Кибербезопасность вакансии - удалённо

Location: Georgia; Belarus; Moldova; Serbia; Armenia; Kyrgyzstan; Montenegro; Uzbekistan; Bulgaria; Czech Republic; Estonia; Finland; Portugal; Romania; Azerbaijan Workplace: remote About the Team We are Quadcode, a fintech company excelling in financial brokerage activities and delivering advanced financial products to our global clientele. Our flagship product, an internal trading platform, is offered as a Software-as-a-Service (SaaS) solution to other brokers. We're looking for a Junior Cybersecurity Specialist to join our Security Team. This role sits within the engineering direction of our cross-functional Security team, focused on identifying and helping mitigate security issues, misconfigurations, and vulnerabilities related to corporate infrastructure. In this role, you'll work closely with infrastructure teams (Admins, NOC, OPS, IT Compliance) and business employees who require security-related help. We work in Agile (2-week sprints, grooming, planning, retro) and use Google Meet, Slack, TargetProcess and Confluence for teamwork. Working hours: Business hours, EET/EEST time zone. You'll work with a modern stack and grow within the company - including cloud and hybrid infrastructure, and AI applied to real security work. Tech Stack: Splunk, CheckPoint, Rapid7, AWS, OpenStack, Gitlab, K8s, Terraform, Ansible, Python, Linux, Windows, macOS. Tasks Proceed with requests and notifications related to the security (access management, security tool notifications, vulnerability assessment, etc.); Identify and help mitigate security issues, misconfigurations, and vulnerabilities related to corporate infrastructure; Develop, implement new, and update existing security measures for the protection of corporate infrastructure; Support the identity and access management process; Formation of a knowledge base for the operation of products and services; Assist the security analytics with the incident response process; Collaboration with the Ops and Infrastructure teams in terms of asset security. Requirements 1+ year of experience in server administration, network engineering, site reliability engineering, infrastructure security, cloud security, or systems engineering; Knowledge of the Linux, Windows, and Mac operating systems and common OS hardening practices; Technical knowledge of network protection and network Device Hardening; Automation skills (Bash, Python); Understanding how computer attacks occur; Passion for developing in cybersecurity; Ability to work in a team, listen, and learn independently; Competent written and verbal communication skills (Russian C1 and English B1); Have a good analytical mindset for problem-solving. Nice to have Background in cybersecurity; Experience using AI tooling for technical/cybersecurity tasks; Experience in vulnerability analysis; Experience with infrastructure-as-code (Terraform, Ansible, Chef, etc.); Understanding the tactics and techniques of intruders and how to defend against them. We offer Full-time remote work (service provider contract). Competitive compensation (EUR). Flexible working hours. Corporate AI subscriptions (Claude, Gemini, GPT, etc.). Access to a rewards marketplace offering products and language courses, redeemable using the company’s internal currency. A strong team of engineers. Positive and friendly atmosphere. With a team of 500+ creative and tech-driven people across the globe, Quadcode is the place where ideas turn into impact, where every project is a chance to grow, innovate, and make your mark. Join us today, and let's shape the future of fintech together! Note: All applications will be treated with strict confidence. We thank all applicants for their interest, however, only those candidates selected for interviews will be contacted. #LI-JM1

Own the full IAM strategy. for corporate, production, and product environments end to end, and own the bridge between corp IAM and product/prod IAM rather than treating them as separate problems.

