Tuesday, June 28, 2022
HomeBudgetWe're Hiring a Humbly Assured Senior Safety Engineer

We’re Hiring a Humbly Assured Senior Safety Engineer

About Us and Why We’re Hiring

We construct “You Want a Price range,” the perfect budgeting software program and academic sources round. (These within the know name us YNAB, which is pronounced “why-nab.”) For greater than a decade, folks have been shopping for YNAB after which telling their buddies what a distinction it has made of their lives. Google us, or learn a few of our opinions on the app retailer, and also you’ll see what we imply. We love constructing one thing that has an enormous constructive influence on folks’s lives.

We’ve taken the stance that it’s finest to make safe practices and selections a sensible a part of our firm tradition from day one. Consequently, now we have quite a few applications and practices in place that we’re happy with, and you’ll examine a few of our public-facing ones in our safety coverage. However safety is a journey, and though now we have loads of individuals who get obsessive about safety, we’re on the level in our journey the place we wish somebody who will get to obsess about safety all day, day by day. And that’s the place you, our new safety engineer, are available. You’re keen on serving to these round you make good selections round safety and are skilled in serving to construct belief and comprehension round finest practices. You’re a vital thinker with an open thoughts, you purpose/debate with empathy, have sturdy communication abilities, and have deep respect for the ability of collaboration.

Now we have one overarching requirement in relation to becoming a member of our group: our Core Worth Manifesto has to actually click on with you. In the event you’re nodding emphatically whereas studying this, you’ll most likely prefer it right here, and we will’t wait to attach with you!

After all, now we have some agency* necessities too, like 5 years of expertise concerned in constructing software program, with at the very least 3 years devoted to a security-focused position.

*Nicely, firm-ish. If you realize you’re a terrific match for this position however fall a bit in need of the five-year requirement, we encourage you to go forward and apply. We don’t want you to be the right candidate on paper. 

On an analogous be aware, we all know impostor syndrome could be a highly effective power and should discourage incredible folks from making use of. Please apply anyway. Many people right here have it too, so that you’re in good firm.

Okay, let’s discuss life at YNAB, after which we’ll go into element about what we’re in search of. 

Who You’d Be Working With

You’ll naturally work with engineers, however you’ll additionally ceaselessly work with everybody in our cross-functional product groups: Designers, Product Managers, and Buyer Assist. And since your safety suggestions will typically apply to how we work internally, you’ll work with workers in advertising, training, and operations too.

All of our workers have one factor in frequent: They’re a pleasure to work with. You gained’t discover heated arguments and raised voices right here. We save our aggressive spirit for YNAB’s exterior opponents (or the occasional spirited board/online game session), however internally we construct up our teammates and rejoice their successes.

We’re all keenly conscious of our work’s influence on prospects and the corporate, and we acknowledge safety and privateness are a necessary a part of each position, no matter title. 

So, safety isn’t a tough promote round right here. All of us work and sleep a bit bit higher after we know methods to architect a system that’s safe by design, and after we know that an errant click on on that attachment isn’t going to destroy the corporate. 

And when one in every of us does make a safety mistake, we’ll admit it as a result of we blame defective processes, not folks.

How You’ll Work at YNAB

We additionally work actually arduous, collectively, to make working at YNAB an incredible expertise, and we have been (humbly) proud to be named Fortune’s #1 Greatest Small Firm to Work For the final two years. Now we have a group of really distinctive folks—the type you’ll be excited to work with. Right here’s how we function:

Duty and Empowerment

YNAB appreciates, respects, and trusts the experience and judgment of our engineers. We empower them to do what they assume is correct. 

We additionally work collaboratively. We repeatedly search the correct amount of construction and unity essential to maximise productiveness. The place it is smart, we designate somebody to make a name. 

Although our persons are proper lots, it’s okay to make errors right here. Exploration and calculated dangers are important to velocity and development. We freely admit after we’re fallacious. If one thing doesn’t go as anticipated, we be taught, bounce again, and make corrections. 

You gained’t be alone; others will likely be there to assist, overview, reassure, and again you up. We personal our processes and collective outcomes as a group.

Dwell (Nearly) Wherever You Need

We’ve at all times been a completely distant group, and have folks everywhere in the world. For this position, you’ll should be situated someplace between the Pacific Time Zone (UTC-8) and the Central European Time Zone (UTC+1). As an example, North America and most of Europe work nicely. Wherever you’re, simply be sure to have a dependable web connection.

No Outrageous Hours

We would like everybody to have a full life outdoors of YNAB, and we seldom work greater than 40 hours per week. There have been a number of events the place issues bought busy and other people needed to put some further time in. However then they took some further day off, so all of it balances out. We work arduous and sensible, however we’re on this for the lengthy haul.

Take Trip (Severely)

We would like you to take trip. The truth is, now we have a minimal trip coverage of three weeks per yr. 5 weeks feels about proper (plus two further weeks for our company-wide December break). It’s vital to get loads of downtime and get out and do one thing. We’ll sit up for seeing footage of your adventures in our #office_wall Slack channel.

