Кибербезопасность вакансии - удалённо

What We Do: Huntress is a fully remote, global team focused on cybersecurity, founded in 2015 by former NSA cyber operators. They protect over 4 million endpoints and 7 million identities worldwide with enterprise-grade cybersecurity products designed alongside their Security Operations Center (SOC). What You’ll Do: - Triage, investigate, respond, and remediate various intrusions daily. - Review EDR telemetry, log sources, and forensic artifacts to determine root causes and provide remediation. - Perform tactical malware analysis. - Investigate suspicious Microsoft M365 activity and provide remediations. - Assist in escalations from Product Support for threat-related and SOC questions. - Contribute to detection engineering creation and tuning. - Participate in projects to improve outcomes for analysts and partners. - Collaborate in a mentored team environment. What You Bring To The Team: - 4+ years experience in SOC or Digital Forensics (DFIR). - Experience with Windows, Linux, and MacOS attack surfaces. - Knowledge of Threat Actor tools and techniques including MITRE ATT&CK Framework, PowerShell, Command Prompt, WMIC, Scheduled Tasks, SCM, Windows Domain and host enumeration, lateral movement, persistence, defense evasion, and other offensive TTPs. - Experience with static and dynamic malware analysis. - Working knowledge of Windows Administration or Enterprise Domain Administration including Active Directory, Group Policy, Domain Trusts. - Working knowledge of core networking concepts such as common ports/protocols, NAT, Public/Private IPs, VLANs. - Working knowledge of web technologies including web servers/applications and OWASP top 10. - Effective communication skills to explain complex events to less technical audiences. - Customer-focused decision making. - Strong curiosity and eagerness to learn. Preferred Qualifications: - Experience in MSP/MSSP/MDR roles. - Linux and MacOS investigative experience. - Experience with scripting languages like PowerShell, Python, Bash, PHP, JavaScript, or Ruby. - Experience with platforms like HackTheBox, TryHackMe, Blue Team Labs Online. - Experience with cloud investigations (M365, Azure, AWS, GCP). - Participation in cybersecurity competitions. - Familiarity with MSP tools such as RMMs. What We Offer: - 100% remote work environment. - Generous paid time off including vacation, sick time, and holidays. - 12 weeks paid parental leave. - Comprehensive medical, dental, and vision benefits. - 401(k) with 5% company contribution. - Life and disability insurance. - Stock options for full-time employees. - $500 one-time home office reimbursement. - Annual education and professional development allowance. - $75/month digital reimbursement. - Access to BetterUp coaching platform. Accommodations: - Reasonable accommodations available for application and selection process upon request. Huntress is committed to inclusivity and non-discrimination, except against hackers exploiting businesses.

Location: Serbia; Poland; Kazakhstan; Georgia; European Union Workplace: Remote 🌍 Remote Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia, starting in the Philippines. We combine global fintech expertise with deep local market knowledge to make financial services simple, accessible, and useful for millions of people across the region. 7M+ app downloads. 2M+ monthly active users. 7,000+ partner stores. US$310M+ raised from leading global investors. Manila-based, globally distributed, and hybrid-first — our team spans 45+ countries. If you want to solve complex problems at scale and impact how millions of people access and manage money, come build with us. Southeast Asia's fintech moment starts here. About the role: You'll own information security risk management, control assurance, and ISO 27001 ISMS governance across a regulated group spanning banking, consumer finance, and technology. What you'll do: - Form an independent view of security risk and challenge whether proposed controls actually address it, working directly with the Group CISO - Assess control design and operating effectiveness across areas such as IAM, cloud, endpoint security, monitoring, vulnerability management, data protection, and secure development - Turn risk and control data into clear, decision-ready reporting for governance forums What you'll own: - Own the security risk process end to end: assessment, treatment, acceptance, monitoring, and reporting - Maintain the risk register and challenge risk assessments and treatment plans so residual risk, ownership, and remediation status stay current - Maintain the security control framework, test controls using evidence, data, sampling, or technical validation, and drive remediation with control owners - Maintain the ISO 27001 ISMS: policies and standards, Statement of Applicability, risk records, control evidence, exceptions, and key security registers - Track control deficiencies, findings, exceptions, and remediation actions - Define KRIs and control metrics, and flag where management decisions or escalation are needed What makes you a strong fit: - Strong practical experience in information security risk management: inherent and residual risk, treatment, acceptance, control effectiveness, risk appetite - Enough technical depth to critically assess controls across IAM, cloud, endpoint security, monitoring, vulnerability management, data protection, and secure development - Hands-on experience reviewing or testing controls, with the ability to distinguish a documented control from an effective one - Working knowledge of ISO 27001, with the ability to turn complex risk and control information into concise management reporting - Comfortable working with GRC platforms, structured risk and control registers, and evidence management What we offer: Ownership and flexibility - Fully remote work with core collaboration hours from 12:00 to 6:00 PM Manila time (UTC+8) - Company-provided tools and equipment Health and time off - Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits - Access to an internal mental health support specialist - 22 vacation days, Philippine public holidays, and 15 sick days Growth and team experience - Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publications - Company-sponsored trips to Manila to meet and work with your team in person - High-performing teams can earn a dedicated beach house week in Southeast Asia We believe strong teams are built by people with different backgrounds, experiences, and points of view. Salmon is an equal opportunity employer, and we make hiring decisions based on skills, experience, and potential.

