SOC / SecOps аналитик вакансии

Location: Madrid, Spain Workplace: hybrid Are you ready to join our digital revolution journey?    At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.   Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.   With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career. We are looking for an experienced and operationally sharp Security Operations & Incident Response Analyst (L3) to join Aleph's global IT Security team. Reporting to the Global CISO, you will be the first line of defence when incidents occur and the engine behind the team's threat detection and response capabilities. You will own the end-to-end incident response process, lead threat hunting and intelligence activities, and manage the vulnerability and identity governance programmes — ensuring Aleph is both able to detect threats quickly and respond to them effectively across a complex, globally distributed environment. What you'll do: Incident Response Own and coordinate the end-to-end incident response process : identification, triage, containment, eradication, recovery, and post-incident review (lessons learned). Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources. Maintain and continuously improve incident response playbooks for the most relevant threat scenarios (ransomware, phishing, account compromise, data breach, insider threat, etc.). Manage the security incident log and register : track all incidents, document timelines and actions, and produce trend analysis and reporting for the CISO. Coordinate with external SOC or MDR providers where applicable: review daily reports, validate alert quality, and manage escalation workflows. Data Breach Management Lead data breach investigations : scope the breach, gather and preserve evidence, assess PII exposure, and coordinate response with Legal, Privacy, and HR. Produce breach investigation reports with findings, root cause, and recommendations. Threat Hunting & Intelligence Conduct proactive threat hunting across the environment: develop hypotheses based on threat intelligence, search for indicators of compromise (IoCs), and investigate anomalous behaviour. Manage the Threat Intelligence function : track relevant threat actors, TTPs (MITRE ATT&CK), and sector-specific threat campaigns; integrate intelligence into SIEM/XDR detection rules and hunting queries. Produce threat intelligence summaries and briefings for the CISO and relevant stakeholders. Vulnerability Management Own the vulnerability management programme : schedule and execute periodic vulnerability scans across infrastructure, endpoints, and cloud environments. Analyse scan results, prioritise findings by risk and exploitability, and coordinate remediation with IT Operations within agreed SLAs. Track remediation progress, produce vulnerability metrics, and report status to the CISO. Validate remediation effectiveness through re-scanning and spot-checks. Identity & Access Management (IAM) Manage periodic access reviews : coordinate with system owners and HR to review and certify user permissions across critical systems, ensuring least privilege is maintained. Oversee the Privileged Access Management (PAM) programme: define PAM policies, monitor privileged account usage, and review access rights for administrator-level accounts. Investigate and respond to identity-related anomalies and access policy violations. What we are looking for: 3–5 years in a SOC analyst, incident response, or security operations role, with at least 1–2 years at L3 level is a plus. Experience implementing or managing IAM and PAM solutions Experience working within international or multinational environments. Hands-on experience with incident response engagements (internal or consulting) is strongly valued. Relevant certifications: GCIH, GCFE, GCFA, CEH, CompTIA CySA+ , or equivalent. OSCP is a plus. Strong hands-on experience with SIEM platforms (alert triage, rule writing, query development) and EDR/XDR tools . Solid knowledge of the MITRE ATT&CK framework and its application to threat hunting and incident response. Experience conducting vulnerability scans using tools such as Tenable Nessus, Qualys, Rapid7, or similar. Familiarity with IAM and PAM concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM, or equivalent). Experience with digital forensics and incident response (DFIR) methodologies: evidence collection, log analysis, and timeline reconstruction. Knowledge of threat intelligence platforms and feeds (e.g. MISP, VirusTotal, threat intel feeds). Understanding of ISO 27001 incident management controls, NIS2 incident reporting obligations, and PCI DSS requirement 12.10 . Calm and decisive under pressure. Strong investigative mindset with structured problem-solving approach, excellent documentation skills. Ability to communicate incident status and findings clearly to both technical teams and executive stakeholders. Collaborative and proactive, comfortable working asynchronously across time zones. English : full professional proficiency (C1/C2) — primary working language. Spanish : professional proficiency is a plus. In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is EUR 48,000 EUR. In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.   #Aleph Why Join Us?   Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.     We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.    #ALEPH

