Location: San Francisco; Remote; Toronto; New York; Montreal; Seattle
Workplace: Hybrid
ABOUT BASETEN
Baseten powers mission-critical inference for the world's most dynamic AI companies, like Cursor, Notion, OpenEvidence, Abridge, Clay, Gamma, and Writer. By uniting applied AI research, flexible infrastructure, and seamless developer tooling, we enable companies operating at the frontier of AI to bring cutting-edge models into production. We're growing quickly and recently raised our $1.5B Series F https://www.baseten.co/blog/announcing-our-series-f/, led by Altimeter Capital, Conviction Partners, and Spark Capital. Join us and help build the platform engineers turn to ship AI products.
THE ROLE
We are seeking an experienced and detail-oriented GRC (Governance, Risk, and Compliance) Manager to build, support, and continuously enhance Baseten’s security governance, compliance, and privacy programs. As one of the early members of our security organization, you will play a key role in ensuring our platform meets and exceeds the highest standards for privacy, trust, and regulatory compliance.
You’ll work closely with Engineering, Product, Security, and Legal to define compliance requirements, assess platform capabilities, and drive implementation from initial scoping through validation. You will also lead customer assurance efforts, helping customers understand our security architecture and compliance posture while bringing their requirements back into product planning.
Alongside this product focus, you’ll contribute to Baseten’s broader GRC program, including governance, risk management, audits, vendor assessments, and security awareness.
RESPONSIBILITIES
- Product Compliance: Translate regulatory, framework, and customer requirements into clear product requirements and technical controls, partnering with Engineering and Product to build compliance into platform design and development.
- Governance & Policy Development: Design, implement, and maintain security governance frameworks, policies, and procedures that align with Baseten’s risk posture and industry best practices.
- Risk Management: Build and manage the company-wide risk assessment program, identifying, tracking, and mitigating key security and compliance risks.
- Compliance Operations: Support efforts to achieve and maintain compliance with SOC 2, ISO 27001/27701, HIPAA, FedRAMP and other applicable standards and regulations.
- Audit & Certification Management: Coordinate external audits and certification processes, ensuring evidence collection, control validation, and remediation plans are executed efficiently.
- Third-Party Risk Management: Oversee vendor security assessments and ensure third-party providers meet Baseten’s security and compliance standards.
- Cross-Functional Collaboration: Partner with Engineering, Product, and Operations teams to embed compliance and risk management into day-to-day operations and technical processes.
- Customer Trust & Assurance: Support customer security questionnaires, due diligence efforts, and documentation requests from prospective and existing clients.
- Training & Awareness: Develop and deliver security and compliance training to ensure company-wide understanding of key policies and responsibilities.
- Continuous Improvement: Stay current on evolving regulatory requirements and lead initiatives to mature our compliance and risk management programs.
REQUIREMENTS
- BS Degree in CS, CE, MIS or equivalent field
- 5+ years of experience in GRC, Security Compliance, or Information Security roles, ideally in a SaaS or cloud-native environment.
- Strong understanding of security frameworks and standards such as SOC 2, ISO 27001, NIST, and GDPR.
- Proven track record managing compliance audits and certification programs end-to-end.
- Experience working directly with leaders and executives within Enterprise organizations
- Experience working cross-functionally with technical and non-technical stakeholders to implement compliance and security controls.
- Proven experience driving product compliance by translating regulatory and customer requirements into actionable product controls with Engineering and Product
- Experience defining project requirements and driving implementation by translating compliance objectives into clear deliverables, coordinating cross-functional stakeholders, and managing execution through completion.
- Experience responding to customer security questionnaires and leading customer security interviews, with the ability to clearly communicate security controls, compliance posture, and risk management practices to technical and nontechnical audiences.
- Ability to thrive in a fast-paced, high-growth startup environment while maintaining structure and process discipline.
NICE TO HAVE
- Experience with cloud security compliance in AWS or GCP environments.
- Hands-on experience using GRC tools (e.g., Vanta, Drata, Secureframe, Anecdotes).
- Understanding of AI/ML security considerations, data privacy, and model governance.
- Previous experience building and implementing security controls in an early-stage or rapidly growing startup.
