Кибербезопасность вакансии

🔹 искать уязвимости в ИТ-системах клиентов; 🔹 проводить penetration testing в команде;

В роли инженера по безопасности приложений в AIFC предстоит заниматься обеспечением защиты программных продуктов, выявлением и устранением уязвимостей, а также внедрением современных методов безопасности. Кандидат должен обладать глубокими знаниями в области информационной безопасности, владеть инструментами анализа кода и тестирования на проникновение, а также иметь опыт работы с технологиями, применяемыми в разработке и эксплуатации приложений. Важны навыки работы с системами контроля версий, понимание принципов безопасного программирования и способность сотрудничать с командами разработчиков для повышения уровня безопасности продуктов.

Location: United States; Canada Workplace: Remote ABOUT DOCKER Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout. We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default. _______________________________________________________________________ As a Senior Security Engineer, Offensive Security, you'll help drive offensive security at Docker, putting our products, platforms, and cloud infrastructure under realistic adversarial testing to surface and drive out attack paths before real adversaries find them. You'll partner with engineering, product, and leadership to turn findings into durable fixes and to shape how security is designed into every Docker product. You'll apply your expertise in penetration testing, threat modeling, and exploit development to find and eliminate risks across Docker products and infrastructure. Working across cloud infrastructure (AWS, GCP, Azure), containerized environments, and AI/ML products, you'll implement proactive security solutions that scale with Docker's growth. This role offers the opportunity to help improve security programs at a company whose products are trusted by millions of developers worldwide. You'll work in a fast-paced, technically challenging environment where your security expertise directly impacts both Docker's platform and the broader container ecosystem. RESPONSIBILITIES: - Contribute to security initiatives that align with business goals, helping ensure security is a core component of our products and infrastructure - Support and help implement key security programs such as automated security design reviews, and vulnerability management - Build deep knowledge of software security and architecture, and act as a go-to resource for engineering teams - Partner with engineering to design and implement security architecture and controls across Docker products and platforms - Plan, scope, and execute penetration tests and red-team / adversary-emulation engagements against Docker's products and services - Develop proof-of-concept exploits and produce clear, risk-rated findings with actionable remediation guidance, then retest fixes to confirm closure - Build and maintain offensive security tooling and automation to expand testing coverage and repeatability - Perform security reviews and threat modeling (design, architecture, and code) across Docker products and services, including emerging AI products, and write automated security tests and exploits - Serve on rotating on-call schedule to respond to security events, investigate threats, and coordinate remediation efforts - Educate and collaborate with cross-functional teams (e.g., engineering, product) to promote security practices - Participate in Security Incident response QUALIFICATIONS - Have 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure - Possess 2+ years of hands-on development experience in Python or Golang - Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles. - Have strong hands-on experience with securing cloud ecosystems (e.g. AWS, GCP, Azure) - Have hands-on penetration testing experience across SaaS web applications and APIs., including manual exploitation beyond automated scanners - Are proficient with offensive tooling and techniques such as. Burp Suite, and OWASP frameworks - Can write security tests and develop exploits and proof-of-concepts that find real vulnerabilities in a product - Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks - Have practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows - Have a track record of building security programs and automations from scratch, applying risk-based prioritization - Have experience performing security reviews and building or improving security review automation - Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders - Understand industry standards, and actively keep up with emerging security technologies and models - Are a team player who drives security change via collaboration and cross-functional partnerships - Hold offensive security certifications such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO - Have published CVEs, original security research, or conference talks Bonus if you: - Have experience with container escape, Kubernetes attack paths, or cloud red teaming - Have experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning WHAT TO EXPECT FIRST 30 DAYS: - Meet with security team and key partners across engineering - Gain access to team owned systems, and internal documentation - Complete security awareness training and compliance onboarding - Review application architecture, tech stack and data flow - Review risk registry and annual roadmap - Familiarize oneself with team workflows and processes - Shadow a fellow security engineer during their on-call/secops rotations FIRST 90 DAYS: - Conduct security review on emerging Docker products - Scope and execute your first penetration test against a Docker product or service - Actively participate in architecture design reviews with the team - Contribute to a Security-owned project or initiative - Collaborate with Docker developers to validate and resolve discovered vulnerabilities - Enhance incident response capabilities by participating in on-call rotation and post-incident activities - Create and maintain security documentation and runbooks FIRST YEAR OUTLOOK - Contribute to the security roadmap for improving security controls - Strengthen Zero Trust architecture and least privilege access controls - Enhance security monitoring and anomaly detection - Perform security reviews for major product releases - Own and run recurring penetration tests and adversary-emulation exercises across Docker products, and engage with external researchers - Support audits and ensure compliance with SOC 2, ISO 27xxx - Advocate for “security by design” in all product features - Become well versed in Docker products and emerging AI technologies Docker does not offer visa sponsorship for this role.   Compensation & Equity Canada: CA$271,150 – CA$434,000 + equity United States: $194,150 – $312,950 + equity ______________________________________________________________________ POSTING INFORMATION - Open vacancy: This posting is for an existing open role. - AI in hiring: Docker may use AI-assisted tools during our recruiting process. - Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent. ______________________________________________________________________ PERKS & BENEFITS - Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration. - Flexibility that fits your life – We trust you to manage your schedule while delivering great work. - Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break. - Home office support – Set up your workspace for comfort and success. - Technology stipend – Equivalent to US$100 net per month to help support your work. - Learning & development – Annual stipend for conferences, courses, certifications, and continued learning. - Parental leave – 16 weeks of paid parental leave after six months of employment. - Equity for all full-time employees – Share in Docker's long-term success as we continue to grow. - Comprehensive benefits – Medical, retirement, and paid holidays vary by country. - Docker swag – Because representing the whale never gets old. Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community. #LI-REMOTE