Location: Remote Workplace: Remote We are building AI to simulate the world through merging art and science. We believe that world models are at the frontier of progress in artificial intelligence. Language models alone won’t solve the world’s hardest problems – robotics, disease, scientific discovery. Real progress requires models that experience the world and learn from their mistakes, the same way that humans do. And this kind of trial and error can be massively accelerated when done in simulation, rather than in the real world. World models offer the most clear path to general-purpose simulation, changing how stories are told, how scientific progress is made and how the next frontiers of humanity are reached. Our team consists of creative, open minded, caring and ambitious people who are determined to change the world. We aspire to continuously build impossible things and our ability to do so relies on building an incredible team. If you are driven to do the same, we'd love to hear from you. *Titles posted to our careers page are updated regularly to best advertise the role and expected seniority, but internally we have a flat titling system with two types of titles: one for individual contributors and one for people managers. ABOUT THE ROLE Open to hiring remote — we also have offices in New York, San Francisco, Seattle, London, Paris, and Tel Aviv. Runway is hiring a Detection & Response Engineer to own how we find and stop attacks against our infrastructure, our research environment and our products. Securing a company that trains and serves frontier video models is a different problem from securing a typical SaaS product. The environment includes research compute, large training datasets, a fast-moving build pipeline and engineers who work inside AI-assisted tooling every day. Each of those changes what an attack looks like and what you need to see to catch it. You'll join the Security team and build our detection and response program the way an engineer would: detections as code, response as automation, evidence as something you can query. This is a role with real ownership: you'll own the detection program end to end, from what we log to how quickly we close an incident. You'll report to the head of security, partner with engineers across platform and research, and shape how this function grows from here. WHAT YOU'LL DO - Own detection and response end to end: what we log, what we alert on, how we triage and how we recover - Write and tune detections as code across multiple cloud environments, Kubernetes, identity systems, endpoints and SaaS, and measure them on coverage and precision rather than alert volume - Lead incident response from the first alert through containment and forensics, then write the post-incident review people actually read - Build automation that takes toil out of triage, including enrichment, correlation, containment actions and evidence collection, and use LLM-based tooling where it holds up under audit - Monitor AI agents and developer tooling operating inside our environment, and turn that into concrete telemetry and controls - Partner with platform and research engineers so new systems ship with logging and response playbooks in place on day one - Run threat hunts and tabletop exercises against the parts of the environment that worry you most, and fix what you find - Turn incident and detection metrics into evidence for SOC 2, ISO 27001 and enterprise customer security reviews, working with our GRC team - Participate in an on-call rotation for security incidents WHAT YOU'LL NEED - Hands-on incident response experience: you've triaged live alerts, led investigations and written up what happened afterward - Experience building and tuning detections in a modern SIEM, ideally managed as code - Working knowledge of how attackers move through cloud and Kubernetes environments (IAM abuse, container escape, credential theft, supply chain compromise) and what that leaves behind in logs - Comfort writing Python, Typescript, Rust or another language to automate response work and connect security tools - Familiarity with at least one major cloud platform and with Kubernetes at the level of audit logs, RBAC and workload identity - Clear writing. Incident timelines, detection documentation and updates to leadership are all part of the job - Judgment about what to alert on, what to automate and when to wake someone up EVEN BETTER IF YOU HAVE - Experience monitoring GPU or HPC-style infrastructure, or research environments with large datasets - Experience building detections or guardrails for AI agents, LLM tooling or MCP servers - Cloud forensics experience: disk and memory acquisition, cloud audit trail reconstruction, chain of custody - Published open source detection content Runway strives to recruit and retain exceptional talent from diverse backgrounds while ensuring pay equity for our team. Our salary ranges are based on competitive market rates for our size, stage and industry, and salary is just one part of the overall compensation package we provide. There are many factors that go into salary determinations, including relevant experience, skill level and qualifications assessed during the interview process, and maintaining internal equity with peers on the team. The range shared below is a general expectation for the function as posted, but we are also open to considering candidates who may be more or less experienced than outlined in the job description. In this case, we will communicate any updates in the expected salary range. Lastly, the provided range is the expected salary for candidates in the U.S. Outside of those regions, there may be a change in the range, which again, will be communicated to candidates. WORKING AT RUNWAY Great things come from great teams. https://www.youtube.com/watch?v=kwmj4ato2kw&ab_channel=Runway