- Relevant certifications (e.g., CISA, CISSP, CISM, ISO 27001 Lead Implementer).
BENEFITS
- Competitive compensation, including meaningful equity
- (U.S. only) 100% coverage of medical, dental, and vision insurance for employee and dependents
- Flexible PTO policy including company wide Winter Break (our offices are closed from Christmas Eve to New Year's Day!)
- Paid parental leave
- Fertility and family-building stipend through Carrot
- (U.S. only) Company-facilitated 401(k)
- Exposure to a variety of ML startups, offering unparalleled learning and networking opportunities.
Apply now to embark on a rewarding journey in shaping the future of AI! If you are a motivated individual with a passion for machine learning and a desire to be part of a collaborative and forward-thinking team, we would love to hear from you.
At Baseten, we are committed to fostering a diverse and inclusive workplace. We provide equal employment opportunities to all employees and applicants without regard to race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, genetic information, disability, or veteran status.
We are an Equal Opportunity Employer and will consider qualified applicants with criminal histories in a manner consistent with applicable law (by example, the requirements of the San Francisco Fair Chance Ordinance, where applicable).
ГибридSan Francisco; Remote; Toronto; New York; Montreal; Seattle
Location: Foster City, CA
Workplace: Hybrid
Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation.
ABOUT THE ROLE
We're looking for a Security Engineer with deep incident response experience to help defend Replit, a fast-moving, cloud-native AI vibe-coding platform. You'll be the person who takes charge when something goes wrong. You'll lead investigations from first signal to root cause, coordinate containment across Security, SRE, and Engineering, and keep stakeholders informed while the incident is moving fast.
This isn't a pure responder role. We want a well-rounded security engineer who has run real incidents and wants to make the next one faster. You'll write the scripts, automations, and tooling that take manual work out of triage, evidence collection, and containment. You'll also turn lessons from each incident into better detections, playbooks, and platform hardening.
RESPONSIBILITIES
Incident Response
- Serve as incident commander or technical lead for security incidents, from detection and triage through containment, eradication, recovery, and post-incident review.
- Coordinate response across Security, SRE, Engineering, Legal, and leadership. Drive decisions under pressure and keep a clear record of actions taken.
- Communicate incident status, impact, and risk clearly to technical and executive audiences.
- Participate in and help shape the security on-call rotation.
Investigation & Forensics
- Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers using SIEM, Cloud Logging, telemetry, and host and container artifacts.
- Determine scope, root cause, attacker behavior, and blast radius for confirmed incidents.
- Quickly assess whether emerging threats (0-days, active exploitation campaigns, bug bounty findings, customer reports) apply to Replit, and whether we're already affected.
IR Automation & Tooling
- Build scripts, automations, and tools (Python, Go, Bash, or directly on Replit) that speed up response, such as automated enrichment, evidence collection, credential and session revocation, workload isolation, and alert triage.
- Develop and maintain response playbooks and runbooks, and automate them where possible.
- Integrate response workflows with SIEM, SOAR, ticketing, and chat tooling to cut time-to-contain.
Detection & Continuous Improvement
- Turn incident findings into new or improved detections, logging coverage, and visibility.
- Lead blameless post-incident reviews and drive remediation items to completion.
- Run tabletop exercises and simulations to test readiness and find gaps.
REQUIRED SKILLS & EXPERIENCE
- Proven experience leading or serving as technical lead on security incidents in a cloud or SaaS environment.
- Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis. Comfortable working through large datasets under time pressure.
- Proficiency writing production-quality scripts or tools in Python, Go, or Bash for investigation and automation.
- Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking).
- Working knowledge of Kubernetes and containers, including how to investigate and contain compromised workloads.
- Understanding of identity systems, SaaS architectures, and common cloud attack paths (credential theft, privilege escalation, supply chain, token abuse).
- Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems, so you can work effectively with Engineering on code-level fixes.
- Understanding of IR frameworks and lifecycle (for example NIST 800-61), plus the vulnerability lifecycle and exploitability analysis.
PREFERRED QUALIFICATIONS
- Experience building or operating SOAR or other response automation platforms.
- Digital forensics experience with cloud, Linux hosts, or containers.
- Experience with threat intelligence, threat hunting, or security research.