О проекте: Международный проект в области AI Security, связанный с разработкой сред, которые помогают LLM-моделям проходить обучение с подкреплением для задач, связанных с кибербезопасностью. Эти среды содержат задания в различных областях кибербезопасности (пентестинг, реагирование на инциденты, эксплуатация, вредоносное ПО и т.д.), цель — создавать достаточно сложные задачи, чтобы модель допускала ошибки, но которые остаются решаемыми для профессиональных специалистов. Это не классическая позиция Pentester или Red Team Engineer. Основная задача — создавать сложные, но реалистичные и проверяемые security-сценарии, в которых LLM-модели совершают ошибки из-за недостатков в рассуждении (reasoning), а не из-за неоднозначных инструкций или ограничений среды. Задачи: — Проектировать security-сценарии для оценки и обучения LLM-моделей — Создавать environments с использованием GitHub, Slack и других инструментов, встречающихся в реальной разработке — Разрабатывать задачи, требующие сложного многошагового reasoning — Моделировать реальные offensive security-сценарии (supply chain attacks, malicious pull requests, exploitation через GitHub Actions и другие техники) — Проверять сценарии на нескольких frontier-моделях и анализировать причины ошибок — Формулировать ожидаемое поведение модели и описывать, почему ошибка считается reasoning failure — Автоматизировать создание и проверку задач с использованием Python и других инструментов Требования: — 5+ лет практического опыта в Offensive Security, Application Security или Web Penetration Testing — Глубокое понимание современных техник атак и поверхности атаки веб-приложений, API, GitHub, CI/CD и связанных экосистем — Практический опыт penetration testing и исследования безопасности приложений — Опыт разработки на Python и/или JavaScript — Навыки статического и динамического анализа кода (Python, JavaScript, Java) — Умение самостоятельно исследовать новые направления, проектировать сложные сценарии и объяснять результаты — Свободный английский язык (Upper-Intermediate / B2+) — Практический опыт работы с современными LLM-моделями — Понимание особенностей работы LLM, ограничений и типичных failure modes — Интерес к AI Security и исследованию поведения LLM Будет плюсом: — Практический опыт AI Red Teaming или LLM Security — Опыт работы с Agentic AI, AI Agents или Model Evaluation — Опыт исследований безопасности GitHub Actions, CI/CD, Supply Chain Security — Сертификаты OSWE, eWPTXv2, OWEE, OSWA или аналогичные — Публикации, write-ups, участие в Bug Bounty, HackTheBox, TryHackMe, Pwn2Own или других проектах Условия: — B2B-контракт (с ИП) — Оплата в долларах США — Part-time: ориентировочно 5–20 часов в неделю — Минимальный объем — 1–2 задачи в неделю — На выполнение одной задачи обычно требуется 5–10 часов — Локация — строго вне РФ (либо уже за пределами РФ, либо готовность к релокации) — Старт — ASAP

О проекте: Международный проект в области AI Security, связанный с разработкой сред, которые помогают LLM-моделям проходить обучение с подкреплением для задач, связанных с кибербезопасностью. Эти среды содержат задания в различных областях кибербезопасности (пентестинг, реагирование на инциденты, эксплуатация, вредоносное ПО и т.д.), цель — создавать достаточно сложные задачи, чтобы модель допускала ошибки, но которые остаются решаемыми для профессиональных специалистов. Это не классическая позиция Pentester или Red Team Engineer. Основная задача — создавать сложные, но реалистичные и проверяемые security-сценарии, в которых LLM-модели совершают ошибки из-за недостатков в рассуждении (reasoning), а не из-за неоднозначных инструкций или ограничений среды. Задачи: — Проектировать security-сценарии для оценки и обучения LLM-моделей — Создавать environments с использованием GitHub, Slack и других инструментов, встречающихся в реальной разработке — Разрабатывать задачи, требующие сложного многошагового reasoning — Моделировать реальные offensive security-сценарии (supply chain attacks, malicious pull requests, exploitation через GitHub Actions и другие техники) — Проверять сценарии на нескольких frontier-моделях и анализировать причины ошибок — Формулировать ожидаемое поведение модели и описывать, почему ошибка считается reasoning failure — Автоматизировать создание и проверку задач с использованием Python и других инструментов Требования: — 5+ лет практического опыта в Offensive Security, Application Security или Web Penetration Testing — Глубокое понимание современных техник атак и поверхности атаки веб-приложений, API, GitHub, CI/CD и связанных экосистем — Практический опыт penetration testing и исследования безопасности приложений — Опыт разработки на Python и/или JavaScript — Навыки статического и динамического анализа кода (Python, JavaScript, Java) — Умение самостоятельно исследовать новые направления, проектировать сложные сценарии и объяснять результаты — Свободный английский язык (Upper-Intermediate / B2+) — Практический опыт работы с современными LLM-моделями — Понимание особенностей работы LLM, ограничений и типичных failure modes — Интерес к AI Security и исследованию поведения LLM Будет плюсом: — Практический опыт AI Red Teaming или LLM Security — Опыт работы с Agentic AI, AI Agents или Model Evaluation — Опыт исследований безопасности GitHub Actions, CI/CD, Supply Chain Security — Сертификаты OSWE, eWPTXv2, OWEE, OSWA или аналогичные — Публикации, write-ups, участие в Bug Bounty, HackTheBox, TryHackMe, Pwn2Own или других проектах Условия: — B2B-контракт (с ИП) — Оплата в долларах США — Part-time: ориентировочно 5–20 часов в неделю — Минимальный объем — 1–2 задачи в неделю — На выполнение одной задачи обычно требуется 5–10 часов — Локация — строго вне РФ (либо уже за пределами РФ, либо готовность к релокации) — Старт — ASAP