We’d love to hear from you. We’re committed to creating a space where our employees can bring their full selves to work and have equal opportunity to succeed. So regardless of race, gender identity or expression, sexual orientation, religion, origin, ability, age, veteran status, if joining this mission speaks to you, we encourage you to apply. More about Runway - Universal World Simulator https://runwayml.com/world-simulator.html - GWM-1 https://runwayml.com/research/introducing-runway-gwm-1 - Gen-4.5 https://runwayml.com/research/introducing-runway-gen-4.5 - General World Models https://runwayml.com/research/introducing-general-world-models - Robotics SDK https://runwayml.com/research/introducing-runway-gwm-1#robotics-section - Conversational Real-time Agents https://runwayml.com/research/introducing-runway-gwm-1#avatars-section - Runway Studios https://runwayml.com/studios We're excited to be recognized as a best place to work: Crain's https://www.crainsnewyork.com/awards/best-places-work-2023 | InHerSight https://www.inhersight.com/companies/best/city/new-york-city-ny | BuiltIn NYC https://builtin.com/awards/new-york-city/2024/best-places-to-work | INC https://www.inc.com/best-workplaces/2024

Ищем hands-on DevSecOps / Security специалиста для проекта в сфере regulated crypto / fintech. Основная задача — разбирать результаты IT/Security-аудитов и технически закрывать выявленные vulnerabilities, security gaps и audit findings. Что важно: • DevSecOps / Application / Infrastructure / ICT Security; • DORA — обязательно; • MiCA, ISO 27001 или аналогичные стандарты; • опыт security/compliance-аудитов; • понимание regulated crypto / fintech; • умение самостоятельно делать remediation. Будет плюсом: Fireblocks, crypto custody, MPC, crypto exchanges, custodians, fintech/payment. Не рассматриваем чистых Compliance Officers, специалистов только по документации и Backend Developers без Security/DevSecOps опыта.

Location: New York; Stockholm Workplace: OnSite ABOUT US: AI NEEDS A NEW INFRASTRUCTURE LAYER. WE'RE BUILDING IT AT MODAL. Every era of computing brought new workloads that previous infrastructure couldn't support: mainframes, databases, and the cloud. Each time, the company that rebuilt the layer underneath defined the decade. AI is no different, except it touches everything instead of one slice, and the window to build the layer underneath it is open right now. Our customers include category-defining companies like Ramp https://modal.com/blog/how-ramp-built-a-full-context-background-coding-agent-on-modal, Cognition, DoorDash, and Suno. They rely on Modal for instant GPU access, sub-second container starts, and native storage, so it's simple to serve low-latency inference, fine-tune models, and access production-ready sandboxes at scale. We've passed $1B in annualized run rate, up 15x from a year ago. In October 2026 we raised a $750M Series D led by Accel at a $15.75B valuation. Our team includes creators of popular open-source projects (e.g.,Seaborn https://github.com/mwaskom/seaborn,Luigi https://github.com/spotify/luigi), academic researchers, international olympiad medalists, and experienced engineering and product leaders with decades of experience. THE ROLE: We’re looking for a Detection & Response Engineer to build the systems that help us identify, investigate, and respond to threats across our platform. This is an engineering role focused on automation. You’ll build detections, investigation tooling, and response capabilities that scale with our infrastructure, using AI where it meaningfully improves signal, investigation speed, and operational effectiveness. You’ll work closely with infrastructure, platform, and security engineers to ensure every incident makes the platform more resilient. WHAT YOU'LL WORK ON: Detection Engineering - Design and build high-fidelity detections for attacks, abuse, and anomalous behavior across our infrastructure and production systems - Continuously improve detections based on telemetry, threat intelligence, and lessons learned from incidents - Improve visibility across cloud infrastructure, containers, identity systems, and production services Incident Response - Lead or participate in investigations spanning production infrastructure, cloud environments, and internal systems - Build playbooks and automation that reduce investigation time and improve response consistency - Drive post-incident improvements that eliminate entire classes of future incidents Security Tooling & Automation - Build internal tooling that improves detection, investigation, and response workflows - Leverage LLMs to automate repetitive analysis, accelerate investigations, and surface actionable insights from security telemetry - Improve the collection, quality, and usability of security telemetry across the platform Engineering Partnership - Partner with engineering teams to ensure new systems are observable and secure by default - Help teams instrument services with the telemetry needed for effective detection and response - Drive security improvements that make the platform easier to defend over time YOU MAY BE A FIT IF: - You have experience in detection engineering, incident response, security engineering, or software engineering with a strong security focus - You have strong software engineering skills and experience building production systems. - You’ve investigated security incidents in cloud-native or distributed environments - You’re familiar with modern cloud infrastructure, Kubernetes, Linux, and networking - You’ve built detections using logs, telemetry, behavioral signals, or large-scale event data. - You have strong SQL skills for investigating security events and developing detections - You’re interested in applying AI and LLMs to detection, investigation, and response, and in understanding emerging threats involving AI-powered systems - You have strong written and verbal communication skills NICE-TO-HAVE: - Experience building AI- or LLM-powered security tooling - Experience with SIEM, SOAR, or EDR platforms - Experience with Kubernetes security or large-scale cloud infrastructure - Experience with threat hunting, malware analysis, or digital forensics - Experience contributing to security operations in a high-growth engineering organization

