Metabase is the easiest way for people to get insights from their data, from tiny startups who get up and running quickly to major corporations with tens of thousands of users. That's why people love us.

We bring data tools with the elegance and simplicity of consumer products to the crufty world of enterprise business intelligence. We provide an opinionated open source starting point for how companies should measure, analyze and share their data, which is used by tens of thousands of companies.

We built Metabase because existing tools for business intelligence didn’t feel like things we wanted to use. We wanted faster, simpler ways to ask questions about data, and wanted to strip away the colder feel of most Enterprise software. Folks seemed to agree, and now Metabase is used daily by tens of thousands of companies to give people in all sorts of roles access to insights they wouldn’t have otherwise had. None of this could happen without our user interface and that’s where you come in. We’re looking for someone with strong product sensibilities, extraordinarily good frontend skills, and solid software engineering fundamentals to join our team to advance the state of the art in our product and our industry.

We are hiring for multiple Engineering Manager positions.

You Will

Directly manage a team of engineers and help them ship features that delight Metabase users.
Work closely with Product, Design, and Success teams to plan and execute on the product roadmap, balancing feature development, tech improvements and bug fixes.
Coach individuals, tune processes, remove obstacles, and optimize the environment to continuously increase the speed of iteration.
Be technical, deeply understand the problems the team is solving and make decisions within that context.
Hire, onboard, and nurture top-level engineering IC talent.

Skills and Experience

Strong written and verbal communication, with a bias to written communication to support async processes in a fully remote and distributed team.
2+ years of engineering management experience or equivalent (you can demonstrate skill at key aspects of building and improving an engineering team, and supporting and developing people's careers).
Ability to debug project execution to identify issues and changes to one or more of people, process, and project scope.
Strong product sensibilities - you can critically navigate product proposal docs and Figma designs and translate them to engineering requirements that span the Metabase product stack, and identify and mitigate risks to building them.
Strong technical background in one of: Clojure or Frontend (React + Typescript) ecosystems.

Main attributes we look for in candidates

Outcome focused, with the ability to ship code by removing obstacles and making decisions.
Highly technical - can fluently read code, tech design docs, can engage in technical discussions that make the technical artifacts better, can provide constructive technical feedback, and is very close to the implementation details
Use their technical understanding to make decisions regarding project execution and delivery.
Problem decomposition to reduce risk, increase surface area for feedback and to be able to continuously adjust plans taking reality into account.
Ability to coach and grow engineers, especially in a low structure environment without formal titles and well-defined career ladders.

Why should you consider Metabase

We're relentlessly user-focused and believe in building long-term value, not short-term hacks. And we raised a $30M Series B to take our approach to the next level for years to come.
We are open source and you can check out the code to see what exactly we do. Look at our roadmap to see what we plan to build next!
The problems we face are genuinely interesting and aren’t trivial. Data influences so much of our world but isn’t that easy to interact with or understand. You’ll make tools that people rely on for their real jobs.
The business is growing and so is the company!
We're a fully remote global team (in 30 countries and growing). We get things done asynchronously with plenty of uninterrupted time and supporting each other to do the best work of our careers.
We offer flexibility (define your own schedule and work from wherever you want), autonomy, and an environment that helps you grow.

Compensation
The US base salary range for this role is $200K–$250K annually, plus equity and benefits.
Compensation is determined by role, level, location, and individual qualifications, including skills, experience, and scope of responsibility. Pay may vary by geographic location and other job-related factors.

Benefits
We offer meaningful equity and a comprehensive US benefits package, including fully employer-covered medical, dental, and vision insurance (with 75% coverage for dependents), a 401(k) with employer match available to enroll after the first 30 days, flexible and unlimited paid time off including sick time, and an asynchronous, remote-first environment.

We're a global team (50% outside the US), fully distributed (from Thailand to California), who get things done asynchronously, with plenty of uninterrupted time, supporting each other to do the best work of our careers. We offer flexibility (define your own schedule and work from wherever you want), autonomy, and an environment that fosters growth, learning, and development. We're relentlessly user-focused and believe in building long-term value, not short-term hacks. And we raised a $30M Series B to take our approach to the next level for years to come.

For U.S. applicants: Metabase participates in the federal E-Verify program, which confirms employment authorization of newly hired U.S. based employees. E-Verify is not used as a tool to pre-screen candidates and is only initiated upon hire.