- Experience with bug bounty programs or coordinated vulnerability disclosure.
- Familiarity with detection-as-code practices and writing detection rules.
- Experience in fast-paced, cloud-native, or AI/ML-driven environments.
- Relevant certifications (such as GCIH, GCFA, GCFR), or equivalent hands-on experience.
WHAT WE VALUE
- Curiosity & initiative: Strong desire to understand attacker behaviors, emerging threats, and how they apply to real-world systems.
- Speed & analytical rigor: Ability to quickly assess high-risk vulnerabilities with clear, evidence-based reasoning.
- Collaboration: Comfort working across cross-functional teams spanning Security, SRE, Engineering, and Infrastructure.
- Clear communication: Ability to explain findings, risks, and mitigation strategies to stakeholders at all levels.
- Ownership mindset: Takes initiative to drive investigations, improvements, and remediations to completion.
- Continuous learning: Passion for staying up to date on new vulnerabilities, exploit trends, and cloud-native security best practices.
Full-Time Employee Benefits Include:
💰 Competitive Salary & Equity
💹 401(k) Program with a 4% match (US Only)
⚕️ Health, Dental, Vision and Life Insurance
🩼 Short Term and Long Term Disability
🚼 Paid Parental, Medical, Caregiver Leave
🏝 Flexible Time Off (FTO) + Holidays
🚗 Commuter Benefits (In-Office & US Only)
📱 Monthly Wellness Stipend
🧑💻 Autonomous Work Environment
🖥 In Office Set-Up Reimbursement (In-Office Only)
🚀 Quarterly Team Gatherings
☕ In Office Amenities (In-Office Only)
Want to learn more about what we are up to?
- Self-driving Company https://replit.com/blog/self-driving-company
- Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale
- AI Adoption https://replit.com/blog/ai-adoption
- Build Open-Source Apps https://replit.com/build/open-source-app-builder
Interviewing + Culture at Replit
- Operating Principles https://blog.replit.com/operating-principles
- Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit
To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.
Location: Sofia, Bulgaria
Workplace: hybrid
Are you ready to join our digital revolution journey?
At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.
Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.
With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career.
Role Purpose
As Audit & Compliance Manager, Europe, you will be the primary owner of audit readiness and tax regulatory compliance across all Europe entities. You will set the standard, structure and cadence for how the region prepares for and manages statutory audits, global group audits, and tax authority engagement — working through the local reporting teams and external accountants who handle data preparation, review and submission, rather than performing that work yourself. Your role is to define how things get done, ensure consistent quality across every market, and be the region's face in front of auditors and tax authorities.
What Makes This Role Different:
Build, don't just maintain.
You're stepping into a newly created position with a mandate to design the region's audit and compliance approach from the ground up — not inherit a fixed process.
Full regional ownership.
This role spans the entire Europe region.
High visibility, real stakes.
You'll be the direct point of contact with external auditors and tax authorities on some of the company's most sensitive matters, with senior leadership relying on your judgment.
A technology-forward environment.
The business is actively investing in automation, AI and dashboarding to modernize reporting — you'll be expected to bring ideas here, not just adopt what's handed to you.
Cross-functional reach.
You'll work closely with the Tax, Transfer Pricing and Legal teams, and directly with hub-entity finance teams, on issues spanning VAT, customer transactions and company-wide reviews.
What You'll Do:
1. Statutory & Global Audit Leadership
Audit Lifecycle Ownership:
Lead the end-to-end process for local statutory audits and global group audits across all 23 countries — planning, coordinating PBC (Provided by Client) lists, and driving on-time sign-off.
External Auditor Relationship:
Act as the primary regional point of contact for audit firms, owning timelines and resolution of open items.
Consolidation Alignment:
Ensure local statutory filings align with Global/Group reporting timelines (IFRS/US GAAP/local GAAP) for a seamless audit process.
Pre-Audit Structuring:
Work with local teams ahead of each audit cycle to define what needs to be prepared and how — so the region walks into every audit with a consistent, proactive structure rather than reacting to auditor requests.
2. Tax Governance & Regulatory Compliance
Filing Oversight:
Ensure accurate, on-time submission across VAT, Withholding Tax (WHT), Corporate Income Tax, and country-specific statistical and national bank reporting — delivered through local reporting teams and external accountants, with you owning quality and timeliness.