Обязанности: — Развертывание и поддержка облачной инфраструктуры в AWS (IaC через Terraform) — Администрирование…

Задачи: — Развертывание и поддержка облачной инфраструктуры в AWS (IaC через Terraform) — Администрирование кластеров Kubernetes (EKS) и управление деплоем через Helm — Настройка, оптимизация и защита пайплайнов в GitLab CI и GitHub Actions — Внедрение инструментов сканирования уязвимостей (SAST/DAST) и управление секретами в HashiCorp Vault — Настройка сквозного мониторинга и логирования (Prometheus, Grafana, ELK/Loki, Sentry), оперативное реагирование на инциденты — Участие во внедрении и поддержании практик информационной безопасности по стандарту ISO 27001 — Настройка и поддержка веб-серверов (Nginx), управление VPN, SSL/TLS сертификатами и DNS Требования: — Уверенное знание Linux (Ubuntu/RHEL) и владение Bash для автоматизации — Практический опыт работы с AWS (EKS, IAM, S3, RDS) и Ansible — Глубокое понимание процессов контейнеризации (Docker, Kubernetes) и автоматизации CI/CD — Понимание принципов сетевой безопасности, опыт работы с криптографическими протоколами и системами управления секретами — Знание принципов и практический интерес к внедрению стандартов безопасности ISO 27001 Условия: — Официальное оформление в соответствии с регламентом МФЦА (AIFC) — График работы 5/2, гибкий гибридный формат (сочетание офиса в Алматы и удаленки) с гибким началом дня — Стабильная заработная плата — Интересные и динамичные digital-проекты (включая AI-интеграции и масштабные веб-платформы) — Сильная техническая команда, минимум бюрократии и открытость к вашим технологическим инициативам

Location: Hong Kong, Hong Kong SAR Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. About the Opportunity We are looking for a Security Operations Engineer who combines hands-on engineering skills with security operations expertise. You will be deeply involved in the operations and troubleshooting of both server-side and client-side components within our Zero Trust architecture, drive security risk governance initiatives, and leverage AI tools to continuously improve system stability and compliance. Key Responsibilities K8s Operations & Vendor Engagement: Develop deep expertise in K3s / Kubernetes, including version management and disaster recovery. Independently identify and reproduce system issues, proactively engage with vendors to drive root cause analysis and resolution — not just workarounds. Zero Trust Network Access Governance: Work closely on Zero Trust initiatives, participate in cluster network configuration and troubleshooting, identify device compliance risks, drive remediation of non-compliant devices, and continuously optimize access control policies. Monitoring & Observability: Build and continuously improve log monitoring systems; proactively surface system risks through alert rules and trend analysis. AI Agent Implementation: Lead the adoption of AI Agents in security operations — design and deploy AI Agent workflows for log analysis, alert triage, and automated incident remediation (e.g., Multi-step Agents using Claude / GPT with tool-calling), reducing manual intervention and improving response efficiency. Requirements Must Have Solid understanding of Kubernetes / K3s core concepts; able to independently diagnose cluster-level issues. Foundational knowledge of security principles and Zero Trust model; strong networking fundamentals with the ability to independently troubleshoot and analyze network connectivity issues. Hands-on experience with AI tools (e.g., Claude, Codex, or equivalents) for day-to-day tasks including log analysis, scripting, fault diagnosis, and documentation. Bachelor's degree or above in Computer Science, Information Security, Network Engineering, or a related field; 3–5 years of relevant experience. Nice to Have Experience with DACS / NAC or similar device access control system operations or risk governance. Familiarity with monitoring and logging platforms such as Prometheus + Grafana, ELK, or Loki. Hands-on experience building AI Agents or implementing tool-calling workflows. Proven track record of collaborating with external vendors to drive issue resolution. Who You Are AI-Forward: You actively explore and integrate AI tools into your daily workflow to boost efficiency. Owner Mindset: You take genuine ownership of system health — you don't just close tickets. Strong Communicator & Driver: You can clearly articulate technical issues and effectively push cross-functional teams and vendors toward resolution. Self-Starter: You don't wait to be told — you proactively spot problems and drive them to closure. Perks & Benefits Competitive total compensation package L&D programs and Education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Please note that Hong Kong is a group-level service hub, and OKX does not carry on a business of operating a virtual asset trading platform in Hong Kong. Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: Home based - Worldwide We have opened several senior/staff Security Operations Engineer (SOC) positions, creating a new team reporting to the CISO. We are looking for a range of experience in these positions - at the high end we are looking for deep experience defending highly contested critical assets and high-value cyber targets against advanced persistent threats and state-level actors. We have more junior roles for exceptional individuals with a proven personal interest an engagement in cyber attack and defence, and outstanding academic and career performance even if experience is limited. Our goal is to build an entirely new level of assurance and observable rigour into the open source supply chain. We have our own estate to monitor, but more broadly our goal is to raise the robustness of the entire global Ubuntu estate through the work of this team. The Security Operations (SecOps) team is responsible for design, implementation and evolution of Canonical security practices, techniques, tools, systems and policies. The team is the primary owner of strategy and practices that determine how Canonical secures its data, internal infrastructure and build processes. They are responsible for assuring the security and integrity of our own infrastructure and product deployments. They design and implement technical security controls that ensure security threats are automatically identified, contained and remediated. The team will also contribute ideas and requirements for Canonical product security, improving the resilience and robustness of all Ubuntu customers and users subject to cyber attack. The SecOps team's mission is not only to secure Canonical, but also to contribute to the security of the wider open source ecosystem. They might share knowledge through public presentations and industry events, and share threat intelligence with the wider community or represent Canonical in sector-specific governance bodies. What you will do in this role: Implement and evolve Canonical's SecOps security standards and playbooks Analyse and improve Canonical's security architecture Evaluate, select and implement new security tools and practices Identify, contain and guide the remediation of security threats and cyber attacks Grow the presence and thought leadership of Canonical SecOps practice Contribute to open source threat intelligence initiatives Drive threat modelling, table top exercises and other SecOps practices across Engineering, IS and Canonical Develop Canonical SecOps learning and development materials Publish blog posts, whitepapers and conference presentations Identify, implement and track SecOps KPIs Plan and deliver SecOps work in the framework of Canonical's agile engineering practice Work with Security leadership to present information and influence change What we are looking for An exceptional academic track record Undergraduate degree in Computer Science or STEM, or a compelling narrative about your alternative path Drive and a track record of going above-and-beyond expectations Deep personal motivation to be at the forefront of technology security Expertise in threat modelling and risk management frameworks Knowledge of security architecture and market-leading security tools Experience contributing to, and consuming, threat intelligence feeds Experience in security risk management frameworks such as NIST CSF Experience with security standards such as ISO 27001 Optional things we value Experience in a security operations team or a security operations centre (SOC) Experience in offensive or defensive security teams with hands-on ability Experience with state-actor and other advanced persistent threats What we offer you We consider geographical location, experience, and performance in shaping compensation worldwide. We revisit compensation annually (and more often for graduates and associates) to ensure we recognise outstanding performance. In addition to base pay, we offer a performance-driven annual bonus. We provide all team members with additional benefits, which reflect our values and ideals. We balance our programs to meet local needs and ensure fairness globally. Distributed work environment with twice-yearly team sprints in person Personal learning and development budget of USD 2,000 per year Annual compensation review Recognition rewards Annual holiday leave Maternity and paternity leave Employee Assistance Programme Opportunity to travel to new locations to meet colleagues Priority Pass, and travel upgrades for long haul company events About Canonical Canonical is a pioneering tech firm at the forefront of the global move to open source. As the company that publishes Ubuntu, one of the most important open source projects and the platform for AI, IoT and the cloud, we are changing the world on a daily basis. We recruit on a global basis and set a very high standard for people joining the company. We expect excellence - in order to succeed, we need to be the best at what we do. Canonical has been a remote-first company since its inception in 2004.​ Working here is a step into the future, and will challenge you to think differently, work smarter, learn new skills, and raise your game. Canonical is an equal opportunity employer We are proud to foster a workplace free from discrimination. Diversity of experience, perspectives, and background create a better work environment and better products. Whatever your identity, we will give your application fair consideration. #LI-remote