Location: Remote Who we are Our mission is to bring clarity and control to the world's most complex codebases. AI is accelerating code creation, but the infrastructure to understand, oversee, and evolve that code hasn't kept pace. Sourcegraph gives engineering organizations full visibility across their systems, precise context for their agents, and the ability to execute coordinated code changes at scale. As agentic development becomes the dominant engineering paradigm, we provide the context layer teams need to take control of their codebase. With Code Search, Deep Search, MCP, and Agentic Batch Changes, we deliver on that mission today - giving engineering teams and their AI tools the cross-repo context to navigate massive codebases with confidence, and the ability to make changes across hundreds of repositories at once. Companies like Stripe, Reddit, and Leidos rely on Sourcegraph to ship faster and with higher quality. We're backed by a16z, Sequoia, and Redpoint, and proud to operate as a globally distributed team that values high agency, direct communication, and customer love. If you want to build the infrastructure that lets every engineering team - and every agent they deploy - operate on their codebase with confidence, join us. Hours & location 🌎 While we hire almost anywhere in the world, we have a preference for someone to reside in the following locations for this role. However, if you feel qualified, we welcome you to apply regardless of location. No matter what, working hours must overlap with GMT-3 for at least 20 hours/week. Preferred locations: USA Why this job is exciting As our Compliance Manager, you will own and drive Sourcegraph’s governance, risk, and compliance program, with a primary focus on compliance. This is a highly cross-functional role that works closely with Security, Engineering, IT, Legal, People, Sales, and other teams across the company. You will be responsible for maintaining and evolving our compliance program, including owning certifications such as SOC 2 and ISO 27001 and preparing Sourcegraph for additional frameworks as the business grows. This is not a role where you will simply coordinate work across a large compliance organization. We are looking for someone who has personally owned audit and certification programs end to end: designing and tailoring controls, collecting evidence, training internal teams, working directly with auditors, managing remediation, and driving follow-up work through completion. 📅 Within one month, you will… You will build strong working relationships across Security, Engineering, IT, Legal, People, Sales, and other key stakeholders. You will develop a clear understanding of Sourcegraph’s existing governance, risk, and compliance program, including our ISMS, risk register, controls, certifications, audit processes, and current areas of focus. You will understand how our SOC 2 and ISO 27001 programs operate today, including key owners, evidence requirements, open risks, and upcoming milestones. You will begin participating directly in day-to-day compliance activities and identify opportunities to improve or simplify existing processes. 📅 Within three months, you will… You will have taken ownership of Sourcegraph’s ongoing SOC 2 and ISO 27001 compliance programs. You will independently manage key audit activities, including control testing, evidence collection, stakeholder coordination, auditor requests, findings, and remediation. You will evaluate existing controls and tailor them to Sourcegraph’s environment rather than relying on overly prescriptive or generic auditor recommendations. You will actively maintain Sourcegraph’s risk register, ISMS processes, policies, and compliance documentation. You will help internal teams understand their compliance responsibilities and provide practical guidance that allows them to meet requirements without creating unnecessary process. You will support customer-facing compliance activities, including security questionnaires and compliance-related questions from prospective and existing customers. 📅 Within six months, you will… You will have successfully led Sourcegraph through an audit or major certification milestone. You will own the operating rhythm of the GRC program, including ISMS meetings, risk management activities, control reviews, documentation updates, and audit preparation. You will have established a forward-looking compliance roadmap covering renewals, upcoming audits, new frameworks, regulatory requirements, and opportunities to improve how the program operates. You will be able to independently identify control gaps or deficiencies, assess their risk, recommend practical solutions, and drive remediation with both technical and non-technical stakeholders. You will have introduced automation, AI, or other process improvements that reduce manual compliance work while maintaining or improving program quality. About you You have built or operated compliance programs in a fast-moving technology environment and have personally owned major compliance initiatives from beginning to end. You are comfortable operating independently, getting into the details, and doing the work yourself while coordinating with stakeholders across the organization. You understand that frameworks such as SOC 2 and ISO 27001 define requirements but often leave significant flexibility in how an organization satisfies them, and you know how to translate those requirements into controls that fit the business. You are also comfortable working with technical teams and modern cloud environments. You can understand enough about infrastructure, systems, access controls, software development, and security processes to ask the right questions and effectively translate between auditors and technical teams. 5+ years of experience in governance, risk, compliance, information security compliance, or a related role. Demonstrated end-to-end ownership of SOC 2 and ISO 27001 programs, ideally within a SaaS, technology startup, or similarly fast-moving environment. Experience personally managing external audits and certification processes, including audit preparation, evidence collection, control testing, stakeholder training, auditor interaction, remediation, and follow-up. Strong understanding of risk management, control design, ISMS governance, and compliance program operations. Experience adapting compliance controls to an organization's actual environment rather than applying generic or overly prescriptive requirements. Familiarity with cloud-based technology environments and the security and compliance considerations associated with a distributed or remote workforce. Strong project management and organizational skills with the ability to drive cross-functional initiatives from inception through completion. Excellent written and verbal communication skills and the ability to explain compliance requirements clearly to both technical and non-technical audiences. A hands-on mindset and willingness to personally execute the work required to keep the compliance program operating effectively. Curiosity about AI, automation, and emerging technology, with an interest in using new tools to improve compliance workflows. Nice-to-haves: Experience with additional security, privacy, or compliance frameworks such as GDPR, HIPAA, HITRUST, FedRAMP, FISMA, PCI DSS, or related standards. Experience supporting security questionnaires, customer assurance processes, or sales-related compliance activities. Experience with GRC platforms, compliance automation tools, or building internal automation for evidence collection and control monitoring. Relevant certifications such as CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, CRISC, or similar credentials. Level 📊 This job is an IC3. You can read more about our job leveling philosophy in our Handbook. Compensation We pay above-market salaries because we want to hire exceptional people who can focus on building great products, not worrying about paying bills. As an open and transparent company, our compensation philosophy and pay bands are visible to every Sourcegraph teammate, and we strive to make our approach equitable, explainable, and competitive. Your base salary is determined by the IC3 pay band for your location zone (1-4). Our pay bands are informed by market data and designed to ensure competitive compensation wherever you live. During the recruiting process, we'll discuss the range applicable to you based on job level, relevant skills, experience, qualifications, and location zone. The starting salary for the IC3 pay band in each zone is: Zone 2: $137,718 USD Zone 3: $102,899 USD In addition to competitive cash compensation, we offer meaningful equity (because when Sourcegraph succeeds, we want you to succeed, too) and generous perks & benefits . Interview process Below is the interview process you can expect for this role (you can read more about the types of interviews in our Handbook). It may look like a lot of steps, but rest assured that we move quickly and the steps are designed to help you get the information needed to determine if we’re the right fit for you… Interviewing is a two-way street, after all! We expect the interview process to take 5 hours in total. 👋 Introduction Stage - we have initial conversations to get to know you better… [30m] Recruiter Screen [30m] Hiring Manager Screen 🧑‍💻 Team Interview Stage - we then delve into your experience in more depth and introduce you to members of the team, including cross-functional partners… [Async] Working assignment [60m] Assignment Walkthrough + Review [60m] Resume Deep Dive [60m] Technical Interview 🎉 Final Interview Stage - we move you to our final round, where you gain a better understanding of our business and values holistically… [30m] Values [30m] Leadership We check references and conduct your background check Please note - you are welcome to request additional conversations with anyone you would like to meet, but didn’t get to meet during the interview process. Learn more about us You can learn more about what it is like to work at Sourcegraph by reading our handbook . We are an ambitious team who are collectively working hard to build the most influential company in the world. You can read more about our culture , competitive compensation and benefits here. Sourcegraph is an equal opportunity workplace; we welcome people from all backgrounds. Sourcegraph participates in E-Verify for U.S. Employees.