E-Verify Participation Notice (English/Spanish)

Right to Work Notice (English/Spanish)

About the company

Metabase provides an open-source business intelligence tool that helps organizations analyze and visualize data. It focuses on usability for non-technical users, allowing people to connect data sources, create dashboards and reports, and embed analytics into applications without deep SQL knowledge. The product supports both self-hosted (open-source) and hosted (premium) options, including features like advanced analytics, priority support, and white-labeling through a freemium model. Compared to competitors, Metabase differentiates itself with its open-source foundation, easy-to-use interface, and flexible deployment and branding options, making it accessible to small and medium-sized businesses as well as larger enterprises. Its goal is to enable data-driven decision-making by democratizing access to data analytics and visualization across organizations.

Company Size

51-200

Company Stage

Series B

Total Funding

$38M

Headquarters

Spring Valley, California

Founded

2014

Get referred to Metabase

See people who can refer or advise you

Simplify's Take

What believers are saying

Metabase patched the August 2026 zero-day within days and hardened cloud instances.
Under 3% of Metabase Cloud customers were compromised before patching.
Metabase 62-63 broadened AI, schema, and embedded-analytics workflows for enterprises.

What critics are saying

August 2026 SQL injection let attackers create admin sessions and steal database credentials.
Self-hosted versions 0.58-0.63 stayed exposed until customers patched immediately.
Another public exploit would destroy trust in Metabase Cloud and stall enterprise adoption.

What makes Metabase unique

Metabase 63, July 2026, ships treemaps, two-factor authentication, and PDF dashboard subscriptions.
Metabase 62, June 2026, adds CLI, plugin SDK, and programmatic embedded filters.
Metabase 60-61, April-May 2026, open-sources AI tools and adds dashboards-as-code.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Remote Work Options
Flexible Work Hours

Growth & Insights and Company News

6 month growth

1 year growth

2 year growth

CyberInsider

Oct 13th, 2026

Blueberry Pediatrics discloses health data theft through Metabase flaw.

Blueberry Pediatrics discloses health data theft through Metabase flaw. Blueberry Medical has disclosed a data breach in which an attacker exploited a Metabase vulnerability to steal patient information, including children's medical records and health insurance details. The healthcare provider discovered the unauthorized access on August 22, 2026. A separate public statement places the initial intrusion on August 10, when the attacker gained administrator access to Blueberry's Metabase environment. According to the notification, Blueberry used the business intelligence platform for reporting and data analysis. The attacker exploited a previously unknown vulnerability to access the environment and copy certain patient data. Blueberry operates a pediatric telehealth service that gives families round-the-clock access to board-certified pediatricians through its app. Its service combines remote consultations with an at-home medical kit, allowing parents to submit pictures, videos, and measurements to support diagnosis. Medical and insurance information exposed. The notification includes versions addressed to patients and to parents or guardians of affected children. Information potentially exposed includes: * Full names * Dates of birth * Health plan names and policy numbers * Medical records * Dates of service * Medical codes * Service charges Blueberry says Social Security numbers and payment information were not involved. Photos and videos used by clinicians for diagnosis were stored separately and were not compromised. The disclosed data nevertheless includes sensitive details about patients' healthcare and insurance coverage. Such information could potentially help criminals make fraudulent messages appear credible, particularly if they impersonate a healthcare provider or insurer. Neither the attached notification nor Blueberry's public statement specifies how many patients were affected. Attack exploited an analytics platform. Metabase's own investigation traced the broader incident to August 3, when a cloud customer reported an API key created outside normal working hours. The vendor identified a flaw in its password-reset flow that allowed attackers to inject SQL commands into the application database. In the observed attacks, attackers used this to create an administrator session and an API key that enabled bulk data downloads. Metabase released patched versions on August 6. It later reported that fewer than 3% of its cloud customers were compromised before patching, and that some users were running publicly accessible, self-hosted installations. Blueberry says it terminated unauthorized access and associated sessions within about an hour of detection, preserved evidence, and confirmed its Metabase environment was running a non-vulnerable version by then. It also contacted law enforcement and hired a forensic cybersecurity firm. The company has since strengthened authentication, added monitoring and escalation procedures for critical vendor vulnerabilities, and increased security reviews of third-party and self-hosted infrastructure. Affected families should review healthcare and insurance statements for unfamiliar services and treat unsolicited requests referencing their medical information cautiously. Verify unexpected communications directly with the provider or insurer using established contact details. Blueberry also recommends monitoring account statements and credit reports.