Location: Home based - Worldwide The Canonical Security Operations team is hiring for a Senior or Staff engineer. The Security Operations team is responsible for designing, building, and operating a world-class Security Operations Center, and the successful candidate will provide leadership, mentorship, expertise, and outstanding individual contributions towards those ends. This role involves aspects of: Traditional SOC duties - security monitoring, threat hunting, and response. Security engineering - assessing and protecting Canonical platforms and products. Software engineering - building custom tools and platforms. Site reliability engineering - deploying, maintaining, and automating security tools. We are looking for individuals with engineering and security experience, as well as a history of remarkable achievement. Senior security operations personnel with engineering experience and senior developers with security experience are equally well-suited to this role. Beyond securing Canonical’s digital estate, this position represents a unique opportunity to contribute to the open source ecosystem. Team members may present at industry conferences, share threat intelligence with the wider community, or publish open source security software. Junior positions are also available for less-experienced individuals with a compelling academic or professional background. In this role, you will: Provide operational and engineering leadership. Implement and evolve Canonical’s Security Operations Center. Design and develop security software and platforms. Monitor for, identify, respond to, and remediate security incidents. Assess and improve Canonical’s security controls. Mentor early-career Security Operations engineers. Plan and deliver work within Canonical's agile engineering framework. Contribute to open source security. Publish blog posts, whitepapers and conference presentations. We are looking for: An exceptional academic track record. Undergraduate degree in Computer Science or STEM, or a compelling narrative about your alternative path. 10+ years of relevant professional experience Professional cybersecurity experience, preferably working or leading a Security Operations Center. Professional engineering experience. An eagerness to contribute to open source security. Proficiency in common scripting languages, such as Python and Bash. Knowledge of Git, GitOps, Infrastructure-as-Code, and common orchestration platforms (e.g., Kubernetes) Though optional, we value: Familiarity with security frameworks such as the NIST CSF, CIS CSC, and ISO 27001 Knowledge of security architecture and market-leading security tools. Experience in a security operations team or a security operations center. Experience in offensive or defensive security teams with hands-on ability. Experience with advanced persistent threats. Proficiency in additional programming languages, such as Golang. What we offer you: We consider geographical location, experience, and performance in shaping compensation worldwide. We revisit compensation annually (and more often for graduates and associates) to ensure we recognise outstanding performance. In addition to base pay, we offer a performance-driven annual bonus. We provide all team members with additional benefits, which reflect our values and ideals. We balance our programs to meet local needs and ensure fairness globally. Distributed work environment with twice-yearly team sprints in person Personal learning and development budget of USD 2,000 per year Annual compensation review Recognition rewards Annual holiday leave Maternity and paternity leave Employee Assistance Programme Opportunity to travel to new locations to meet colleagues Priority Pass, and travel upgrades for long haul company events About Canonical Canonical is a pioneering tech firm at the forefront of the global move to open source. As the company that publishes Ubuntu, one of the most important open source projects and the platform for AI, IoT and the cloud, we are changing the world on a daily basis. We recruit on a global basis and set a very high standard for people joining the company. We expect excellence - in order to succeed, we need to be the best at what we do. Canonical has been a remote-first company since its inception in 2004.​ Working here is a step into the future, and will challenge you to think differently, work smarter, learn new skills, and raise your game. Canonical is an equal opportunity employer We are proud to foster a workplace free from discrimination. Diversity of experience, perspectives, and background create a better work environment and better products. Whatever your identity, we will give your application fair consideration. #LI-remote

Location: Home based - Worldwide This global leadership role in cyber security is to manage the Security Operations (SecOps) team responsible for design, implementation and evolution of Canonical security practices, techniques, tools, systems and policies. The team is the primary owner of strategy and practices that determine how Canonical secures its data, internal infrastructure and build processes. They are responsible for assuring the security and integrity of our own infrastructure and product deployments. They design and implement technical security controls that ensure security threats are automatically identified, contained and remediated. The team will also contribute ideas and requirements for Canonical product security, improving the resilience and robustness of all Ubuntu customers and users subject to cyber attack. As a leader on cyber security in the company, the SecOps team manager will collaborate with our Organisational Learning and Development team to develop