• Выполнять задачи, ставящиеся перед командой, включая исследование ядра Android, реверс-инжиниринг компонентов с закрытым исходным кодом, отладку смартфонов, проверку имеющихся уязвимостей и proof-of-concepts на эксплуатируемость, написание рабочих эксплоитов, объединение эксплоитов в цепочки.

Location: USA - Remote Workplace: Remote About Us Since 2013, we’ve been building a CRM that gets out of your way and helps your team sell more, faster. Now we’re building AI into every part of it, so Close does the busywork and your team does the selling. No manual data entry, no 10-click workflows. Just communication-first, AI-powered sales software designed to help you succeed and scale. We're bootstrapped and profitable which means we answer to our customers and play by our rules. We're proud of our 130-person, 100% remote team, focused on building Close so that no small, scaling business fails because it can't figure out sales. ABOUT THE ROLE Close is a CRM built around the communication tools sales teams use every day: email, calling, SMS, workflows, reporting, and AI. Underneath that product is a broad technical surface — Python services and a large application backend, a TypeScript and React frontend, public APIs, Docker and Kubernetes, AWS infrastructure, and integrations with providers that handle sensitive customer data. Security work happens across it all today, but the ownership is spread across Engineering, Infrastructure, and Security & Trust. We’re hiring our first dedicated Product Security Engineer to make that work systematic. You’ll report to the Backend Platform team manager within EPD (Engineering, Product, and Design), while working across the entire product and infrastructure surface. You’ll find vulnerabilities, determine which findings matter most, and drive them through remediation. Often you’ll fix the problem yourself. Other times you’ll give the owning team a clear reproduction, a practical path forward, and enough context to prioritize correctly. You’ll analyze code, build proof-of-concepts, test running applications, tune or replace noisy tools, and automate the repetitive parts of vulnerability management. This is not a role where you forward scanner alerts and call the queue managed. Product and application security will be your responsibility. You’ll partner closely with our Infrastructure team on cloud security, access, and secrets, and with our Security & Trust Lead on GRC Engineering https://grc.engineering/, compliance (SOC 2) goals, audits, and corporate security. This role is a new one at Close. You’ll have significant room to decide where better tooling, clearer ownership, and a small amount of code can reduce the most risk. OUR STACK Our backend is primarily Python, with Flask and FastAPI services and TaskTiger https://github.com/closeio/tasktiger and Temporal handling much of our asynchronous work. We expose REST https://developer.close.com/ and GraphQL APIs and store data in MongoDB, PostgreSQL, Elasticsearch, and Redis. Our frontend is a large single-page TypeScript application built primarily with React. We bundle with Vite, target modern browsers, and test with Vitest, React Testing Library, Playwright, and Chromatic. The product updates in near real time and uses technologies including WebSockets and WebRTC. Our mobile application is built with React Native. We build and test Docker images in CI/CD and continuously deploy them to Kubernetes on AWS. Our infrastructure uses managed services including EKS, MSK, and ElastiCache, alongside services running on EC2. Terraform and Ansible automate much of the underlying infrastructure, and our containerized local development environment lets engineers run the full system on their own machines. For this role, our stack extends beyond simply backend or frontend: browser behavior, frontend state, API authorization, asynchronous processing, data access, third-party integrations, containers, and cloud configuration can all be part of the same attack path. We love open sourcing our code and ideas on our GitHub https://github.com/closeio and on The Making of Close https://making.close.com/, our behind-the-scenes Product & Engineering blog. Check out our open source projects like SocketShark https://github.com/closeio/socketshark, TaskTiger https://github.com/closeio/tasktiger, LimitLion https://github.com/closeio/limitlion and ciso8601 https://github.com/closeio/ciso8601. AI is both how we build and what we ship, and that's reshaped what engineering looks like. This is a transformation we’re embracing and find deeply exciting. YOU ARE - An application security engineer who writes code. You can move from reading an unfamiliar code path, to reproducing an exploit, to proposing or shipping a production-quality fix. Strong Python or TypeScript experience would be especially useful; fluency across both backend and frontend systems is even better. - Skilled at finding vulnerabilities conventional scanners may miss. You use modern AI-assisted review pipelines, guided by expert judgment, to uncover subtle flaws in web apps and APIs—from authentication, authorization, and tenant isolation to injection, SSRF, unsafe data flows, and business logic. You can threat-model designs, white-box review code, and test running systems. - Offensive-minded and operationally responsible. You know how to test like an attacker without being careless with customer data or production systems. You can turn a finding into a safe reproduction, assess exploitability and business impact, and retest the eventual fix. - An automation builder. You have worked with some mix of SAST, DAST, software composition analysis, container scanning, secrets scanning, or cloud posture tooling. More importantly, you know how to tune tools, connect them to engineering workflows, and remove noise. - AI-native and accountable. You use coding agents and LLMs to accelerate investigation, code review, and repetitive engineering work, but you verify their output. You think carefully about what happens when agents clone untrusted code, install dependencies, or receive access to credentials. - Able to separate severity from priority. A score is an input, not a foregone conclusion. You consider reachability, existing controls, customer impact, and attack chains, then explain the risk in language that is legible to an engineer