The YNAB Retreat

When the pandemic isn’t protecting us from touring, we get the entire group collectively every year to compensate for spreadsheets and powerpoints in a Greatest Western convention room. Simply kidding. To this point, we’ve carried out Costa Rica, a gigantic cabin within the mountains, a seashore home within the Outer Banks, a ranch in Montana, and most not too long ago, Laguna Seaside. We do actually enjoyable issues at these retreats, however the spotlight is inevitably simply being collectively and having a blast.

Up Your Sport

We’re severe about serving to you enhance your craft. We funds for it (hey-o!). Assume conferences, Lynda/Skillshare subscriptions, books, and devoted time away from work to be taught one thing new. We like to see our folks develop.

Worldwide is Completely Okay

Our group is unfold throughout the globe, together with Switzerland, Mexico, Canada, Brazil, the UK, and everywhere in the United States. We arrange group members within the US and UK as workers, and people in different nations as impartial contractors. 

As talked about above, now we have a while zone restrictions for this position, however so long as you’re between UTC-8 and UTC+1, we’re good!


We provide wonderful well being, dental, and imaginative and prescient insurance coverage for our US workers, the place we cowl 100% of the premium for you and your loved ones. No must verify your imaginative and prescient, you learn that proper—100%. Though in the event you did must verify your imaginative and prescient, we’ve bought you coated!

We even have a Conventional and Roth 401k possibility. YNAB matches your contributions, as much as six % of your paycheck. Matches vest instantly. (Are you a private finance junkie like our founder Jesse? He arrange YNAB’s 401k to have the bottom payment construction doable, the place all plan prices are paid by YNAB, not your retirement nest egg. The funding funds accessible are incredible, passively-managed, ultra-low-cost index funds. Not a PF junkie? Belief us, it’s superior.) For UK workers, we additionally contribute six % to your pension.

We additionally supply beneficiant paid parental go away for all full-time group members. Right here’s to growing the world’s budgeters, one little one at a time!

Aggressive Compensation

The beginning wage vary for this place is $142,000-$170,000 USD yearly, relying on expertise. We contemplate raises yearly, and have a bi-annual profit-share bonus. YNAB wins, you win—that form of factor.

Different Tidbits

  • When you begin, we DEMAND (in a pleasant, ALL CAPS IS YELLING approach) that you just fill out your “Bucket Checklist” spreadsheet with 50 objects. (That’s tougher than it sounds!) 
  • The bucket listing actually helps in deciding what we must always offer you in your birthday and the vacations. 
  • We’re all adults. There’s no must punch a clock or ask for permission to take off early one afternoon to go see the physician. We take a look at what you accomplish, not how lengthy you sit (have you ever tried standing?) in entrance of a pc.
  • We’re at present trialing a four-day work week! For us, this implies 4 common days of labor adopted by a three-day weekend…each week. That is new to us, and we’re studying lots, however we’re enthusiastic about what it may imply each for the corporate and our group members. 
  • We would like you firing on all cylinders so we’ll set you up with a top-of-the-line pc and can change it commonly.
  • Did we point out we make an enormous, constructive distinction on this planet? 

If this appears like your splendid atmosphere, learn on as a result of now we need to discuss you. You’ll play a giant half in constructing one thing simple and joyful to make use of that helps hundreds of thousands of individuals uncover budgeting as a necessary monetary and life-planning instrument. You will change lives

You, Our New Safety Engineer


While you learn the next listing, you’re most likely going to assume, “This sounds nice. I may actually assist in these areas,” after which a number of bullet factors later, you’ll assume, “Wait, that is an excessive amount of for one particular person,” and that’s virtually definitely true. Fortunately that is solely the primary place we’re filling for our safety group. We’d like your assist to determine the small print, however as we be taught extra we will discuss rising that group the place essential. As well as, you’ll have:

  • The popularity that simply since you’ll act as our major marketing consultant in these areas, you gained’t essentially be the primary implementer.
  • Affordable expectations relating to timelines.
  • The expertise essential to know the place to prioritize your power first, based mostly on strong danger evaluation of threats, their chance, and their influence.
  • The authority to suggest methods to construct out and rent our safety group as we develop.
  • The power to assume strategically and long run, and switch that pondering into tactical progress/accomplishment.

So though we’re trying to find a safety unicorn with a large depth and breadth of data, we’re not anticipating you to be a magical unicorn! 