Задачи: — Развивать antifraud-направление: определять стратегию, roadmap и приоритеты; — Руководить командой scientists/developers и развивать экспертизу; — Разрабатывать и внедрять antifraud-правила, scoring-модели и автоматизировать ручные процессы; — Развивать единый antifraud-сервис и выводить решения в production. Требования: — Опыт построения fraud prevention в iGaming, fintech, marketplace или payments; — Опыт работы с разными типами фрода и управления antifraud-направлением; — Опыт управления разработкой в роли лида + готовность самостоятельно писать и выводить код в production; — Уверенный SQL и Python; опыт Machine Learning для classification и scoring-задач будет плюсом; — Опыт взаимодействия с бизнесом и другими стейкхолдерами. Условия: — Компенсация на основании ваших ожиданий; — 24 дня оплачиваемого отпуска; — Корпоративные занятия английским; — Для сотрудников офиса на Кипре - компенсация питания, GYM & SPA в офисе и корпоративные мероприятия.

Location: Poland; Georgia Workplace: Remote Solvd Inc. is a rapidly growing AI-native consulting and technology services firm delivering enterprise transformation across cloud, data, software engineering, and artificial intelligence. We work with industry-leading organizations to design, build, and operationalize technology solutions that drive measurable business outcomes. Following the acquisition of Tooploox, a premier AI and product development company, Solvd now offers true end-to-end delivery—from strategic advisory and solution design to custom AI development and enterprise-scale implementation. Our capability centers combine deep technical expertise, proven delivery methodologies, and sector-specific knowledge to address complex business challenges quickly and effectively. We are looking for an Application Security Engineer to join a greenfield digital news platform build for a major international news brand. Security is not a pre-launch checklist here — it is an engineering requirement embedded across every phase of delivery, from architecture through launch and into multi-year support. You'll be the security authority on a full-lifecycle engagement, validating controls across a composable CMS, video pipeline, advertising integrations, personalisation services, and public-facing APIs — on a platform designed to sustain extreme traffic during breaking-news events. WHAT YOU'LL DO - Define and validate application and platform security controls across all delivery phases. - Perform architecture and threat-model reviews at design stage and as the platform evolves. - Review authentication, authorization, and privileged-access controls across CMS, APIs, and integrated services. - Validate API and integration security across a composable, multi-vendor platform architecture. - Review secrets, credentials, and token-management practices across the full stack. - Support vulnerability scanning and penetration-testing activities — coordinating findings and remediation. - Validate encryption and secure data handling across storage, transit, and third-party integrations. - Review security logging, monitoring, and incident-response requirements. - Support GDPR and privacy engineering requirements throughout delivery. - Conduct third-party security assessments for integrated services and vendors. - Provide remediation guidance and produce security acceptance evidence ahead of launch. BASIC QUALIFICATIONS - 5+ years of experience in application security, security engineering, or a closely related role. - Experience performing threat modelling and architecture security reviews on complex, multi-component platforms. - Strong knowledge of authentication and authorization patterns — OAuth, OIDC, RBAC, privileged access management. - Hands-on experience validating API security and reviewing integration patterns across third-party services. - Solid understanding of secrets management, credential handling, and token lifecycle best practices. - Experience supporting or coordinating vulnerability scanning and penetration testing programmes. - Knowledge of encryption standards and secure data handling practices across storage and transit. - Familiarity with GDPR and privacy-by-design engineering requirements. - Ability to produce clear remediation guidance and security acceptance documentation for engineering and delivery teams. PREFERRED QUALIFICATIONS - Experience securing composable CMS or media platform architectures — AEM, Amplience, or similar. - Background working on high-traffic, public-facing platforms where availability and security intersect. - Experience with security logging and monitoring tooling — SIEM, alerting, incident response playbooks. - Familiarity with third-party vendor security assessment processes. - Relevant certification — CISSP, OSCP, CEH, or equivalent. - Experience working within a phased, full-lifecycle delivery programme alongside engineering and architecture teams. When you join Solvd, you'll… - Shape real-world AI-driven projects across key industries, working with clients from startup innovation to enterprise transformation. - Be part of a global team with equal opportunities for collaboration across continents and cultures. - Thrive in an inclusive environment that prioritizes continuous learning, innovation, and ethical AI standards. Ready to make an impact? If you're excited to build things that matter, champion responsible AI, and grow with some of the industry’s sharpest minds. Apply today and let’s innovate together. Solvd is an equal opportunity employer.