or business owner. - Comfortable working across the business. You’ll collaborate with product engineers, Site Reliability Engineers, Security & Trust Lead, auditors, and external researchers without confusing partnership for pass-off ownership. You will follow findings to closure even when another team is responsible for the fix. - Self-directed in a remote environment. You can take an ambiguous surface (say, secret rotation or dependency remediation) and learn how it works across multiple systems then turn it into a practical plan with measurable progress. You do not need to arrive as the deepest expert in every part of this scope. You do need to be able to investigate an unfamiliar system, determine what matters, and bring the right people with you. YOU WILL The work spans hands-on application security, security automation, vulnerability management, and infrastructure partnership. Depending on where you find the greatest risk and leverage, projects could include: - Build a recurring product security review program. Threat model new features, audit high-risk areas, review code, and build safe proof-of-concepts in isolated development environments. Work across our backend, frontend, APIs, and customer-facing integrations. - Improve application security testing. Combine static analysis, dependency and secrets scanning, dynamic testing in development, and carefully scoped production testing. Use existing tools where they fit and build focused automation where they don’t. - Own vulnerability intake and remediation. Triage findings from HackerOne, scanners, penetration tests, audits, customers, and internal research. Reproduce issues, assess exploitability and impact, track remediation, and verify fixes. Serve as technical lead for our bug bounty program while contract and budget ownership remain elsewhere. - Turn security alerts into useful engineering work. Verify scanner coverage and automate ingestion, deduplication, enrichment, prioritization, and routing—so teams spend less time interpreting alerts and more time fixing important issues. - Make dependency remediation safer and less manual. Improve scanning across our Python and TypeScript codebases, then build workflows to assess upgrades, stage pull requests, run checks, and route work without exposing credentials to untrusted packages or build steps. - Make secrets routinely rotatable. Partner with service owners and Infrastructure to inventory application secrets, add graceful rotation paths, document provider-specific runbooks, and automate rotation where the provider and risk justify it. Expand our use of Vault-backed dynamic credentials and reduce the number of rotations that require a coordinated fire drill. - Strengthen AWS security with Infrastructure. Evaluate and improve automated detection of risky configuration across identity, networking, compute, storage, containers, and registries. Turn findings into secure defaults, just-in-time access patterns, infrastructure guardrails, and actionable remediation—not build a second Infrastructure team. - Support audits and raising the security floor. Partner with Security & Trust on external assessments, provide technical context, and ensure findings are fixed rather than rediscovered. Along the way, create documentation, paved roads, and lightweight training that helps engineers make safer choices without waiting for a security review. - Take a key technical role in security incident response. Partner with Engineering and Infrastructure to coordinate investigation, containment, and remediation. Contribute to root-cause analysis and follow-up improvements, translating lessons learned into stronger controls and reduced recurrence. Tech you’ll touch: Python, TypeScript, React, Flask, FastAPI, GraphQL, Docker, Kubernetes, AWS, Vault, GitHub Actions, MongoDB, PostgreSQL, Redis, Kafka, Elasticsearch and the security tooling you help us choose. BENEFITS - Compensation: Competitive pay plus an organization-wide goal-based bonus - Paid Time Off: ~5 weeks of PTO to start. Plus a 1-week all-company Winter Holiday Break and paid US holidays. You'll earn 2 extra days for every year you're with Close. - 80% Work Option: Work with your manager to choose between a standard 5-day week or a 4-day week at 80% pay - Parental Leave: Paid leave for primary and secondary caregivers - Sabbatical: A 1-month paid sabbatical every 5 years with the team - Healthcare (US residents): Two medical plans with Close covering the majority of your premium, plus Dental, Vision, HSA, FSA, and company-paid Long-Term Disability - 401k (US residents): We match your contributions up to 6%, vested immediately OUR VALUES Build a house you want to live in - Examine long-term thinking and action No BS - Practice transparency and honesty, especially when it’s hard Invest in each other - Build successful relationships with your coworkers and customers Discipline equals freedom - Keep your word to yourself and others Strive for greatness - Constantly challenge yourself and others LEARN MORE Listen to our CEO and Founder, Steli Efti, tell the story of Close’s journey in the $0-30m Blueprint https://www.close.com/blueprint.  Watch our culture video https://www.youtube.com/watch?v=maXKi1GN2MI from our 2023 team retreat in Milan. Every year our entire team gathers in person to build connection, foster cross-functional collaboration, and have fun. In 2027, we're headed to Dusseldorf, Germany! Explore our product. Check out a demo https://www.close.com/demo-site! OUR HIRING PROCESS We ask a few role-specific questions as part of our application process. These questions are designed to help us learn more about you from the start, so please answer each one thoughtfully. We see this as an opportunity to get to know you beyond your resume. We use AI tools daily at Close and expect candidates to do the same. In evaluating your application, we aim to get a sense for you - the way you think, how you communicate, the work you've done. Applications that read as fully AI-generated will not be considered. Regardless of fit, you can expect to hear back from our team with an update on the status of your candidacy. If you progress to the interview process, you'll receive a full outline of the role-specific steps in your first touchpoint with us. We do our best to make the hiring process clear and human.