Defend YNAB – The Product

  • Now we have skilled, security-savvy engineers, and you’ll assist guarantee they comply with safe growth practices and construct rigor round our software program growth life cycle to make it safe. 
  • Triage incoming bugs from our ongoing Bug Bounty Program with the suitable software engineers.
  • Help and prepare us in performing security-focused code opinions.
  • Make the most of your expertise in establishing techniques which are safe by design to behave as the first safety marketing consultant for our engineers as they architect new techniques.
  • Examine intrusion/ATO makes an attempt utilizing our software monitoring stack, and suggest infrastructure enhancements to make subsequent intrusion makes an attempt simpler to determine and block.
  • Make significant suggestions for Safety Info and Occasion Administration (SIEM), and know what that will appear like for a completely distant SaaS firm.
  • Maintain abreast of finest practices and vulnerabilities to make sure that we don’t fall behind as attackers innovate.
  • Consider and Coordinate with third celebration auditors to carry out penetration checks and code audits. (And whenever you learn their report, you may simply distinguish between the advertising fluff and the scary stuff.)
  • Advocate automated checks to assist detect vulnerabilities earlier than we ship them.
  • Introduce safety requirements which are enforced by strong documentation and empathetic steerage.
  • Motive clearly about safety and product tradeoffs and steadiness such priorities in selections.
  • Discover bettering engineering requirements, tooling, and processes rewarding.

Defend YNAB – The Firm

  • Consider and increase our Inner Safety Insurance policies and Governance Paperwork.
  • Know methods to discover the steadiness between insurance policies that make us extraordinarily safe, however paralyze the group, and lax insurance policies which are extraordinarily environment friendly, however go away us one click on away from a business-ending ransomware assault.
  • Work with Operations/IT to:
    • Guarantee now we have configured our inner enterprise functions appropriately and securely.
    • Advocate cloud suppliers for security-sensitive operations, like identification administration, account provisioning, and many others.
  • Carry out Inner Danger Assessments to assist guard towards probably the most possible safety threats our enterprise faces.
  • Consider and suggest inner safety coaching supplies which are really helpful.
  • Assess our current infrastructure, from bodily asset practices to community settings.
  • Reply to safety questionnaires from potential distributors.
  • Assist navigate new legislative necessities relating to knowledge privateness.
  • Establish threats and vulnerabilities in a completely distant SaaS atmosphere.
  • Put together for potential threats that would disrupt operations.

Defend our Prospects and their Knowledge

  • We assist our prospects to make safe selections by default, and you’ll assist enhance our current techniques designed to: forestall dangerous/breached passwords, encourage enabling 2FA, resist phishing and self-XSS makes an attempt, and many others. You’ll coordinate with the product and engineering groups to guage our efforts and make suggestions to enhance them.
  • Seek the advice of with our Head of Product, Head of Know-how, Operations, and attorneys to assist reply to, and probably automate our (uncommon) GDPR/CCPA requests.
  • Area inner and exterior safety questions relating to the remedy of delicate knowledge.
  • Maintain our exterior safety and privateness insurance policies updated.

A bit extra about you:

You might have a powerful technical background with at the very least 5 years of expertise associated to constructing, transport, and securing software program. Ideally in a SaaS atmosphere.

We acknowledge that individuals get into software program “safety” by many paths, so it’s tough to boil our expertise necessities right down to an ideal listing of bullet factors, however you’re the particular person we’re in search of in the event you:

  • Will not be solely undaunted however excited concerning the above listing of duties and appropriately assured in your potential to sort out most of them.
  • Are a collaborative group participant, but in addition comfy working independently with a lot of autonomy.
  • Have sufficient expertise to be stunned to see us go away sure issues out of the above job description, and sit up for educating us.
  • Have broad sufficient abilities to have the ability to make best-practice safety suggestions for our group as an entire, whereas having deep sufficient abilities to have the ability to acknowledge and probably even exploit prime OWASP vulnerabilities like SQL injections, XSS, and many others.
  • Labored on, and probably led a safety group earlier than with a title like Utility Safety Lead or Utility Safety Engineer.
  • Are a superb written and verbal communicator.
  • We divorce administration experience from technical experience right here, and this can be a technical position. Though you don’t must know the way or want to handle folks, you have to be extraordinarily personable and capable of effortlessly be a liaison and champion of safety and coverage between all groups and ranges at YNAB.

Felony Information:

In case your path to the world of data safety concerned “hacking”, and you’ve got a prison report in consequence, we’ll nonetheless contemplate you relying upon the circumstances. Tell us upfront so we will discuss it fairly than be stunned when doing our background checks.


YNAB is an equal alternative employer. We imagine a variety of backgrounds, beliefs, skills, and experiences is vital to our success. We’re captivated with making a welcoming, supportive, and collaborative atmosphere for all workers. All are inspired to use as we proceed to develop a wise, skilled, and various group that loves working collectively to construct one thing that issues.

Find out how to Apply

  • Apply by filling out this way. You’ll must log in to your Google account to entry it.
  • The deadline is 11:59 pm PT on Sunday, July 10, 2022. 
  • Our purpose is to make the hiring course of as accessible as doable. If we might help you with an accessibility want, e mail us at  at [email protected] Remember to point out within the topic line that you just’re making use of for the Senior Safety Engineer place. (Please be aware that this inbox is barely monitored for messages associated to lodging.)

We’re excited to listen to from you!

P.S. In the event you’re not on this place proper now, however know somebody who may be, we’d recognize you passing this alongside!



Please enter your comment!
Please enter your name here

Most Popular

Recent Comments