Требования: — Опыт Security Code Review — Знание основных уязвимостей Java, Kotlin, .NET и умение находить их в коде — Знание логических уязвимостей, где они могут возникать, и опыт их нахождения в коде и диаграммах последовательности — Опыт работы с SemGrep, Solar AppScreener — Опыт написания правил и их оптимизации — Опыт написания правил для GitLeaks — Опыт оптимизации сканирования AppScreener — Знание основных уязвимостей веб и мобильных приложений, умение оценить их критичность — Опыт триажа уязвимостей — Опыт разработки отчетов и рекомендаций по результатам анализа безопасности — Опыт проведения анализа защищенности веб и мобильных приложений — Опыт моделирования угроз и проведения ревью безопасности нового функционала приложений — Умение применять паттерны ООП на Python и написание скриптов инструментов с применением паттернов ООП — Знание английского языка на уровне чтения технической литературы — Готовность самостоятельно разбираться в чужом коде (скриптах) — Ведение базы знаний и технической документации — Работа в Agile/SCRUM командах — Опыт работы с GIT — Знание и опыт работы с CI/CD на базе GitLab

Требования: Опыт Security Code Review Знание основных уязвимостей Java/Kotlin/.NET и умение находить их в коде Знание логических уязвимостей, где они могут возникать и опыт их нахождения в коде и диаграммах последовательности Опыт работы с SemGrep, Solar AppScreener. Опыт написания правил и их оптимизации Опыт написания правил для GitLeaks Опыт оптимизации сканирования AppScreener Знание основных уязвимостей веб и мобильных приложений. Умение оценить их критичность Опыт триажа уязвимостей Опыт разработки отчетов и рекомендаций по результатам анализа безопасности Опыт проведения анализа защищенности веб и мобильных приложений Опыт моделирования угроз и проведения ревью безопасности нового функционала приложений Уметь применять паттерны ООП на Python и написание скриптов инструментов с применением паттернов ООП Знать английский язык на уровне чтения технической литературы Готовность самостоятельно разбираться в чужом коде (скриптах) Ведение базы знаний и технической документации Работа в Agile/SCRUM командах Опыт работы с GIT Знание и опыт работы с CI|CD на базе GitLab