• Проведение пентестов web-приложений и API (black-box, grey-box, white-box), включая REST, GraphQL, gRPC и WebSocket. • Тестирование безопасности AI/LLM-функциональности (Prompt Injection, Data Leakage, RAG, MCP, Agentic AI и другие сценарии по OWASP Top 10 for LLM).

-Анализ двоичного и/или исходного кода с целью поиска ошибок реализации, уязвимостей и/или восстановления логики работы программ. -Анализ защищенности и поиск уязвимостей в устройствах и компонентах.

As an Abuse Research Engineer in the Abuse Research Group, you will play a critical role in safeguarding Stripe’s financial ecosystem by proactively hunting for advanced threats, dissecting complex fraud vectors, and extracting actionable adversary intelligence.

Location: United States; Canada Workplace: Remote ABOUT DOCKER Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout. We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default. _______________________________________________________________________ As a Senior Security Engineer, Offensive Security, you'll help drive offensive security at Docker, putting our products, platforms, and cloud infrastructure under realistic adversarial testing to surface and drive out attack paths before real adversaries find them. You'll partner with engineering, product, and leadership to turn findings into durable fixes and to shape how security is designed into every Docker product. You'll apply your expertise in penetration testing, threat modeling, and exploit development to find and eliminate risks across Docker products and infrastructure. Working across cloud infrastructure (AWS, GCP, Azure), containerized environments, and AI/ML products, you'll implement proactive security solutions that scale with Docker's growth. This role offers the opportunity to help improve security programs at a company whose products are trusted by millions of developers worldwide. You'll work in a fast-paced, technically challenging environment where your security expertise directly impacts both Docker's platform and the broader container ecosystem. RESPONSIBILITIES: - Contribute to security initiatives that align with business goals, helping ensure security is a core component of our products and infrastructure - Support and help implement key security programs such as automated security design reviews, and vulnerability management - Build deep knowledge of software security and architecture, and act as a go-to resource for engineering teams - Partner with engineering to design and implement security architecture and controls across Docker products and platforms - Plan, scope, and execute penetration tests and red-team / adversary-emulation engagements against Docker's products and services - Develop proof-of-concept exploits and produce clear, risk-rated findings with actionable remediation guidance, then retest fixes to confirm closure - Build and maintain offensive security tooling and automation to expand testing coverage and repeatability - Perform security reviews and threat modeling (design, architecture, and code) across Docker products and services, including emerging AI products, and write automated security tests and exploits - Serve on rotating on-call schedule to respond to security events, investigate threats, and coordinate remediation efforts - Educate and collaborate with cross-functional teams (e.g., engineering, product) to promote security practices - Participate in Security Incident response QUALIFICATIONS - Have 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure - Possess 2+ years of hands-on development experience in Python or Golang - Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles. - Have strong hands-on experience with securing cloud ecosystems (e.g. AWS, GCP, Azure) - Have hands-on penetration testing experience across SaaS web applications and APIs., including manual exploitation beyond automated scanners - Are proficient with offensive tooling and techniques such as. Burp Suite, and OWASP frameworks - Can write security tests and develop exploits and proof-of-concepts that find real vulnerabilities in a product - Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks - Have practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows - Have a track record of building security programs and automations from scratch, applying risk-based prioritization - Have experience performing security reviews and building or improving security review automation - Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders - Understand industry standards, and actively keep up with emerging security technologies and models - Are a team player who drives security change via collaboration and cross-functional partnerships - Hold offensive security certifications such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO - Have published CVEs, original security research, or conference talks Bonus if you: - Have experience with container escape, Kubernetes attack paths, or cloud red teaming - Have experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning WHAT TO EXPECT FIRST 30 DAYS: - Meet with security team and key partners across engineering - Gain access to team owned systems, and internal documentation - Complete security awareness training and compliance onboarding - Review application architecture, tech stack and data flow - Review risk registry and annual roadmap - Familiarize oneself with team workflows and processes - Shadow a fellow security engineer during their on-call/secops rotations FIRST 90 DAYS: - Conduct security review on emerging Docker products - Scope and execute your first penetration test against a Docker product or service - Actively participate in architecture design reviews with the team - Contribute to a Security-owned project or initiative - Collaborate with Docker developers to validate and resolve discovered vulnerabilities - Enhance incident response capabilities by participating in on-call rotation and post-incident activities - Create and maintain security documentation and runbooks FIRST YEAR OUTLOOK - Contribute to the security roadmap for improving security controls - Strengthen Zero Trust architecture and least privilege access controls - Enhance security monitoring and anomaly detection - Perform security reviews for major product releases - Own and run recurring penetration tests and adversary-emulation exercises across Docker products, and engage with external researchers - Support audits and ensure compliance with SOC 2, ISO 27xxx - Advocate for “security by design” in all product features - Become well versed in Docker products and emerging AI technologies Docker does not offer visa sponsorship for this role.   Compensation & Equity Canada: CA$271,150 – CA$434,000 + equity United States: $194,150 – $312,950 + equity ______________________________________________________________________ POSTING INFORMATION - Open vacancy: This posting is for an existing open role. - AI in hiring: Docker may use AI-assisted tools during our recruiting process. - Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent. ______________________________________________________________________ PERKS & BENEFITS - Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration. - Flexibility that fits your life – We trust you to manage your schedule while delivering great work. - Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break. - Home office support – Set up your workspace for comfort and success. - Technology stipend – Equivalent to US$100 net per month to help support your work. - Learning & development – Annual stipend for conferences, courses, certifications, and continued learning. - Parental leave – 16 weeks of paid parental leave after six months of employment. - Equity for all full-time employees – Share in Docker's long-term success as we continue to grow. - Comprehensive benefits – Medical, retirement, and paid holidays vary by country. - Docker swag – Because representing the whale never gets old. Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community. #LI-REMOTE