Что предстоит делать: 🔹 проводить penetration testing:

• Анализ защищенности внутренних и внешних сервисов компании с использованием методики OWASP WSTG (black/gray/white box тестирования); • Подготовка рекомендаций (написание отчетов) по повышению уровня защищенности по результатам проведенных работ;

Location: New York, United States Who We Are At OKX, we believe the future will be reshaped by crypto and blockchain technology. We operate a leading global crypto platform and build products and services designed to expand access to the digital-asset ecosystem. Across our global organization, we value ownership, sound judgment, collaboration, innovation, and the ability to operate effectively in a fast-moving and continuously evolving environment. Recruiting should insert the current approved OKX corporate “Who We Are” language when the position is posted. About the Team The Fraud Investigations Team (FIT) is a First Line of Defense function within OKX’s Risk organization responsible for identifying, assessing, investigating, and helping manage significant internal and external fraud risks affecting the company, its customers, personnel, and operations. FIT conducts and supports complex investigations involving digital assets, internal and external fraud, employee misconduct, insider threats, unauthorized access or misuse of information, vendor and third-party misconduct, account compromise, social engineering, collusion, conflicts of interest, and other significant fraud-related matters. The team works closely with Legal, HR, Information Security,Engineering, Physical Security, Compliance, Finance, Operations, and other functions across OKX. About the Opportunity We are looking for an experienced Senior Analyst, Blockchain Investigations & Fraud Intelligence to join FIT. This is first and foremost a blockchain investigations role requiring significant hands-on expertise tracing digital assets across complex blockchain ecosystems. The successful candidate must be capable of independently conducting sophisticated on-chain investigations, developing and testing attribution hypotheses, identifying relationships among wallets and entities, following assets through multiple chains and protocols, and translating highly technical blockchain activity into clear investigative findings. Blockchain analysis is a specialized investigative discipline. Accordingly, we are seeking someone who understands not only how to operate commercial tracing platforms, but also the underlying blockchain architecture, transactional mechanics, attribution methodologies, clustering techniques, tracing limitations, and evidentiary considerations necessary to reach reliable conclusions. The role extends beyond on-chain analysis. The Senior Analyst will combine blockchain intelligence with enterprise data, system logs, transactional records, open-source information, and other evidence to support complex fraud and insider-risk investigations. The position will also provide analytical support to the Global Physical Security Team (PST) on selected protective-intelligence and threat-assessment matters. The Senior Analyst will directly manage one Analyst and will be expected to serve as a subject-matter resource for blockchain investigations and analytical methodology across FIT. What You’ll Be Doing Blockchain Investigations & Digital-Asset Intelligence Lead and conduct complex blockchain investigations and transaction tracing across multiple wallets, counterparties, entities, blockchains, tokens, protocols, and digital-asset ecosystems. Trace the origin, movement, conversion, layering, consolidation, and ultimate disposition of digital assets , including activity spanning multiple intermediaries and blockchain environments. Conduct investigations using tools such as Chainalysis Reactor , TRM Labs, Elliptic, or comparable blockchain intelligence platforms , while understanding the methodologies and limitations underlying platform-generated attribution. Analyze activity involving centralized exchanges, self-hosted wallets, decentralized exchanges, cross-chain bridges, mixers, privacy-enhancing technologies, DeFi protocols, smart contracts, stablecoins, NFTs, OTC activity, gambling platforms, and other relevant ecosystems . Trace assets across multiple chains and cross-chain transactions , identifying continuity of funds where technically supportable and clearly documenting assumptions or limitations where definitive attribution is not possible. Analyze transaction graphs, address relationships, behavioral patterns, clusters, counterparties, timing, amounts, transaction sequencing, and other relevant blockchain indicators. Understand and appropriately apply wallet-clustering and attribution methodologies , including the limitations and potential for false attribution associated with particular heuristics. Independently evaluate blockchain intelligence rather than relying solely on automated labels, risk scores, or vendor-generated attribution. Corroborate on-chain findings, where appropriate, with internal account records, KYC / KYB information, transaction data, access information, open-source intelligence, legal-process returns, or other available evidence . Identify relationships among blockchain addresses, OKX accounts, external counterparties, individuals, organizations, vendors, affiliates, and other relevant entities. Reconstruct complex transaction flows and create clear fund-flow diagrams, transaction maps, timelines, and visualizations that allow investigators and nontechnical stakeholders to understand the movement of assets. Analyze blockchain activity associated with suspected fraud , theft, account takeover, social engineering, insider activity, collusion, payment diversion, asset misappropriation, or other misconduct . Identify new wallets, counterparties, entities, or transactional patterns that may generate additional investigative leads. Clearly document the methodology, assumptions, confidence level, and limitations associated with blockchain findings. Distinguish between confirmed attribution , vendor attribution, analytical inference, behavioral similarity, and an unverified investigative hypothesis . Avoid presenting blockchain proximity, exposure, clustering, or a commercial risk score alone as proof of ownership, control, intent, or misconduct. Maintain current knowledge of emerging blockchain technologies, protocols, tracing methodologies, obfuscation techniques, fraud typologies, and developments affecting blockchain attribution or investigations . Fraud Investigations & Investigative Intelligence Conduct and support investigations involving internal and external fraud , employee misconduct, insider threats, vendor and third-party misconduct, collusion, conflicts of interest, asset misappropriation, unauthorized access, credential misuse, and other significant fraud risks . Combine blockchain findings with off-chain evidence to develop a comprehensive investigative picture rather than treating blockchain activity in isolation . Develop investigative hypotheses and objectively test those hypotheses against available evidence, including information that supports, contradicts, or fails to establish the hypothesis. Conduct timeline