New York, US (Hybrid)1 open job
Squarespace builds and hosts websites, online stores, domains, email, and scheduling software for millions of customers globally.
Squarespace runs a lot of infrastructure that attackers care about. The company, founded in 2003 and headquartered in New York City with additional offices in Dublin and Aveiro, provides website building and hosting for millions of customers globally, and it is one of the world's largest domain registrars. That combination - multi-tenant hosting plus control over domain names - puts account takeover, registrar abuse, and cross-tenant isolation at the center of the threat model.
The product surface is broad, and each piece carries its own exposure. The core platform is a drag-and-drop website builder backed by hundreds of designer-crafted templates, supporting sites, blogs, and portfolios. Around it sit online stores handling ecommerce transactions, professional email services, Acuity Scheduling for appointment booking and the customer data that comes with it, domain registration, integrated marketing tools, AI-powered website building features, and analytics. Customers span creative services, professional services, education, beauty, fitness, nonprofits, and events - businesses that increasingly run payments, bookings, and client communications on the platform without writing code themselves.
The stakes are legible: the people relying on this software are entrepreneurs, not security teams. Protecting them means treating payment flows, mailbox integrity, domain hijacking, and abuse of automated building features as first-class problems, not footnotes. Squarespace has operated for over two decades and supports businesses at every stage of growth; the security work scales with that surface rather than against it.
