)
  • Health coverage (medical, dental, vision)
  • Home office setup provided
Last updated Oct 21, 2026. Interested? Apply on the company site.
Kestra logo

About Kestra

Powerful orchestration. Simplified workflows.

Use declarative language to build simpler, faster, scalable and flexible data pipelines

Data OrchestrationWorkflow AutomationOpen Source
Company profileWebsite

More open roles at Kestra