reconstruction, link analysis, relationship mapping, pattern analysis, clustering, and comparative analysis across individuals, accounts, wallets, devices, systems, transactions, and entities. Support investigations involving account takeover, impersonation, social engineering, business-email compromise, payment diversion, affiliate misconduct, and trusted-party abuse , particularly where a digital-asset, employee, vendor, or enterprise nexus exists. Analyze vendor, affiliate, partner, and other third-party activity for indicators of billing irregularities, undisclosed relationships, conflicts of interest, unusual payments, control circumvention, or other potential misconduct. Support investigative interviews by developing transaction timelines, identifying inconsistencies or information gaps, organizing evidence, and identifying appropriate areas for follow-up. Enterprise Data & Insider-Risk Analytics Analyze appropriately authorized information including system and access logs, authentication records, audit trails, customer-account activity, KYC / KYB information, transaction records, payment information, case-management records, vendor information, and relevant security telemetry . Correlate blockchain activity with enterprise data to identify possible connections among wallets, accounts, employees, customers, vendors, devices, transactions, and other relevant entities . Support investigations involving suspected unauthorized access, information misuse or exfiltration, credential compromise, control circumvention, unauthorized disclosure, or abuse of privileged access. Identify anomalous behavior or access patterns that may warrant additional investigation. Develop repeatable analytical methodologies capable of processing and correlating information from disparate systems. Use appropriate scripting, database querying, data visualization, and analytical technologies to efficiently analyze large or complex datasets. Investigative Reporting & Evidence Prepare clear, concise, and well-supported blockchain investigation reports, investigative memoranda, executive summaries, transaction-flow diagrams, link charts, timelines, and other analytical products . Explain complex blockchain concepts and transaction activity in plain language suitable for investigators, senior management, Legal, regulators, or law enforcement , as appropriate. Clearly distinguish among allegations, investigative leads, known facts, third-party attribution , analytical judgments, assumptions, information gaps, and substantiated conclusions . Ensure analytical conclusions are proportionate to the evidence and do not imply greater certainty than the underlying blockchain or other data supports. Maintain sufficient documentation to allow significant blockchain findings to be reviewed, reproduced, and understood by another qualified analyst . Preserve and handle investigative records in accordance with applicable evidence-preservation, chain-of-custody, confidentiality, privacy, access-control, and need-to-know requirements . Support appropriately authorized law-enforcement, regulatory, litigation, or legal matters in coordination with the appropriate company functions. Protective Intelligence & Physical Security Support Provide analytical support to PST on selected matters involving threats or concerning activity directed toward employees, executives, offices, events, or other company interests. Conduct authorized open-source, link, timeline, blockchain, financial, or other analytical research where relevant to understanding the identity, relationships, capabilities, or activity associated with a potential threat. Assist in evaluating available information relating to credibility, corroboration, intent, capability, access or opportunity, targeting, escalation, timing, and other relevant indicators . Prepare objective analytical products identifying known facts, analytical judgments, material information gaps, uncertainties, and appropriate confidence levels. Support PST’s assessment while preserving PST’s responsibility for protective-security decisions and operational response . Leadership & Development Directly manage and develop one Junior Analyst, including work allocation, coaching, technical development, quality assurance, and review of analytical work product . Serve as a FIT subject-matter resource for blockchain investigations and on-chain analytical methodology . Review blockchain analysis for technical accuracy, appropriate methodology, corroboration, reasonable attribution, and evidentiary support. Train and mentor junior personnel in transaction tracing, blockchain intelligence platforms, analytical reasoning, documentation, and investigative methodology. Help establish consistent standards for blockchain investigations, attribution , documentation, quality assurance, and reporting . Participate in time-sensitive investigations affecting a global organization, including occasional work outside normal business hours when required. What We Look For In You 7+ years of relevant investigative or analytical experience , with meaningful professional experience specifically conducting cryptocurrency or blockchain investigations . Demonstrated hands-on expertise independently conducting complex blockchain tracing investigations , rather than solely reviewing blockchain alerts or commercial risk scores. Advanced proficiency with one or more blockchain intelligence platforms such as Chainalysis Reactor , TRM Labs, Elliptic, or comparable technology . Strong understanding of how blockchain intelligence platforms derive attribution, clustering, exposure, and risk information—and the limitations associated with those methodologies . Demonstrated understanding of blockchain fundamentals, including wallets and addresses, transactions, UTXO and account-based models, tokens, smart contracts, block explorers, transaction fees, confirmations, and blockchain-specific transactional structures . Strong understanding of digital-asset ecosystems including centralized exchanges, self-hosted wallets, DeFi , DEXs, stablecoins, cross-chain bridges, mixers, privacy-enhancing mechanisms, and other relevant technologies . Demonstrated ability to trace assets across multiple chains, protocols, and intermediaries and recognize when technical limitations prevent definitive continuity or attribution. Experience conducting transaction-graph analysis, wallet attribution , clustering, counterparty analysis, transaction-flow reconstruction, and investigative link analysis . Ability to critically assess blockchain attribution and distinguish among technical facts, commercial vendor intelligence, analytical inference, and unsupported assumptions . Experience integrating blockchain intelligence with off-chain evidence and enterprise information to develop investigative conclusions. Strong knowledge of fraud-investigation principles including corroboration, source evaluation, evidence preservation, timeline development, hypothesis testing, and documentation. Experience analyzing large or complex datasets and familiarity with tools such as SQL , advanced Excel, Python, Splunk, or comparable data-analysis technologies . Ability to clearly explain technically complex blockchain