-Break things on purpose. Threat-model and review Solidity contracts, blockchain state transition functions in Rust, and other critical systems before an attacker gets the chance.

Analyze and investigate alerts to identify, assess, and respond to potential threats. Collaborate with teammates and customer security teams to remediate incidents and strengthen defenses.

Задачи: — Обучение с нуля в области кибербезопасности, начиная с Linux и Networking. — Обучение реальным системам и уязвимостям, их выявлению, анализу и работе с профессиональной методологией. — Подготовка независимого специалиста по безопасности, способного работать в реальной среде. Требования: — Отсутствие необходимости в предварительных знаниях. — Требуются дисциплина, время и серьёзный подход. Условия: — Обучение онлайн в вечернее время. — Группа из 8 человек, количество мест не увеличивается. Описание: — Не требуется готовый "cybersecurity mutaxassisi". — Не проводится повторное обучение поверх поверхностных знаний из других учебных центров. — Не используются готовые инструменты и команды. — Не проводится решение CTF и искусственных задач. — Обучение ведёт опытный специалист с сертификатами EWPT, EWPTX и EMAPT, работающий в государственных организациях и обладающий опытом в области хакерства, реверс-инжиниринга, архитектуры безопасности и тестирования на проникновение. — Фокус на реальных задачах и системах, а не на искусственных вызовах.

Location: Remote Workplace: Remote We are building AI to simulate the world through merging art and science. We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world. World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached. Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you. *Titles posted to our careers page are updated regularly to best advertise the role and expected seniority, but internally we have a flat titling system with two types of titles: one for individual contributors and one for people managers. ABOUT THE ROLE Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv. Runway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, our research environment and our products. Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what you need to see to catch it. You'll join the Security team and build our detection and response program the way an engineer would: detections as code, response as automation, evidence as something you can query. This is a role with real ownership: you'll own the detection program end to end, from what we log to how quickly we close an incident. You'll report to the head of security, partner with engineers across platform and research, and shape how this function grows from here. WHAT YOU'LL DO - Own detection and response end to end: what we log, what we alert on, how we triage and how we recover - Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume - Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read - Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit - Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls - Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one - Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find - Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team - Participate in an on-call rotation for security incidents WHAT YOU'LL NEED - Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward - Experience building and tuning detections in a modern SIEM, ideally managed as code - Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs - Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools - Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity - Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job - Judgment about what to alert on, what to automate and when to wake someone up EVEN BETTER IF YOU HAVE - Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets - Experience building detections or guardrails for AI agents, LLM tooling or MCP servers - Cloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody - Published open source detection content Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide. There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range. Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates. WORKING AT RUNWAY Great things come from great teams. https://www.youtube.com/watch?v=kwmj4ato2kw&ab_channel=Runway We’d love to hear from you. We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply. More about Runway - Universal World Simulator https://runwayml.com/world-simulator.html - GWM-1 https://runwayml.com/research/introducing-runway-gwm-1 - Gen-4.5 https://runwayml.com/research/introducing-runway-gen-4.5 - General World Models https://runwayml.com/research/introducing-general-world-models - Robotics SDK https://runwayml.com/research/introducing-runway-gwm-1#robotics-section - Conversational Real-time Agents https://runwayml.com/research/introducing-runway-gwm-1#avatars-section - Runway Studios https://runwayml.com/studios We're excited to be recognized as a best place to work: Crain's https://www.crainsnewyork.com/awards/best-places-work-2023 | InHerSight https://www.inhersight.com/companies/best/city/new-york-city-ny | BuiltIn NYC https://builtin.com/awards/new-york-city/2024/best-places-to-work | INC https://www.inc.com/best-workplaces/2024