LBank

Sep 3rd, 2026

Wallet owners face multiple threats.

Wallet owners face multiple threats. Trezor's own systems were not breached, and devices, private keys and wallet backups are untouched. The danger is that the records identify confirmed hardware wallet owners at specific front doors. Alongside fake emails, calls and letters, Trezor warned affected customers about risks to their physical security, and repeated that a wallet backup should never be shared or typed into a website. Owners of both Trezor and rival hardware wallet Ledger were already receiving forged letters in February, printed with holograms, QR codes and forged executive signatures, demanding they activate a fictitious security check or lose access to their wallets. At the time, cybercrime consultant David Sehyeon Baek told Decrypt that a letter carrying a name and home address signals "we can locate you," and that stolen data stays useful for years because people rarely move or change their numbers. The intrusion traces to a critical SQL injection flaw in the analytics tool Metabase, disclosed on August 6, which let unauthenticated attackers steal credentials for connected databases. Laptop maker Framework and form builder Tally were caught in the same wave. ShipMonk has reportedly received extortion emails attributed to ShinyHunters, though that attribution remains unconfirmed. Trezor said it is working to ship anonymous delivery as quickly as possible, an option using locker pickup, neutral packaging and generic sender details so that buyers need not hand over a home address at all.

SMBtech

Aug 30th, 2026

Ticket resale platform Tixel warns users of data breach in Metabase zero-day attack.

Ticket resale platform Tixel warns users of data breach in Metabase zero-day attack. Surprisingly useful AI article enhancements. Melbourne-based ticket resale platform, Tixel, has notified users that their email addresses and mobile numbers may have been accessed after an attacker exploited a zero-day vulnerability in its third-party analytics provider, Metabase. Tixel told affected users that the incident occurred inside Metabase's systems, not within the Tixel platform itself. "Our website and account systems were not breached," the company stated in a notification sent to users. No passwords, credit card details, payment information or purchase history were involved in the incident, according to the company. Part of a wider Metabase breach. The Tixel disclosure is the latest in a growing list of companies affected by a critical SQL injection vulnerability in Metabase that was exploited as a zero-day, impacting versions 1.58 and above. The vulnerability, tracked as CVE-2026-72898, carries a CVSS severity score of 10.0 - the highest possible rating. It affects the password-reset functionality and can be reached through the publicly accessible POST /api/session/reset_password endpoint, allowing a remote attacker to inject SQL into the Metabase application database without authenticating. Metabase CEO, Sameer Al-Sakran, warned in a blog post that the company's cloud platform had been compromised through the previously unknown flaw. Metabase confirmed that attackers were actively exploiting the vulnerability against real-world environments. Metabase is an open-source business intelligence and data visualisation tool that customers can connect to databases including Databricks, MongoDB, Oracle, Snowflake, Amazon and BigQuery, among others, to access analytics, query and visualise data, and build dashboards. What was accessed. In its notification to users, Tixel indicated that the breach was limited in scope. "Our investigation with Metabase indicates your email address and mobile number may have been accessed as part of this incident," the company stated. Tixel confirmed that user accounts, including any tickets or listings, were unaffected. The company warned users to watch for phishing and spam as a result of the exposure. "Be cautious of any unexpected message about your tickets, orders or account," Tixel advised. "If a message feels off, don't click anything in it - go straight to tixel.com or contact us." Tixel also reminded users that it would never ask for passwords or payment details by email or text, and would never direct payments outside tixel.com. Remediation steps. Tixel stated that it changed the keys connecting its systems to Metabase, checked for any further access - finding none - and strengthened its security and data-handling practices. On Metabase's side, the company blocked the endpoints used for the attack, then identified and patched the vulnerability. Metabase Cloud customers had their instances upgraded and patched automatically. Metabase has also engaged an independent forensic firm and notified relevant authorities and regulators, according to Tixel's notification. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalogue, requiring federal agencies to apply fixes by 14 August 2026. Other companies affected. Tixel is not alone in disclosing a breach stemming from the Metabase vulnerability. Several companies have already confirmed they were affected, including Kilo Code, Tally, Framework, n8n and ChecklyHQ, with stolen data including usernames, emails, API keys and Slack tokens across various incidents. Laptop manufacturer, Framework, disclosed that attackers accessed names, email addresses, phone numbers, physical addresses and login IP addresses through its compromised Metabase cloud instance, though payment information and order records were not affected. Workflow automation platform, n8n, confirmed that 136 records containing names and email addresses were accessed across its user base. Scale of exposure. Roughly 2,500 Metabase instances are estimated to be internet-exposed, and about 25 per cent of self-hosted cloud deployments are fully accessible online. Dataminr's threat research team conducted a broad exposure assessment on 8 August, with approximately 11,000 hosts observed as probable self-hosted Metabase deployments. Tixel directed users with further questions to [email protected] and pointed to the Australian Cyber Security Centre at cyber.gov.au and the ACCC's Scamwatch at scamwatch.gov.au for general online safety guidance. About tixel. Tixel is a Melbourne-based ticket resale marketplace founded in 2017. The platform operates as a fan-to-fan marketplace for buying and selling tickets to concerts, festivals and events, with AI-powered fraud detection and price caps that prevent scalping. Unlike some resale platforms, Tixel caps resale prices at 110 per cent of face value, verifies tickets before transfer and works with event organisers to provide a secondary market. Last Updated on August 30, 2026 by Nick Ross