Location: Remote (United States | Canada) Workplace: Remote 1Password is growing. We’ve surpassed $500M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up with iconic partners like Oracle Red Bull Racing. About 1Password At 1Password, we’re building the foundation for a safe, productive digital future. Our mission is to unleash employee productivity without compromising security by ensuring every identity is authentic, every application sign-in is secure, and every device is trusted. We innovated the market-leading enterprise password manager and pioneered Unified Access Management, a new cybersecurity category built for the way people and AI agents work today. As one of the most loved brands in cybersecurity, we take a human-centric approach in everything from product strategy to user experience. Over 180,000 businesses, from Fortune 100 leaders to the world’s most innovative AI companies, trust 1Password to help their teams securely adopt the SaaS and AI tools they need to do their best work. If you're excited about the opportunity to contribute to the digital safety of millions, to work alongside a team of curious, driven individuals, and to solve hard problems in a fast-paced, dynamic environment, then we want to hear from you. Come join us and help shape a safer, simpler digital future. As a Staff Security Engineer on Security Incident Response, you'll serve as a senior technical leader and builder for the team, helping shape both how we respond to incidents today and how our response capabilities evolve over time.This role is about advancing what the team is capable of, not just responding when something breaks. You'll design and build the AI-assisted systems that extend the team's reach, lead the response to the most complex incidents, and own programs that make the organization more prepared over time, from tabletop exercises and gamedays to the continued advancement of threat hunting and insider risk capabilities. You bring engineering depth, sound incident judgment, and the ability to plan, and deliver complex work against a longer-term maturity roadmap not just execute against a queue. This is a senior individual contributor role with organization-wide impact on how 1Password investigates, contains, and learns from security incidents. This role reports to the Manager, Security Incident Response. How we’re using AI today Our Engineering, Product, and Design teams are thoughtfully integrating AI across the full software and product development lifecycle to move faster without sacrificing quality or security. In practice, that looks like engineers using AI-assisted coding tools to accelerate reviews and catch bugs earlier, product managers synthesizing user research at scale, and designers rapidly prototyping and iterating with AI-generated mockups. We approach AI the same way we approach security: with clear principles, human accountability at every consequential decision point, and rigorous evaluation before anything ships to customers. This is a remote opportunity within Canada and the US. What we're looking for: - Significant experience leading complex, high-severity security incidents across multiple environments, including serving as an incident commander or equivalent technical lead. - Experience designing and building AI-assisted or agentic automation for security operations (triage, investigation, containment), with sound judgment about where automation should and shouldn't hold decision authority. - Strong software engineering skills, and experience building production tooling, automation, or systems rather than only operating existing security platforms. - Experience owning a security program or capability roadmap end to end, including planning, sequencing, and delivering multi-quarter work. - Strong understanding of cloud-native, SaaS, and identity-driven attack techniques and response approaches. - Experience designing and running tabletop exercises, gamedays, or comparable readiness programs and translating findings into improvements.. - Strong written and verbal communication skills, including the ability to represent technical tradeoffs to senior leadership and cross-functional stakeholders. - Experience mentoring engineers or otherwise raising the technical and investigative capabilities of a team. How you'll work: - You look for opportunities to build systems that scale the team's capabilities rather than relying on repeated manual effort, and you're interested in thoughtfully applying AI and automation where they can improve security outcomes. - An experienced incident commander who brings structure to complex incidents, makes sound decisions with incomplete information, and helps teams move forward during high-pressure situations. - You're comfortable taking ownership of a capability from strategy through execution, including defining priorities, sequencing work, navigating dependencies, and delivering against a longer-term roadmap. - You can operate as a technical partner to leaders and cross-functional teams, independently representing technical priorities, risks, and tradeoffs. - You value continuous improvement and contribute to an environment where teams can examine incidents, decisions, and failures openly and turn what they learn into stronger systems and practices. What you can expect: - Serve as incident manager and technical escalation point for complex, high-severity events, bringing structure, sound judgement, and clear decision-making under pressure. - Design and build AI-assisted and automated systems that improve how quickly and consistently the team can triage, investigate, and contain incidents. - Establish appropriate safety controls, approval gates, auditability, and rollback mechanisms for automated and AI-assisted actions, ensuring high-impact decisions remain appropriately human-controlled. - Own the team's readiness programs, including tabletop exercises and incident gamedays, from scenario design and execution through debriefing and translating finishes into concrete (or measurable) improvements - Advance the team’s threat hunting and insider risk capabilities by identifying opportunities, defining priorities, and delivering roadmap work that improves investigative depth and coverage - Plan, sequence, and deliver multi-quarter initiatives that mature the team's capabilities, bringing project management discipline to work that doesn't fit neatly into a sprint. - Mentor and provide technical leadership to other engineers, strengthening engineering rigor and investigative judgement across the team. - Partner with Security Operations, Product Security, and Engineering teams to close gaps surfaced through investigations, hunting, and simulations. - Foster psychological safety and blameless learning across incident retrospectives, gamedays, and tabletop debriefs. - Extend strong incident response practices beyond the immediate team by building reusable systems, tooling, and operating patterns that strengthen response capabilities across areas such as PSIRT, Privacy, and Engineering. USA-based roles only: The annual base salary for this role is between $192,000 USD and $278,000 USD, plus immediate participation in 1Password's benefits program (health, dental, 401k and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs. Canada-based roles only: The annual base salary for this role is between $167,000 CAD and $242,000 CAD, plus immediate participation in 1Password’s generous benefits program (health, dental, RRSP and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs. At 1Password, we approach each individual's compensation with a promise of fair market value and internal equity commensurate with experience and specific skill set. This posting is for an existing vacancy. Our culture At 1Password, we prioritize collaboration, clear and transparent communication, receptiveness to feedback, and alignment with our core values: keep it simple, lead with honesty, and put people first. You’ll be part of a team that challenges the status quo, and is excited to experiment and iterate in search of the best solution. That said, 1Password is not for everyone https://blog.1password.com/inside-the-culture-powering-1passwords-next-chapter/. Our work is demanding, we strive for excellence, and the pace is fast. We need people who are keen to take on challenging problems, who seek feedback to grow, and who are driven to make an impact. If you're looking for a place where you can settle into a comfortable routine, this might not be the right fit for you. We’re looking for individuals who are proven experts in their fields, as well as those who are highly adaptable, can thrive in ambiguity and through change, are curious, and above all deliver results. How we work with AI We are committed to leveraging cutting-edge technology—including AI—to achieve our mission. We also understand that thinking critically about AI in its current forms will help us create better solutions for our customers and ourselves with its future forms, which will help us continue to close the gap between security and privacy and achieve our mission. We want team members at all levels to take the approach of actively learning AI best practices, identifying opportunities to apply AI in meaningful ways, and driving innovative solutions in their daily work. Embracing the future of AI isn't just encouraged—it's an essential part of how we will be successful at 1Password. This approach extends to our hiring process—candidates are welcome to use AI tools responsibly and thoughtfully during the application process. To us, this means we do ask that you join live interviews without using AI tools so we can get to know how you communicate, solve problems, and collaborate with others. Our approach to remote work We believe in the power of remote work, but recognize that in-person connection is important to help us achieve our mission. While we are a remote-first company, travel for in-person engagement is a part of almost all roles, and we require our employees to be ready and willing to take part. Frequency will depend on role and responsibilities, and may include, but is not limited to: annual department-wide offsites, team meetings, and customer/industry events. What we offer We believe in working hard, and rewarding that hard work through our benefits. While not an exhaustive list, here is a glance at what we currently offer: Health and wellbeing 👶 Maternity and parental leave top-up programs 🩺 Competitive health benefits 🏝 Generous PTO policy Growth and future 📈 RSU program for most employees 💸 Retirement matching program 🔑 Free 1Password account Community 🤝 Paid volunteer days 🏆 Peer-to-peer recognition through Bonusly 🌎 Remote-first work environment *Some roles in our GTM team are currently being hired for in-person hybrid work in Toronto and Austin. These roles will specify on the posting. You belong here. 1Password is proud to be an equal opportunity employer. We are committed to fostering an inclusive, diverse and equitable workplace that is built on trust, support and respect. We welcome all individuals and do not discriminate on the basis of gender identity and expression, race, ethnicity, disability, sexual orientation, colour, religion, creed, gender, national origin, age, marital status, pregnancy, sex, citizenship, education, languages spoken or veteran status. Be yourself, find your people and share the things you love. Accommodation is available upon request at any point during our recruitment process. If you require an accommodation, please speak to your talent acquisition partner or email us at nextbit@agilebits.com and we’ll work to meet your needs. Remote work is a part of our DNA. Given that our company was founded remotely in 2005, we can safely say we're experts at building remote culture. That said, remote work at 1Password does mean working from your home country. If you've got questions or concerns about this, your talent partner would be happy to address them with you. Successful applicants will be required to complete a background check that may consist of prior employment verification, reference checks, education confirmation, criminal background, publicly available social media, credit history, or other information, as permitted by local law. 1Password uses artificial intelligence (AI) and machine learning (ML) technologies, including natural language processing and predictive analytics, to assist in the initial screening of employment applications and improve our recruitment process. See here https://www.ashbyhq.com/downloadables/ashby-bias-audit-08-2024.pdf for the latest third party bias audit information. If you prefer not to have your application assessed using AI/ML features, you may opt out by completing this form https://jobs.ashbyhq.com/1password/automation-notice. For additional information see our Candidate Privacy Notice https://1password.com/files/candidate-privacy-notice.pdf.