Location: Remote Workplace: Remote We are building AI to simulate the world through merging art and science. We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world. World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached. Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you. *Titles posted to our careers page are updated regularly to best advertise the role and expected seniority, but internally we have a flat titling system with two types of titles: one for individual contributors and one for people managers. ABOUT THE ROLE *Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv. Runway is hiring an Infrastructure Security Engineer to secure the platform our models are trained and served on. The role covers Kubernetes platform security, cloud identity and access, software supply chain, tenant isolation in the serving layer and the research infrastructure behind our models. Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline, and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what the platform has to enforce to stop it. This is a hands-on engineering role on the Security team. You'll write policy, tooling and infrastructure code, work in the platform team's repositories, and ship controls that hold up in production. WHAT YOU'LL DO - Design and ship security controls in our Kubernetes ecosystem: admission policy, RBAC, workload identity, network policy and runtime hardening across every cluster we run - Harden the software supply chain from dependency intake through build and deploy, including package firewalling, artifact signing and provenance, and admission controls that block what doesn't pass - Own cloud IAM and identity architecture: least-privilege roles, short-lived credentials and workload federation - Secure research infrastructure and training pipelines, including access to model weights and datasets, without slowing down the people using them - Threat model new platform components before they ship and turn the findings into concrete requirements the owning team can act on - Build guardrails for AI agents and developer tooling operating inside our infrastructure - Write infrastructure as code and policy as code, and treat security configuration with the same review and rollout discipline as any other change - Give the incident response team what they need when infrastructure is involved: fast answers about how a system works and what to shut off WHAT YOU'LL NEED - Hands-on experience securing Kubernetes in production: you've written admission policies, debugged RBAC and workload identity problems and understand how a cluster gets compromised - Working knowledge of cloud IAM and networking on at least one major cloud platform, including how identity federation and short-lived credentials actually work - Experience with infrastructure as code and GitOps-style deployment, and the habit of shipping security changes through the same pipeline as everything else - Comfort writing Python, Typescript, Rust or another language to build tooling, not just scripts - An understanding of software supply chain attacks and the controls that stop them: signing, provenance, SBOMs, admission enforcement - Clear writing. Design docs, threat models and explanations to engineers who don't work in security are all part of the job - Judgment about which controls to enforce, which to recommend and how to roll out a breaking change without breaking the company EVEN BETTER IF YOU HAVE - Experience securing GPU or HPC-style compute, training pipelines or research environments - Experience with policy engines and admission controllers (Kyverno, OPA Gatekeeper, Falco or similar) - Multi-tenant isolation design in a cloud environment: ABAC, scoped credentials, per-tenant boundaries - Experience producing security architecture evidence for SOC 2, ISO 27001 or other audits and customer assessments - Open source contributions or published work in cloud or Kubernetes security Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide. There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range. Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates. WORKING AT RUNWAY Great things come from great teams. https://www.youtube.com/watch?v=kwmj4ato2kw&ab_channel=Runway We’d love to hear from you. We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply. More about Runway - Universal World Simulator https://runwayml.com/world-simulator.html - GWM-1 https://runwayml.com/research/introducing-runway-gwm-1 - Gen-4.5 https://runwayml.com/research/introducing-runway-gen-4.5 - General World Models https://runwayml.com/research/introducing-general-world-models - Robotics SDK https://runwayml.com/research/introducing-runway-gwm-1#robotics-section - Conversational Real-time Agents https://runwayml.com/research/introducing-runway-gwm-1#avatars-section - Runway Studios https://runwayml.com/studios We're excited to be recognized as a best place to work: Crain's https://www.crainsnewyork.com/awards/best-places-work-2023 | InHerSight https://www.inhersight.com/companies/best/city/new-york-city-ny | BuiltIn NYC https://builtin.com/awards/new-york-city/2024/best-places-to-work | INC https://www.inc.com/best-workplaces/2024