HookPhish

Aug 14th, 2026

Ransomware Group shinyhunters hits: Metabase.

Ransomware Group shinyhunters hits: Metabase. HookPhish team Summary. In the latest cybersecurity news, Metabase - an organization based in US - has fallen victim to a ransomware attack conducted by the group shinyhunters. This data breach, discovered on Aug 14, 2026, 06:01 UTC, underscores the increasing need for proactive cybersecurity defenses as HookPhish continue through 2026. Incident report. | Target Organization | Metabase | | Threat Group | shinyhunters | | Summary | Updated: 12 August 2026 | SHA256: 84daf8f33954a0b03238a1e0da3ee109d5bc32acc134cfdddfac36b4b75d2480 | | Date of Breach | Aug 12, 2026, 11:10 UTC | | Discovery Date | Aug 14, 2026, 06:01 UTC | | Region | US | | Business Sector | Technology | How to reduce your ransomware risk. Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure: * awareness training - close the gap attackers exploit. * keep watch on the dark web - close the gap attackers exploit. Disclaimer. HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.

Metabase

Aug 12th, 2026

Security-focused metabase release announcement.

Security-focused metabase release announcement. Sameer al-sakran. - Aug 12, 2026 in News Following its security update last week, today Metabase is releasing hardened versions of Metabase which incorporate several security improvements, including hardening its api and fixing issues that are derivatives of the vulnerability Metabase encountered last week. Metabase strongly encourage you to upgrade immediately. This update was largely a result of its first-party security research (with hat tips to DOS, Ophion Security and Anthropic for helping identify areas of focus). While Metabase is proud of the new features Metabase has developed, Metabase is holding off on its next release, and will instead focus on weekly minor releases. These will be largely security and observability centered. Metabase understand you are interested in what happened and how you can best protect yourself. Metabase appreciate your patience as its internal and external investigations proceed, and Metabase will update you if Metabase has additional relevant information to share. In the meantime, Metabase is working hard to protect you and help you protect yourselves. Metabase will continue to invest heavily in its internal security research as well as engage with third-party researchers. Upgrade instructions. See the list of versions below and find the latest point version for the Metabase version you're running. For example, if you are running 0.58.6, you should upgrade to 0.58.31 release or later. Minimum safe releases for each Metabase version. (Updated 2026-08-14) The downloads below include the minimum safe release for each Metabase version. * Docker image: metabase/metabase:v0.63.13 * Download the JAR here: https://downloads.metabase.com/v0.63.13/metabase.jar * Docker image: metabase/metabase:v0.62.16 * Download the JAR here: https://downloads.metabase.com/v0.62.16/metabase.jar * Docker image: metabase/metabase:v0.61.18 * Download the JAR here: https://downloads.metabase.com/v0.61.18/metabase.jar * Docker image: metabase/metabase:v0.60.24 * Download the JAR here: https://downloads.metabase.com/v0.60.24/metabase.jar * Docker image: metabase/metabase:v0.59.28 * Download the JAR here: https://downloads.metabase.com/v0.59.28/metabase.jar * Docker image: metabase/metabase:v0.58.31 * Download the JAR here: https://downloads.metabase.com/v0.58.31/metabase.jar