Fastly is seeking a Threat Detection Analyst for the APAC region who is Japanese speaking. The role is part of the Fastly Customer Security Operations Center (CSOC) team, focusing on operational support of Fastly’s security products and services, particularly integrating and supporting agent software installed on customer systems. The position involves monitoring and analyzing customer activity with emphasis on security functions such as identifying account-takeover, Bot Attacks, and WAF administration, focusing on application layer security and web technologies. The role requires working Friday to Tuesday, 0000 - 0800 UTC (9am - 6pm AEST). Responsibilities include: — Ensuring security for customers and providing outstanding responses to security issues. — Providing deep application-security expertise on escalated cases from customers and automated systems. — Conducting continuous improvement and research to enhance customer security products and operations. — Contributing to processes and policies to scale the organization. — Creating and reviewing security service reports for customers. — Creating and managing security content for customer environments. Requirements: — Prior experience working in a SOC environment. — Experience with SaaS/Cloud or hybrid cloud deployments; Apache, NGINX, IIS or other web server platforms and associated application server technologies and frameworks. — Scripting skills in Python, Java, Go, Rust, PHP, Unix/Linux Shell, C#, or other common web languages. — Strong information security background with practical skills in application security. — Experience in IT or security technical support, operations, or research roles. — Unix/Linux or Windows system administration skills. — Ability to work with limited supervision and mentor others on security knowledge. — Fluent spoken and written English, adaptable to different audiences. — Experience troubleshooting software products. — Focus on delivering exceptional customer experiences. Work hours require availability during core business hours. The position is remote based with potential to become hybrid as Fastly expands in the region. Travel to the US and internationally may be required. Benefits include a comprehensive package starting from day one, with variations depending on country. Fastly emphasizes a positive work environment, diversity, inclusion, and support for employees' passions and causes. Applications must be submitted through Fastly's official careers site. Fastly is an equal opportunity employer committed to a safe and welcoming work environment free of discrimination and harassment. Reasonable accommodations are available for applicants with disabilities.

