Security Engineer

OverviewWe are looking forThe Open Home Foundation is looking for a Security Engineer to join our Home Assistant team.
This role focuses on keeping Home Assistant and its ecosystem secure by owning the intake and coordination of reported security issues, strengthening our CI/CD and release security, and proactively reducing risk through audits, testing, and security improvements.
You will work closely with engineering, and the broader open-source community to improve our security posture across code, build pipelines, dependencies, and releases.
What You Are Going To DoOwn security issue intake and coordination by triaging reports submitted via our established channels (including private reports through GitHub Security Advisories and our security contact process), reproducing issues where needed, coordinating fixes with maintainers, and ensuring responsible disclosure practices.
Drive timely remediation by tracking SLAs, communicating status with reporters and internal stakeholders, and coordinating releases and backports when required.
Harden our CI/CD and release workflows by improving build pipeline security, secrets management, artifact integrity, and access controls;
and by reducing exposure to supply chain attacks.
Strengthen supply chain defenses by improving dependency and artifact verification, provenance, signing, and monitoring;
and by hardening the paths through which third-party code and integrations enter the ecosystem.
Build preventive security practices by introducing and continuously improving security testing and scanning in our engineering workflows;
including SAST/DAST where appropriate, dependency and artifact scanning, and CI/workflow static analysis.
Coordinate external security work by scoping and managing third-party audits, pentests, and targeted reviews;
and by ensuring findings are remediated effectively.
Create and maintain security processes and documentation that are clear, repeatable, and community-friendly, including runbooks for incident response and disclosure.
Collaborate with the community by supporting maintainers and contributors with guidance, reviewing security-relevant pull requests, and helping raise security awareness across the project.
What You Need To Have5+ years preferred, or 3+ years with strong, demonstrated ownership in vulnerability management and CI/CD / supply-chain security.
Demonstrated experience triaging and coordinating vulnerability reports (e.G., CVEs, responsible disclosure workflows) and driving remediation across multiple stakeholders.
Strong understanding of software supply chain security (dependencies, build systems, artifacts, signing, provenance, CI/CD hardening).
Experience securing CI/CD pipelines (e.G., GitHub Actions), including secrets management, permissions, token scopes, and isolation.
Practical knowledge of secure software development practices and ability to perform risk assessments and security reviews.
Ability to work independently, with strong problem-solving skills and attention to detail.
Extensive proficiency with Git and GitHub workflows (pull requests, reviews, merging, etc.).
Professional fluency in English, excellent written and verbal communication skills in English.
European residency, you must be currently based in Europe and eligible to work within it.
It Would Be Great If You Also HaveExperience with Python ecosystems and packaging (pip, PyPI), dependency management, and common security tooling.
Familiarity with SBOMs, SLSA, signing and attestations (e.G., Sigstore/cosign), and reproducible builds.
Experience with incident response and post-incident reviews.
Prior contributions to Home Assistant or other open-source projects.
Experience working with IoT / smart home software and threat models.
Experience improving security testing and integrating checks into developer workflows.
Affinity for the open-source philosophy and community-driven development.
A passionate Home Assistant user, or a strong interest in smart home technology and automation.
What We Offer YouThe Open Home Foundation is a fully remote organization that uses an Employer of Record to employ people from all over the world.
You will be a normal salaried employee in your country.
This is a full-time position for 40 hours per week.
Because we are a fully remote company, there is no fixed schedule.
For the purpose of team communication, we do try to ensure at least 3 hours of overlap in the workday.
You will report to the Home Assistant Lead, who is based in the Netherlands.
Core to the establishment of the Open Home Foundation was the well-being of the people building the future of the smart home.
We will provide all the benefits required by the country you reside in.
However, we also want to make sure all our employees, regardless of country of origin, get at least a minimal set of benefits,