findings to audiences that may have little or no blockchain expertise. Strong investigative writing skills and demonstrated ability to produce accurate, concise, and defensible analytical products. Sound judgment and ability to work effectively where evidence is incomplete, conflicting, or evolving. Demonstrated discretion when handling sensitive employee, customer, investigative, security, or company information. Demonstrated experience mentoring, supervising, or reviewing the work of junior analysts or investigators. Nice to Haves Experience conducting blockchain investigations within a cryptocurrency exchange, blockchain analytics company, law-enforcement agency, regulatory organization, financial institution, intelligence function, or investigative consulting environment . Experience investigating digital-asset matters involving fraud proceeds, theft, account compromise, insider activity, social engineering, asset tracing, or complex cross-chain movement . Experience supporting asset recovery, law-enforcement referrals, subpoenas/legal process, civil litigation, regulatory inquiries, or other matters requiring defensible blockchain analysis . Experience investigating insider threats, employee misconduct, unauthorized access, data exfiltration, credential compromise, vendor fraud, conflicts of interest, or trusted-party abuse. Experience with OSINT, digital forensics, enterprise logs, security telemetry, or identity and access-management information . Experience creating custom blockchain analytics through APIs, SQL , Python, blockchain explorers, node data, or other raw-data sources , rather than relying exclusively on commercial graphical interfaces. Relevant blockchain-specific training or certifications, including certifications associated with Chainalysis , TRM Labs, or comparable blockchain-analysis platforms . Professional certifications such as CFE, CFCS, CAMS, GIAC, or comparable investigative, fraud , financial-crime, cybersecurity, or intelligence credentials . What Success Looks Like Success in this role requires significantly more than knowing how to enter an address into a blockchain analytics platform. The successful candidate should be able to receive a complex transaction, wallet, allegation, or investigative question and independently determine how to trace the activity, which chains and protocols are involved, what the available data establishes, what additional information is needed, what attribution can reasonably be made, and where the technical or evidentiary limitations prevent a definitive conclusion . The individual should be able to move seamlessly between on-chain and off-chain evidence , recognizing that a blockchain transaction may establish movement of assets without necessarily establishing the identity, knowledge, intent, or conduct of the person behind a wallet. They should also be capable of converting a highly technical blockchain investigation into a concise and defensible explanation that an investigator, attorney, executive, regulator, or law-enforcement partner can understand and act upon. At the same time, this person must be sufficiently versatile to apply the same investigative discipline to internal fraud , insider risk, enterprise data, third-party misconduct, and protective-intelligence matters when required. The hierarchy is much clearer this way: blockchain investigations are the specialized core competency; fraud /investigative intelligence is the broader mission; enterprise analytics and PST support are complementary capabilities. That should materially improve the candidate pool versus a title that makes blockchain expertise appear interchangeable with general data analytics. OKX Statement: OKX is committed to equal employment opportunities regardless of race, color, genetic information, creed, religion, sex, sexual orientation, gender identity, lawful alien status, national origin, age, marital status, and non-job related physical or mental disability, or protected veteran status. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records. The salary range for this position is $143,000 - $214,000 The salary offered depends on a variety of factors, including job-related knowledge, skills, experience, and market location. In addition to the salary, a performance bonus and long-term incentives may be provided as part of the compensation package, as well as a full range of medical, financial, and/or other benefits, dependent on the position offered. Applicants should apply via OKX internal or external careers site. Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus Workplace: hybrid Capital.com's Product Security team protects our web and mobile applications, infrastructure, and external perimeter in a highly regulated environment. As Senior/Staff Application Security Engineer, you will raise the bar for application security across the organisation. This role is measured by leverage: how well you design, automate, and scale security processes so that many engineering teams can build securely by default. You will lead security architecture reviews and threat modelling, increasingly with the help of AI tooling, and turn one-off security work into repeatable, self-service capabilities. The role combines deep hands-on offensive and defensive security expertise with the engineering mindset needed to automate at scale. You will work closely with development, QA, DevOps, and platform teams. Responsibilities: Security Architecture & Threat Modelling: Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure Security Automation & Tooling: Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely Security Testing & Vulnerability Management: Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible Participate in and help lead red teaming and offensive security exercises Enablement: Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams Requirements: Experience: 5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort Technical: Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so Collaboration: Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture Nice to have: Experience securing the AI harness: hardening LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints against prompt injection, data leakage, and insecure agent actions Experience securing Kubernetes, including cluster hardening, RBAC, network policies, admission control, workload isolation, and image and supply-chain security Experience securing AWS infrastructure, including IAM, network and account architecture, key and secret management, and CSPM Experience building AI-assisted security tooling or internal self-service security platforms Experience mentoring or technically leading a security team Offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE What you'll get in return: You will join the company, that cares about work and life balance Annual Bonus based on the performance review cycle Generous Annual Leave Policy Medical Insurance and Pension fund, with additional benefit packages based on the location Hybrid working model (3 days from our modern office and 2 days fully remotely) Comprehensive Workation Policy with 30 more remote days available. Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.

Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus Workplace: hybrid Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and the backend services behind them, all in a highly regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products. You will set the direction for how we secure software at scale: you will own secure-by-design patterns and standards, lead threat modelling and architecture reviews, and define the application security baseline that engineering teams build against. Working closely with the Product Security team and the Director of Product Security, you will guide AppSec processes and set the vision for your area without direct line management. You will treat security as a shared outcome rather than a gate, balancing strong protection with developer experience and delivery speed, and you will earn adoption through enablement rather than mandates. Responsibilities: Security Architecture & Standards: Define and maintain secure-by-default reference architectures for common patterns: web apps, mobile backends, microservices, public and partner APIs, and event-driven services Own core application security architecture decisions: authentication and authorisation, session management, API security, secrets management, multi-tenant isolation, and security logging and auditing Lead the redesign of user authentication and the delivery of security features into the product Develop and roll out application security standards, secure-coding guidelines, configuration standards, reusable design patterns, and architecture decision records (ADRs) that engineers can apply without a security expert in the room Define internal policies for the safe use of AI-assisted and vibe-coding tools Define security requirements for acquired technology and guide its secure integration Threat Modelling & Design Review: Establish and run a threat-modelling operating model, covering scope, cadence, templates, and facilitation, proportionate to each product's risk tier Own the security review stage of the new product approval process, covering architecture design and configuration Lead design reviews for high-impact initiatives: new products, new auth flows, payment and sensitive-data flows, platform migrations, and major refactors Identify design-level risks and agree practical, prioritised mitigations with engineering teams Secure SDLC, DevSecOps & Supply Chain: Assess the current state of application security, propose improvements, and drive the secure SDLC strategy with Engineering and Security leadership Oversee AppSec processes and own the tooling strategy (SAST, DAST, IAST, SCA, and secrets scanning), including how findings flow back to engineering Embed security controls as guardrails in CI/CD through policy-as-code, with agreed enforcement and escalation paths Partner with DevOps to organise repository management and prevent supply-chain attacks, covering safe component usage, dependency management, SBOMs, and build integrity Improve the security of our internal tools Requirements: Experience: 8+ years in technology, including 5+ years in a dedicated application or product security role, with a strong engineering background and hands-on architecture or design ownership Proven track record creating, documenting, and rolling out security standards, patterns, and best practices across a complex engineering organisation Deep, demonstrable threat-modelling experience across product portfolios Technical: Experience designing and implementing a secure SDLC in a cloud-native environment. Strong AWS knowledge is required, and exposure to GCP or other clouds is welcome Strong command of OWASP standards (Top 10, ASVS) and DevSecOps practice, including AppSec tooling (SAST, DAST, IAST, SCA, secrets scanning) and vulnerability management Deep understanding of modern distributed architectures: microservices, REST and GraphQL APIs, event-driven systems, OAuth2/OIDC, and containerised workloads (Docker, Kubernetes). You should be able to reason about their trust boundaries, attack surface, and data flows across web and mobile clients Collaboration: Exceptional ability to influence and align engineering teams without direct authority, and to brief both engineers and executives Pragmatism and strategic thinking: you balance the ideal with the achievable, protect delivery throughput, and turn long-term direction into an actionable plan Clear written communication through diagrams, ADRs, and patterns, plus a track record of mentoring and cross-functional collaboration Nice to have: Experience in fintech, trading, brokerage, or another regulated environment Awareness of relevant regulatory and compliance drivers: FCA and CySEC operational resilience, GDPR, and PCI DSS Software supply-chain security, including SBOMs and artifact and build integrity Experience securing AI-integrated product features, or using AI to scale an AppSec programme Experience building or running a Security Champions programme CSSLP, GIAC GDSA, or a hands-on offensive security certification. Certifications are valued but secondary to demonstrated experience What you'll get in return: You will join the company, that cares about work and life balance Annual Bonus based on the performance review cycle Generous Annual Leave Policy Medical Insurance and Pension fund, with additional benefit packages based on the location Hybrid working model (3 days from our modern office and 2 days fully remotely) Comprehensive Workation Policy with 30 more remote days available. Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.