Location: Toronto; Calgary; Boston; Canada; Seattle; New York; Vancouver; California; Ottawa; Montreal Workplace: Remote WHO ARE WE? Cohere is the leading security-first enterprise AI company. We build cutting-edge foundation AI models and end-to-end products that are designed to solve real-world business problems. We’re training and deploying frontier models for enterprises who are building AI systems. We believe that our work is instrumental to the widespread adoption of AI and we are looking for folks that want to be part of that. We obsess over what we build. Each one of us is responsible for contributing to increasing the capabilities of our models and the value they drive for our customers. Cohere is a team of researchers, engineers, designers, and more, who are all passionate about their craft. We are a global technology company headquartered in Toronto with key offices in London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul. Join us! WHY THIS ROLE Enterprises hand Cohere their most sensitive data and put our models inside workflows they can't afford to get wrong. Securing that means working on problems the industry hasn't settled yet, what authorization means when an agent acts on a user's behalf, how to contain tools that consume untrusted input, and whether tenant boundaries hold when a model can be steered by the data it reads. The established playbooks only take you so far. We're hiring a Senior Product Security Engineer to work these problems alongside the engineers building the products, reviewing architecture and code, threat modeling before implementation, testing what ships, and turning what you learn into defaults other teams inherit. This is a hands-on engineering role, not an advisory one. WHAT YOU’LL DO - Lead security reviews. Review architecture, code, and security-sensitive changes. Identify both individual vulnerabilities and the recurring design patterns behind them. - Secure AI-powered products. Evaluate risks such as prompt injection, unsafe tool use, identity and delegation failures, excessive agency, data exposure, tenant isolation, and sandbox escapes. - Threat model new capabilities. Identify trust boundaries, abuse cases, and high-impact failure modes before implementation. Translate findings into practical, prioritized mitigations. - Perform hands-on testing. Investigate suspected vulnerabilities, develop proofs of concept, assess exploitability and impact, and partner with engineers through remediation. - Build scalable guardrails. Develop secure defaults, approved patterns, reusable controls, review requirements, and automated checks that reduce recurring risks. - Strengthen engineering capability. Pair with engineers, document practical guidance, and help product teams develop durable security expertise. - Influence risk decisions. Explain technical findings, business impact, and remediation options clearly to engineers, product leaders, and executives. YOU MAY BE A GOOD FIT IF - You have strong software engineering fundamentals and can independently understand, test, and contribute fixes to production codebases. - You are proficient in at least one of Python, Go, or TypeScript. - You have led security reviews or threat models for complex production systems and can point to meaningful design or risk improvements that resulted. - You understand common vulnerability classes and their underlying design failures, including injection, authorization flaws, IDOR, SSRF, unsafe deserialization, race conditions, cryptographic misuse, and software supply-chain risks. - You understand modern application architecture, including web applications, APIs, OAuth/OIDC, cloud platforms, containers, Kubernetes, and CI/CD systems. - You can reason rigorously about untrusted input, authorization, isolation, identity, delegation, and data boundaries. Direct experience with agentic AI systems is valuable but not required. - You have driven security improvements involving multiple engineering teams, including situations where influence mattered more than authority. - You communicate clearly with both technical and non-technical audiences. NICE TO HAVE - Experience building or operating security tooling such as SAST, DAST, SCA, custom linters, or policy-as-code. - Experience securing multi-tenant SaaS, enterprise software, or systems that process sensitive customer data. - Offensive security experience through penetration testing, red teaming or security research. - Experience operating or participating in a vulnerability disclosure or bug bounty program. - Contributions to open-source security projects, published research, conference talks, or credited vulnerability discoveries. FULL-TIME EMPLOYEES AT COHERE ENJOY THESE PERKS: - A weekly lunch stipend of $75/£75 or equivalent in your local currency for lunch. - Full health and dental benefits, including a separate budget for mental health. - RRSP matching, 401K, Pension Scheme. - 100% Parental Leave top-up for up to 6 months, for either parent. - Annual enrichment benefits: Arts & culture, fitness/wellness, quality time, and a workspace improvement credit. Education & learning stipend for conferences, courses, and coaching. - 6 weeks of paid vacation (30 working days!) - Budget for traveling to other offices if you are remote, plus an annual company offsite. HOW AND WHERE WE WORK: - Cohere is remote-friendly, but we also have offices in Toronto, London, New York City, San Francisco, Montreal, Paris, Berlin and Seoul with more opening soon. - For those in the office: a daily lunch program, plenty of snacks, and regular community and social events. - For those not near an office: a co-working benefit so you can work alongside others in your city. - Everyone receives a $500 home office stipend to set up your workspace properly. If any of the above doesn’t line up exactly with your experience, we still encourage you to apply. We strive to create an inclusive work environment for all; we welcome applicants from all backgrounds and are committed to providing equal opportunities. Should you require any accommodations during the recruitment process, please submit an Accommodations Request Form https://docs.google.com/forms/d/12a6IrLdF3kI2nonKSr4tiFuz18rLQbaeYV-JM9L4o9Q/edit, and we will work together to meet your needs. We may use AI-enabled tools to screen and assess applicants against the criteria for this position. This helps our recruiters identify potentially qualified candidates, but it doesn't limit the applications our recruiters may review or consider. Beware of Scams: Cohere will never ask for payment or third-party services (e.g., CV writing) as part of our hiring process. All legitimate roles are listed on the Cohere careers page and LinkedIn only, with all communications from Cohere employees coming from an @cohere.com or @cw.cohere email alias. If jobs are viewed on other sites then please verify these through our official careers https://cohere.com/careers page.

