About n8n
n8n is the open workflow orchestration platform built for the new era of AI, giving technical teams the freedom of code with the speed of no-code. Founded in 2019, the company has grown to over 260 people working across Europe and the US, with its centre of gravity in Berlin. It has cultivated a community of more than 650,000 active developers and builders, earned 190K+ GitHub stars (Top 40 most popular projects), and is backed by top investors including Sequoia and SAP, at a $5.2bn valuation.
Role
Your main goal will be to identify and reduce security risks across n8n's product and internal systems, using threat modelling, hands-on security expertise, and cross-functional collaboration to help teams design, build, and operate more secure systems. You'll join a growing security team at a pivotal stage, acting as a trusted security partner to teams across the business, helping move from reactive security management to a proactive, scalable security practice.
Responsibilities
Threat Modelling, Risk Assessment & Security Design
•Conduct threat modelling and risk assessments across product features, AI agents, cloud infrastructure, corporate IT, internal applications, and data systems, identifying vulnerabilities and recommending practical mitigations
•Partner with Engineering, Cloud, IT, and Data teams to review security designs, define actionable security requirements, and influence implementation of appropriate controls
•Help teams embed security into their development processes through secure coding guidance, design reviews, documentation, and security tooling
Security Operations & Incident Readiness
•Help establish and improve logging, detection, and protective monitoring capabilities across infrastructure, corporate systems, and internal applications
•Develop and improve incident response processes, runbooks, and exercises
•Work closely with system owners to identify security gaps, prioritise remediation, and verify that implemented controls effectively reduce risk
Vulnerability Management & Coordinated Disclosure
•Participate in the security triage rotation, assessing incoming vulnerability reports, validating findings, and prioritising remediation based on severity and business impact
•Collaborate with engineering teams to coordinate vulnerability remediation, verify fixes, and support secure patch and release processes
•Help manage the vulnerability disclosure and bug bounty programmes, including engagement with security researchers, coordinated disclosures, and GitHub Security Advisories
Customer Trust & Compliance Engineering
•Support SOC 2 compliance by helping establish continuous control monitoring, automated evidence collection, and processes that make security assurance part of everyday operations
•Collaborate with Sales, Solutions Engineering, and Customer Success to respond to customer security assessments and build reusable resources
•Partner with Legal, Finance, IT, and other stakeholders to assess security risks, improve security policies and controls, and strengthen trust with enterprise customers
n8n is hiring two Security Engineers with complementary strengths, so you don't need to be an expert in every security domain.
Requirements (Must-haves)
•🔍 Threat Modelling & Risk Assessment: hands-on experience assessing real-world systems, identifying security risks, determining defensible severity levels, and recommending practical controls teams can implement
•🛠️ Technical Security Expertise: ability to validate security findings, reproduce vulnerabilities, develop proof-of-concepts, and write code or automation when needed
•🔐 Security Engineering Experience: hands-on work in infrastructure, product, or application security within a product-focused organisation, with a strong understanding of how modern systems are designed and secured
•🤝 Cross-functional Influence: comfortable acting as an internal security consultant, advising teams, challenging technical decisions constructively, and influencing stakeholders without direct authority
•🎯 Risk Remediation & Ownership: experience securing systems you don't directly own, translating security findings into actionable requirements and working with responsible teams to ensure remediation
•🤖 AI & LLM Fluency: comfortable using LLM-assisted tooling and understand its limitations, security implications, and potential failure modes
•✍️ Clear Communication: can explain complex security risks, document technical findings, and provide practical guidance for technical and non-technical stakeholders
You also need deep expertise in at least two of the following areas:
•💻 Application Security: developed security checks, engineering guardrails, tooling, or guidance that helps product teams build and ship secure software
•☁️ Platform Security: experience securing a major cloud provider and Kubernetes environments, including sandboxing, multi-tenancy, or identity
•🔑 Corporate Security: worked on identity and access management, endpoint security, employee access lifecycles, or data access controls across corporate environments
•🚨 Security Monitoring: implemented logging, protective monitoring, or security detection capabilities supporting investigation and incident response
•📋 Security Assurance & Compliance: supported SOC 2 or ISO 27001 from an engineering perspective, including implementing technical controls or automating compliance evidence collection
Nice-to-haves
•🐛 Vulnerability Disclosure: helped operate bug bounty or coordinated vulnerability disclosure programmes, including publishing GHSAs or CVEs
•🧠 AI & Agent Security: experience assessing or securing LLM-powered applications and AI agents, including risks related to permissions, tool access, prompt injection, or sensitive data
•🏢 Corporate IT Tooling: familiarity with platforms such as Okta, Azure, or Drata and their role in securing corporate systems and supporting compliance
•🌍 Open-source Ecosystems: experience with open-source or source-available products, contributed to security communities, or already familiar with n8n
•🎯 Penetration Testing: practical experience independently identifying, demonstrating, and helping remediate security vulnerabilities
•🌱 Early-stage Security Experience: been an early security hire or helped establish security practices in a startup or rapidly scaling organisation
What n8n offers
•Competitive compensation and equity ownership
•Work/life balance: Europe – 30 days of vacation plus public holidays; US – 20 vacation days, 8 sick days, plus public holidays
•Health & wellness: Europe – benefits per local country norms; US – multiple low-premium, low-deductible medical plans, no-cost premium HDHP option with pre-seeded HSA, dental and vision coverage
•Future planning: Europe – pension contributions per local country norms; US – 401(k) with 4% employer match
•Financial security: Europe – benefits per local country norms; US – company-paid short-term and long-term disability insurance, plus life insurance
•€1K (or equivalent) per year for courses, books, events, or coaching
•Regular hackathons
•Remote-first team across Europe with regular off-sites
•$100 per month to support open-source projects
•Full company transparency on company performance and what everyone is working on
n8n can sponsor visas to Germany; for any other country, candidates need an existing right to work. The company language is English.