поиск уязвимостей в коде; безопасностью SDLC;

Location: San Francisco, California; New York, New York Workplace: Hybrid WHO WE ARE Notion is the collaborative AI workspace where teams and agents think together https://www.youtube.com/watch?v=vkpYpWfEK5s. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work. ABOUT THE ROLE Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build. We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion. You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next. We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters WHAT YOU'LL ACHIEVE - Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments, with review and mentorship from senior teammates as you ramp up. - Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety. - Build tooling and automation that speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful. - Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements. - Take part in investigations, incident response, and postmortems, and help turn what we learn into lasting fixes. - Help define and track metrics such as coverage, MTTD, and alert quality. - Join a shared on-call rotation for incident response. SKILLS YOU'LL NEED TO BRING - We're hiring across a range of experience levels. If you have some of these skills but not all, we'd still like to hear from you. - 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role. - Have written or tuned detections that run in production, and care about signal quality and cutting noise. - Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly. - An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect. - Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs. - Have used SIEM, EDR, or SOAR tools in any size of environment. - Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end. NICE TO HAVE - Have led purple team, blue team, or adversary emulation exercises that improved detections or telemetry. - Experience running SIEM, EDR, or SOAR platforms at large scale. - Experience building or maintaining detection-as-code workflows (version control, CI, and tests for detections). - Experience applying LLMs or agent-style tooling to security workflows. - Experience securing AI-enabled systems or endpoint tooling. - Kubernetes or container detection experience. - Background in threat intelligence, malware analysis, or digital forensics. - Contributions to the security community through research, tooling, CTFs, or talks. - Experience at a high-growth startup or AI company. Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role’s scope and complexity, and the candidate’s experience and expertise, and may vary from the range provided below. For roles based in San Francisco or New York City, the estimated base salary range for this role is $185,000 - $280,000 per year.   By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy https://notion.notion.site/Notion-Global-Recruiting-Privacy-Policy-fc3eb4e829354a26a2bb6fd5e289b550 and and NYLL 144 https://notion.notion.site/Ashby-AI-Bias-Audit-2b0efdeead05803bbbfae159ec86c528.   #LI-Onsite A NOTE ON AI You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on. EQUAL OPPORTUNITY & ACCOMMODATIONS We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know. Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.