playbooks and facilitate SecOps training across Canonical. They will operate in a wider security organisation, run a high performing security team and improve Canonical's security posture. They will lead initiatives to integrate the team's insights into Canonical's broader software development process. While this is a management position, we expect managers to be expert practitioners, able to lead by example, contribute at the highest level, and assess work based on their own professional experience and skill. Candidates should have deep, hands-on expertise with a range of open source and proprietary security tooling and practices, which they can integrate into a holistic next generation security solution across the breadth of Canonical's interests. The SecOps team's mission is not only to secure Canonical, but also to contribute to the security of the wider open source ecosystem. They might share knowledge through public presentations and industry events, and share threat intelligence with the wider community or represent Canonical in sector-specific governance bodies. This role reports to the CISO. What you will do in this role: Hire and mentor a team of outstanding technical security professionals Define Canonical's SecOps security standards and playbooks Own and drive the architecture and design of the SOC Analyse and improve Canonical's security architecture Evaluate, select and implement new security tools and practices Identify, contain and guide the remediation of security threats and cyber attacks Grow the presence and thought leadership of Canonical SecOps practice Contribute to open source threat intelligence initiatives Drive threat modelling, table top exercises and other SecOps practices across Engineering, IS and Canonical Develop Canonical SecOps learning and development materials Publish blog posts, whitepapers and conference presentations Identify, implement and track SecOps KPIs Plan and deliver SecOps work in the framework of Canonical's agile engineering practice Work with Security leadership to present information and influence change What we are looking for Proven track record of mitigating with advanced threat actors and nation state threats Expert technical understanding of SOCs from the ground up In depth knowledge of SOC architecture and design including strategies for logging, firewalls, network segmentation, honeypots etc Someone who understands how the SOC works not just how to use it Expert in Linux security Ability to define, implement, automate and measure effective incident response playbooks Knowledge of security architecture and market-leading security tools Experience contributing to, and consuming, threat intelligence feeds Experience in security risk management frameworks such as NIST CSF An exceptional academic track record from both high school and university Undergraduate degree in Computer Science or STEM, or a compelling narrative about your alternative path Drive and a track record of going above-and-beyond expectations Deep personal motivation to be at the forefront of technology security Leadership and management ability Excellent business English writing and presentation skills Confidence to report security performance metrics with accountability for accuracy and completeness Optional things we value Experience in offensive or defensive security teams with hands-on ability Experience with open source security tools Experience with security standards such as ISO 27001 Experience with security posture management of corporate endpoitns

Location: Athens; Thessaloniki Workplace: onsite The Role:    As a Junior Systems Monitoring Officer working within our team, you will be responsible for managing a variety of risks for the company, relating to our systems and the various products we offer to our clients and partners. Using in-house tools and reports, you will monitor and evaluate client behaviour, analyse and evaluate the products we offer, and take initiative to help improve on the current tools, reports and procedures used and followed by the department. The main responsibilities of the position include: Monitor the system used by the department and analyse various reports Conduct reviews and investigations of client activity Monitor and ensure swift actions are being taken to manage a range of risks Identify, examine, and report any suspicious activities related to the violation of the Terms and Conditions or the company Work with other departments to perform daily duties and to achieve common goals Stay up to date with market and economic developments Main requirements: BSc/MSc in Mathematics, Statistics, Economics, or any other relevant field (first or upper second-class honours) Strong analytical skills Organised and methodical personality, high attention to detail Excellent oral and written communication skills in English Excellent working knowledge of Microsoft Office tools Ability to work on a well-structured, rotating shift schedule, including weekends Benefit from: Attractive remuneration package Private health insurance Corporate pension fund Intellectually stimulating work environment Continuous personal development and international training opportunities The Hiring Experience: What Awaits You Let’s Connect – Intro Chat with Talent Acquisition Deep Dive – First Interview with Your Future Team Test your edge – Aptitude Assessment Final Connection – Final Interview All applications will be treated with strict confidentiality!   By submitting this application, I confirm that I have read and agree to the terms of the Privacy Policy and the Confidentiality Undertaking.