Задачи: — сопровождать студентов в учебном чате; — отвечать на вопросы по материалам курса; — помогать разобраться в сложных темах; — подсказывать по заданиям, инструментам и практическим кейсам; — проводить онлайн-вебинары и делиться своей экспертизой; — поддерживать понятную и конструктивную коммуникацию в чате; — регулярно проверять сообщения минимум 2 раза в день; — отвечать на вопросы в течение 24 часов. Требования: — практический опыт проведения тестирования на проникновение веб-приложений и API: умение самостоятельно проводить разведку, находить и подтверждать уязвимости, оценивать их влияние и формулировать рекомендации по устранению; — хорошее знание основных классов веб-уязвимостей из OWASP Top 10: понимание причин возникновения, умение находить на практике, отличать реальные уязвимости от ложноположительных результатов, подтверждать возможность эксплуатации и объяснять разработчикам, как исправить; — знание уязвимостей аутентификации и авторизации: выявление проблем с управлением сессиями, контролем доступа, IDOR, обходом авторизации и другими типовыми сценариями; — опыт тестирования API и понимание специфики поиска уязвимостей в API: работа с REST API, анализ запросов и ответов, проверка механизмов аутентификации и авторизации, поиск нарушений контроля доступа и других типовых проблем; — владение инструментами веб-пентеста и умение применять их для решения практических задач: использование Burp Suite и/или аналогичных инструментов (ZAP, Caido) для перехвата и анализа HTTP-трафика, автоматизации проверок и ручного тестирования; — умение грамотно документировать результаты тестирования: описание сути и сценария эксплуатации уязвимости, оценка рисков и влияния, приведение доказательств и дача понятных рекомендаций по устранению; — представление о безопасной разработке, контейнеризации и DevSecOps: понимание этапов SDLC и CI/CD, на которых можно выявлять и предотвращать уязвимости, и как результаты пентеста связаны с процессами разработки. Условия: — удалённое сотрудничество с взаимодействием со студентами в учебном чате и на онлайн-вебинарах; — возможность экспериментировать и реализовать свой потенциал без микроменеджмента; — плавное погружение в сотрудничество с поддержкой команды и знакомством с инструментами сопровождения; — пополнение портфолио сертификатами о социально полезной деятельности; — нетворкинг, поддержка и вдохновение от комьюнити экспертов из разных сфер; — возможность участвовать в конференциях, мероприятиях и подкастах Яндекс Практикума.

Ищем hands-on DevSecOps / Security специалиста для проекта в сфере regulated crypto / fintech. Основная задача — разбирать результаты IT/Security-аудитов и технически закрывать выявленные vulnerabilities, security gaps и audit findings. Что важно: • DevSecOps / Application / Infrastructure / ICT Security; • DORA — обязательно; • MiCA, ISO 27001 или аналогичные стандарты; • опыт security/compliance-аудитов; • понимание regulated crypto / fintech; • умение самостоятельно делать remediation. Будет плюсом: Fireblocks, crypto custody, MPC, crypto exchanges, custodians, fintech/payment. Не рассматриваем чистых Compliance Officers, специалистов только по документации и Backend Developers без Security/DevSecOps опыта.

Samsara is the pioneer of the Connected Operations™ Cloud, a platform that enables organizations that depend on physical operations to harness IoT data to improve safety, efficiency, and sustainability. Key requirements: — proficiency in Go, Python, and JavaScript — bonus: experience with C/C++ (firmware/embedded systems)

Требования: — владение Go, Python и JavaScript — опыт с C/C++ (прошивка/встроенные системы) будет плюсом

Требования: — владение Go, Python и JavaScript — опыт с C/C++ (прошивка/встроенные системы) будет плюсом

Samsara is the pioneer of the Connected Operations™ Cloud, a platform that enables organizations that depend on physical operations to harness IoT data to improve safety, efficiency, and sustainability. Key requirements: — proficiency in Go, Python, and JavaScript — bonus: experience with C/C++ (firmware/embedded systems)

Требуется специалист на вакансию Менеджер по развитию бизнеса в информационной безопасности. Требуемые навыки: — Информационная безопасность — It консультирование — Ведение переговоров — Презентации — Развитие бизнеса — Продажи — B2B — Корпоративные коммуникации — Привлечение клиентов Формат работы: полный рабочий день, возможно удалённо.