Location: Dublin, Ireland Workplace: Hybrid WHO WE ARE Notion is the collaborative AI workspace where teams and agents think together https://www.youtube.com/watch?v=vkpYpWfEK5s. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work. ABOUT THE ROLE Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build. We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion. You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next. We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters WHAT YOU'LL ACHIEVE - Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments, with review and mentorship from senior teammates as you ramp up. - Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety. - Build tooling and automation that speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful. - Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements. - Take part in investigations, incident response, and postmortems, and help turn what we learn into lasting fixes. - Help define and track metrics such as coverage, MTTD, and alert quality. - Join a shared on-call rotation for incident response. SKILLS YOU'LL NEED TO BRING - We're hiring across a range of experience levels. If you have some of these skills but not all, we'd still like to hear from you. - 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role. - Have written or tuned detections that run in production, and care about signal quality and cutting noise. - Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly. - An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect. - Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs. - Have used SIEM, EDR, or SOAR tools in any size of environment. - Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end. NICE TO HAVE - Have led purple team, blue team, or adversary emulation exercises that improved detections or telemetry. - Experience running SIEM, EDR, or SOAR platforms at large scale. - Experience building or maintaining detection-as-code workflows (version control, CI, and tests for detections). - Experience applying LLMs or agent-style tooling to security workflows. - Experience securing AI-enabled systems or endpoint tooling. - Kubernetes or container detection experience. - Background in threat intelligence, malware analysis, or digital forensics. - Contributions to the security community through research, tooling, CTFs, or talks. - Experience at a high-growth startup or AI company. Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role's scope and complexity, and the candidate's experience and expertise, and may vary from the range provided below. The estimated base salary range for this role is €75,000–€142,000 per year. By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy https://notion.notion.site/Notion-Global-Recruiting-Privacy-Policy-fc3eb4e829354a26a2bb6fd5e289b550?pvs=74. #LI-Onsite A NOTE ON AI You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on. EQUAL OPPORTUNITY & ACCOMMODATIONS We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know. Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.

• Исследовать актуальные угрозы, тактики, техники и процедуры (TTP) APT, анализировать современные методы проведения кибератак; • Разрабатывать алгоритмы выявления угроз: создавать правила и сценарии детектирования;

обеспечивать управление полным циклом разработки правил корреляции; анализировать ложноположительные инциденты и добавлять исключения в SIEM;

-Break things on purpose. Threat-model and review Solidity contracts, blockchain state transition functions in Rust, and other critical systems before an attacker gets the chance.

Analyze and investigate alerts to identify, assess, and respond to potential threats. Collaborate with teammates and customer security teams to remediate incidents and strengthen defenses.

