What you’ll do
Depending on your experience / skillset and our broader priorities, you could:
Operate, automate, and extend vulnerability management end-to-end: triage, prioritize, and drive remediation across product, infrastructure, and dependencies, and keep the program’s SLAs meaningful rather than theoretical
Run our bug bounty program: triage incoming reports, validate severity, work with engineering on fixes, and keep researcher relationships professional and responsive
Lead product security testing: threat model new features (including AI/agent-facing surfaces), review designs and code for security-relevant risk, and do hands-on testing (manual and tool-assisted) rather than relying solely on scanners
Be a primary responder for security incidents: lead investigation and containment, drive postmortems, and turn lessons into concrete hardening work
Own meaningful chunks of our cloud/infra security posture on GCP/k8s/Postgres: harden configurations, close gaps surfaced by audits or scanning, and partner with infra engineering on secure defaults
Build and maintain security tooling and automation, including using AI/LLM tooling to speed up triage, code review, and repetitive investigation work, so the program scales without linear headcount growth
Partner with the GRC/Trust function: feed real findings into the risk register and control evidence, and help make sure compliance requirements reflect actual engineering practice
What we’re looking for
A generalist, senior-level security engineer (5+ years across security engineering, with real depth in at least two of: vulnerability management, product/appsec testing, incident response, and cloud security). We need breadth, rather than a narrow specialist in any one of these.
Hands-on and technical: you can read and reason about code (we use a lot of TypeScript), you’re comfortable in cloud environments (GCP a plus), and you can go deep on a finding rather than just filing a ticket for someone else to fix. You’re comfortable using AI coding/security tools as force multipliers (Linear Agent, Claude, Codex, etc).
Calm under pressure: you can lead an incident from first alert through postmortem without needing to be told what to do next
A builder: you’d rather write a script or ship a tool than repeat a manual process a third time
A pragmatic risk-reducer: you optimize for actually reducing risk, not for checking a box or maximizing findings count
Autonomy-oriented: comfortable setting your own priorities, working with significant independence, and knowing when to escalate
A clear communicator: able to explain a technical finding to a non-technical stakeholder and write it up so it’s actually actionable
Our tech
This is a hands-on security engineering role. You'll be running tools, reading/writing code, building detections, working in our cloud environment, and partnering closely with the engineers who build our product. Our stack is fronted by Cloudflare and runs on Google Cloud with k8s, Postgres, and Node.
For day-to-day work, we use
Linear, GitHub, Slack, and Google Workspace for collaboration
Claude and ChatGPT for general & engineering-specific AI tasks
Vanta for compliance automation and evidence collection
Our security-specific tooling includes
GitHub Advanced Security
RunReveal
SentinelOne
What we offer
We're a small, focused team that cares deeply about the quality of our work and the people we do it with. Here's what you can expect:
Competitive salary and equity
Employee-friendly equity terms including early exercise in the US and extended exercise windows
Daily meal and coffee stipend on every workday
Paid co-working space or desk
Health coverage (based on country requirements)
5 weeks paid vacation, plus local statutory holidays
4 months paid parental leave
Paid month off after 4 years & every 2 years thereafter
Regular team events and off-sites
Remote-first with no required commute
Compensation
For US-based candidates, the expected cash compensation range for this role is $240,000—$282,000. For sales roles, this range represents on-target earnings (OTE), including base salary and variable compensation; for all other roles, it represents base salary. Final compensation is determined based on job-related knowledge, skills, and experience. For sales roles, actual earnings vary based on sales performance. Equity is a meaningful part of all offers at Linear.
Learn how we think and work
Read Me https://linear.app/readme a story about our mission
Our hiring process: How we hire at Linear https://linear.app/now/how-we-hire-at-linear
How we work: Designing remote work at Linear https://linear.app/now/designing-remote-work-at-linear
Why and how we do work trials https://linear.app/blog/why-and-how-we-do-work-trials-at-linear Linear blog post
How we use AI in design https://designerfund.substack.com/p/ai-design-linear feature of Linear's design team
Scaling our real-time sync engine https://linear.app/blog/scaling-the-linear-sync-engine talk by our cofounder, Tuomas Artman, at Linear's 2023 offsite
Our recent tender offer: Sharing Linear’s growth with the people building it https://linear.app/now/sharing-growth-with-the-people-building-linear
A note on recruitment fraud: all official Linear hiring communication comes from an @linear.app http://linear.app email address, and all open roles are listed at linear.app/careers http://linear.app/careers. We never ask candidates for payment or financial information. Suspicious messages can be reported to security@linear.app.
Linear is an equal opportunity employer. We do not discriminate based on race, color, religion, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic under applicable law.
