From the listing
About the role
Ghost is a non-profit organization on a mission to create modern, independent publishing technology to power the future of online journalism. We are a sustainable, profitable company with annual revenue over $10,000,000, powering tens of thousands of websites for publications like 404 Media and companies like YCombinator and Cloudflare.
We are looking for a Senior Security Engineer to own how Ghost finds, fixes, and prevents security issues. You will be the first person at Ghost whose whole job is security, joining our Platform team to treat the security report queue as a signal for improving our code, tooling, and habits.
Ghost is an open source full-stack web application. As a member of an intentionally small team of around 50 people, you will act as the primary owner for the disclosure lifecycle and work closely with the engineers who build and ship the product every day.
What you'll do
- Own the disclosure lifecycle including triaging, reproducing, and communicating with researchers.
- Write and publish security advisories and maintain researcher policies.
- Fix security issues directly in the Node.js/TypeScript codebase and shepherd patches through to release.
- Design and implement automated security scanning and threat modeling for new architectural bets.
- Build AI-driven tooling to automate triage, reproduction, and advisory drafting.
- Provide guidance, examples, and short sessions for engineers to prevent recurring bug categories.
- Harden infrastructure related to Ghost(Pro) including dependencies, supply chain, and access.
- Participate in the on-call rotation.
What they're looking for
- Senior individual contributor experience owning application security for a real product.
- Deep knowledge of web application security (XSS, SSRF, auth flaws, path traversal, injection) in Node.js applications.
- Strong engineering skills in Node.js and TypeScript with the ability to land merge-ready fixes.
- Systems thinker who addresses root causes rather than just clearing queues.
- Experience with coordinated disclosure and collaborating with security researchers.
- Practical experience using AI tools in security workflows.
- Clear writing skills for advisories, incident write-ups, and remote communication.
- High ownership and low ego.
Nice to have
- Prior open source contributions or public advisories.
- Experience securing a hosting or multi-tenant SaaS product.
- Experience with corporate security (SSO, device management, access reviews) for remote teams.
- An interest in digital publishing and journalism.
From the company page
Ghost benefits
◉ Remote policy · in their words
“Work from anywhere: From a home office, or travel continuously if that's your thing. Everything we do is online. As long as you have wifi, you're all set.”
Pulled from their careers page · verified by Atlas
The hot takeJeff's read on Ghost
Give it up for four day workweeks. Seriously, you can keep your unlimited PTO, nobody uses enough of it anyways. And how about this golden remote work policy? "🌍 Work from anywhereFrom a home office, or travel continuously if that's your thing. Everything we do is online. As long as you have wifi, you're all set." Their careers page isn't gorgeous, but their heart is. If we were to up and quite Beach Commute, we'd all try to apply at Ghost.