Security Engineer II - California, US (Remote)

We help people own their digital presence. When you put your dreams online—your words, your photos, your creations—you shouldnt have to worry about your service provider mining that data for marketing purposes. DreamHosts open platform gives you the power to share your data and the freedom to control how its used.
We invest in our people, we promote from within the organization when possible and we offer extensive training to aid in your success. In this role, we offer competitive salary, health, vision, and dental insurance, as well as a company-issued laptop, 401k, opportunities for growth, and much much more! Full health/vision/dental for the entire family at

zero

cost to team member
~Opportunities for profit sharing and bonuses
~ 11 Paid holidays (Technical Support and Technical Operations use a floating holiday policy)
~ Tuition reimbursement (50/50 up to a specific amount)
~ Udemy online learning courses
~ Disability Insurance
~ Discounted personal travel through corporate booking program Egencia
~ Free web hosting

The Security Engineer II is responsible for protecting DreamHost, our infrastructure, and our customers in a large, multi-tenant Linux hosting environment where untrusted code runs on our machines by design. You will investigate live compromises, build the tooling and detections that find the next one, review the security of our own applications and infrastructure, and drive down long-standing risk across a fleet spanning shared hosting, VPS, managed WordPress, dedicated servers, cloud, and email.
Incident response across shared, virtualized, and dedicated Linux hosts — compromise investigation, blast-radius scoping, containment, evidence preservation, and write-ups.
Detection engineering: malware and webshell signatures, log-based detections, and reducing the false positives that create alert fatigue at fleet scale.
Application security review of our in-house control plane, customer panel, and internal tooling, plus the third-party and open-source code we depend on.
Vulnerability management and patch velocity across a large, heterogeneous fleet, including end-of-life OS and runtime remediation.
Anything done manually more than twice is a candidate for tooling, and youll build it.
Security review and governance of AI and agent tooling as its adopted internally — data exposure, permission scope, agent identity, and abuse paths. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the role.
Design and implement safeguards protecting customer sites, accounts, and infrastructure from active and evolving threats.
Conduct vulnerability assessments, security reviews, and risk analysis, with remediation guidance engineers can act on.
Build automation and tooling that improves detection, monitoring, response, and operational safety.
Contribute to security policy, standards, and process, and support compliance efforts without mistaking compliance for security.
~3–6 years in security engineering, incident response, application security, offensive security, or systems administration, with demonstrated ability to resolve complex security problems independently.

Depth in at least one of: application security, incident response and detection engineering, or offensive security and penetration testing plus working competence in the other two.
Strong hands-on Linux (Debian/Ubuntu preferred), including low-level concepts: processes, namespaces, capabilities, filesystems, kernels, and how things actually break.
Experience in multi-tenant or customer-facing environments where users are untrusted.
Scripting and automation youve shipped and operated in production. Python, Go, Bash, Perl, or similar. We care that youve built and maintained real tooling, not which language.
Log analysis and investigation at scale, and comfort with intrusion detection and web application firewalls (mod_security or similar).
Working knowledge of cloud platform security (AWS, GCP, Azure, or OpenStack) including IAM, network controls, and workload isolation.
Familiarity with secrets management and CI/CD security (Vault or equivalent, pipeline hardening, dependency and supply-chain risk).
Practical, current fluency with AI tooling in your own work. Clear written and verbal communication, including translating technical risk for non-technical stakeholders.
Web hosting or WordPress-at-scale experience, as a provider or a customer.
Malware analysis, YARA rule authorship, or reverse engineering.
Hands-on experience securing AI/LLM systems, agent frameworks, or MCP tooling. Prompt injection, tool-permission scoping, or data-boundary work.
DreamHost provides equal employment opportunities to all team members and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.
This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.**