Location: United States & Canada Workplace: Remote About WorkOS 🚀 WorkOS builds modern developer tools and APIs that make it easy for companies to become Enterprise Ready. Our platform powers authentication, identity, authorization, and other critical infrastructure that developers need to securely scale their products to large organizations. We recently raised a $100M Series C, valuing the company at $2B, led by Meritech and Sapphire with participation from Greenoaks, Craft, Abstract, and Audacious. WorkOS powers enterprise features for many of the fastest-growing AI companies, including OpenAI, Cursor, and Perplexity, Sierra, and Plaid. As AI reshapes software, WorkOS is at the frontier of Human and Agent Authentication, Identity, and Access Control helping companies answer a new critical question: who are your agents, and what are they allowed to do? Our fast-growing customer base includes hundreds of modern software companies building the next generation of enterprise-ready products. About the Security team The Security team at WorkOS is responsible for keeping the data and identities of hundreds of millions of users secure. Security is fundamental to our products, and customer trust is the foundation of our success. We are a highly collaborative group with a strong engineering mindset. Our security program is shaped by hands-on experience attacking and defending systems, and applying lessons from across the industry. We embrace the latest advancements in practices and tooling that make modern security teams effective. We are comfortable in code and collaborate often with engineering to create products that are secure by default. Who we’re looking for - Risk-focused and pragmatic. You excel at identifying and reasoning about security risk in real-world contexts. You prioritize ruthlessly, always asking: what's the most effective way to reduce risk right now and in the long term? - A builder who can break things. You're comfortable reading and writing code, and you have a passion for deeply understanding the products you secure. You think like an attacker to find subtle, high impact vulnerabilities and like a defender to design pragmatic, effective mitigations. - A strong partner to engineering. You build trust with engineers by understanding their priorities, making security frictionless, and finding ways to make the secure path, the easiest path. - Excited about AI. You're embracing AI and automation to scale security and reduce toil. - Curious and humble. You ask the basic questions, enjoy untangling complex systems, and bring others along with you. Responsibilities - Lead secure design efforts. Partner with engineering teams on secure design and code reviews. Identify and prioritize risks early in the product lifecycle. - Build secure by default systems. Develop paved paths that systemically reduce risk and make secure development the easiest path for engineers. - Perform offensive security testing. Conduct penetration tests and code audits on new and existing products from an adversarial lens. - Improve our security tooling. Integrate and improve our static analysis, supply chain security, and vulnerability management capabilities across engineering pipelines. - Operate our responsible disclosure program. Run and improve our program by furthering automation, validating submissions, and coordinating remediation. - Improve our products. Write and ship code to remediate vulnerabilities in production systems and improve the security posture of WorkOS products. - Work directly with customers. Help build our customers' trust by directly engaging with their security-related questions and concerns. Qualifications - 5+ years of experience in a security engineering or security-focused software engineering role. - Ability to execute across a wide range of security functions such as security assessments, penetration testing, responsible disclosure, security tooling integration, etc. - Familiarity with and experience using common industry tooling. - Proven ability to identify vulnerabilities in software, demonstrated through CVEs, bug bounty, blog posts, or prior work experience. - Strong written and verbal communication skills, particularly in partnering with engineering teams. - Comfortable reading and writing code, and able to effectively leverage AI during the process. - Bonus: Experience in the authentication and identity domain. - Bonus: Experience writing production level code, especially developing security features. Benefits and Perks (US Only) 💖 At WorkOS, we offer resources that emphasize personal and familial well-being. We offer healthcare coverage for you and your family, including medical, dental, and vision. We offer parental leave, paid-time off and fully remote working arrangements.   - 401k matching - Competitive Equity - Healthcare, dental and vision coverage - FSA, ST/LT Disability, Voluntary Life - Carrot fertility benefits - 20 days paid vacation + 10 holidays + unlimited sick leave - 12 weeks fully paid parental leave - Fitness: Monthly stipend for gyms, yoga classes, race registrations or whatever keeps you active - Wellness: Monthly stipend for a massage, meditations class, therapy, or activities that enhance your well-being - Commuter benefits for hybrid employees in SF/NYC - Unlimited token usage! Please inquire directly with our recruiting team for benefits available to those working outside the US.   Equal Opportunity Employer WorkOS is an equal opportunity employer, committed to diversity and inclusiveness. We will consider all qualified applicants without regard to race, color, nationality, gender, gender identity or expression, sexual orientation, religion, disability or age. We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.

We are building a new capability that turns fragmented, noisy security logs into actionable insights. The position is full-time, 40 hours per week, with mostly remote work within Germany and monthly in-person collaboration at the Berlin office. The contract is fixed-term. Salary ranges from EUR 69,000 to 77,000 per year.

Задачи: — проводить пентест Web, API, мобильных приложений, инфраструктуры, сетей и облака; — выполнять white-box / SAST-анализ исходного кода; — работать с разработчиками, DevOps и Blue Team; — использовать Burp Suite, Nmap, Metasploit, Nessus/OpenVAS, Hydra, sqlmap, Impacket, BloodHound и др.; — участвовать в построении SecSDLC; — готовить отчёты по результатам работ. Требования: — знание OWASP Top 10 / API Top 10 / Mobile Top 10; — понимание TCP/IP, HTTP/S, DNS, LDAP, SMB; — опыт в Pentest / Network Security; — уверенное владение Linux; — опыт работы с Burp Suite, Nmap, Metasploit и инструментами анализа уязвимостей; — знание OWASP, MITRE ATT&CK, D3FEND.