Location: Madrid, Spain Workplace: hybrid Are you ready to join our digital revolution journey?    At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.   Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.   With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career. We are looking for an experienced and operationally sharp Security Operations & Incident Response Analyst (L3) to join Aleph's global IT Security team. Reporting to the Global CISO, you will be the first line of defence when incidents occur and the engine behind the team's threat detection and response capabilities. You will own the end-to-end incident response process, lead threat hunting and intelligence activities, and manage the vulnerability and identity governance programmes — ensuring Aleph is both able to detect threats quickly and respond to them effectively across a complex, globally distributed environment. What you'll do: Incident Response Own and coordinate the end-to-end incident response process : identification, triage, containment, eradication, recovery, and post-incident review (lessons learned). Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources. Maintain and continuously improve incident response playbooks for the most relevant threat scenarios (ransomware, phishing, account compromise, data breach, insider threat, etc.). Manage the security incident log and register : track all incidents, document timelines and actions, and produce trend analysis and reporting for the CISO. Coordinate with external SOC or MDR providers where applicable: review daily reports, validate alert quality, and manage escalation workflows. Data Breach Management Lead data breach investigations : scope the breach, gather and preserve evidence, assess PII exposure, and coordinate response with Legal, Privacy, and HR. Produce breach investigation reports with findings, root cause, and recommendations. Threat Hunting & Intelligence Conduct proactive threat hunting across the environment: develop hypotheses based on threat intelligence, search for indicators of compromise (IoCs), and investigate anomalous behaviour. Manage the Threat Intelligence function : track relevant threat actors, TTPs (MITRE ATT&CK), and sector-specific threat campaigns; integrate intelligence into SIEM/XDR detection rules and hunting queries. Produce threat intelligence summaries and briefings for the CISO and relevant stakeholders. Vulnerability Management Own the vulnerability management programme : schedule and execute periodic vulnerability scans across infrastructure, endpoints, and cloud environments. Analyse scan results, prioritise findings by risk and exploitability, and coordinate remediation with IT Operations within agreed SLAs. Track remediation progress, produce vulnerability metrics, and report status to the CISO. Validate remediation effectiveness through re-scanning and spot-checks. Identity & Access Management (IAM) Manage periodic access reviews : coordinate with system owners and HR to review and certify user permissions across critical systems, ensuring least privilege is maintained. Oversee the Privileged Access Management (PAM) programme: define PAM policies, monitor privileged account usage, and review access rights for administrator-level accounts. Investigate and respond to identity-related anomalies and access policy violations. What we are looking for: 3–5 years in a SOC analyst, incident response, or security operations role, with at least 1–2 years at L3 level is a plus. Experience implementing or managing IAM and PAM solutions Experience working within international or multinational environments. Hands-on experience with incident response engagements (internal or consulting) is strongly valued. Relevant certifications: GCIH, GCFE, GCFA, CEH, CompTIA CySA+ , or equivalent. OSCP is a plus. Strong hands-on experience with SIEM platforms (alert triage, rule writing, query development) and EDR/XDR tools . Solid knowledge of the MITRE ATT&CK framework and its application to threat hunting and incident response. Experience conducting vulnerability scans using tools such as Tenable Nessus, Qualys, Rapid7, or similar. Familiarity with IAM and PAM concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM, or equivalent). Experience with digital forensics and incident response (DFIR) methodologies: evidence collection, log analysis, and timeline reconstruction. Knowledge of threat intelligence platforms and feeds (e.g. MISP, VirusTotal, threat intel feeds). Understanding of ISO 27001 incident management controls, NIS2 incident reporting obligations, and PCI DSS requirement 12.10 . Calm and decisive under pressure. Strong investigative mindset with structured problem-solving approach, excellent documentation skills. Ability to communicate incident status and findings clearly to both technical teams and executive stakeholders. Collaborative and proactive, comfortable working asynchronously across time zones. English : full professional proficiency (C1/C2) — primary working language. Spanish : professional proficiency is a plus. In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is EUR 48,000 EUR. In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.   #Aleph Why Join Us?   Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.     We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.    #ALEPH

Задачи: — проводить penetration testing продуктов и сервисов Samsung; — искать и оценивать уязвимости; — проводить code review; — взаимодействовать с разработчиками. Требования: — опыт web application pentest от 3 лет; — знание Burp Suite, OWASP ZAP; — знание OWASP Top 10; — знание Python. Будет плюсом: Kali Linux, AWS, Docker, SAST, CI/CD и DevSecOps, Linux internals, AI Security. Изюминка вакансии: это именно security-команда R&D, а не классический внутренний ИБ-отдел — основной фокус на тестировании большого количества веб-приложений и поиске уязвимостей.