Tax Team Liaison:
Standardize and oversee submission of supporting data to the central Tax team; ensure schedules provided for assessments are reconciled and audit-ready.
Notice & Assessment Management:
Proactively manage tax notices and audits, coordinating evidence-gathering and working with the Tax team to ensure timely, well-supported responses.
Corporate Secretarial Support:
Oversee annual filings and coordinate with Legal on board meeting minutes (financial aspects) and other local regulatory requirements.
3. Process Improvement & Digital Transformation
Root Cause Analysis:
Identify recurring audit adjustments or tax queries and implement structural fixes to eliminate them at the source.
Internal Controls:
Strengthen the control environment across the region to minimize audit findings.
Technology & Automation:
Identify and champion tools — including AI and dashboarding — to reduce manual work and increase consistency across the region's reporting.
What We're Looking For:
Mindset & Soft Skills (critical to this role)
A challenger, not a process-follower — someone who questions how things are done today and proposes a better way, rather than simply executing an existing playbook.
Comfortable operating in a fast-moving, high-volume, occasionally chaotic environment, and energized rather than fatigued by it.
Strong communicator and team player who can build trust quickly across Tax, Legal, Transfer Pricing and local finance teams.
Strategic mindset with the ability to zoom out across markets while staying close enough to the detail to be credible with auditors and tax authorities.
Experience & Technical Skills
Currently operating at Manager level (or equivalent) within an audit firm or a multinational's in-house compliance/audit function — this is not a developmental hire.
10–12+ years of post-qualification experience, with hands-on exposure to multi-country compliance in Europe.
Chartered Accountant (CA), CPA, or ACCA qualification.
Solid working knowledge of IFRS, European tax regulations, and Transfer Pricing fundamentals.
Advanced proficiency with Tier-1 ERP systems (SAP, Oracle, or NetSuite).
Fluent English, written and spoken — required given daily interaction with regional and global stakeholders.
Strong project management and negotiation skills, with the ability to work confidently across time zones and cultures.
In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is EUR 40,000.
In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.
#ALEPH
Why Join Us?
Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.
We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.
#ALEPH
Location: Budapest, Hungary
Workplace: hybrid
Are you ready to join our digital revolution journey?
At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.
Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.
With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career.
Role Purpose
As Audit & Compliance Manager, Europe, you will be the primary owner of audit readiness and tax regulatory compliance across all Europe entities. You will set the standard, structure and cadence for how the region prepares for and manages statutory audits, global group audits, and tax authority engagement — working through the local reporting teams and external accountants who handle data preparation, review and submission, rather than performing that work yourself. Your role is to define how things get done, ensure consistent quality across every market, and be the region's face in front of auditors and tax authorities.
What Makes This Role Different:
Build, don't just maintain.
You're stepping into a newly created position with a mandate to design the region's audit and compliance approach from the ground up — not inherit a fixed process.
Full regional ownership.
This role spans the entire Europe region.
High visibility, real stakes.
You'll be the direct point of contact with external auditors and tax authorities on some of the company's most sensitive matters, with senior leadership relying on your judgment.
A technology-forward environment.
The business is actively investing in automation, AI and dashboarding to modernize reporting — you'll be expected to bring ideas here, not just adopt what's handed to you.
Cross-functional reach.
You'll work closely with the Tax, Transfer Pricing and Legal teams, and directly with hub-entity finance teams, on issues spanning VAT, customer transactions and company-wide reviews.
What You'll Do:
1. Statutory & Global Audit Leadership
Audit Lifecycle Ownership:
Lead the end-to-end process for local statutory audits and global group audits across all 23 countries — planning, coordinating PBC (Provided by Client) lists, and driving on-time sign-off.
External Auditor Relationship:
Act as the primary regional point of contact for audit firms, owning timelines and resolution of open items.
Consolidation Alignment:
Ensure local statutory filings align with Global/Group reporting timelines (IFRS/US GAAP/local GAAP) for a seamless audit process.
Pre-Audit Structuring:
Work with local teams ahead of each audit cycle to define what needs to be prepared and how — so the region walks into every audit with a consistent, proactive structure rather than reacting to auditor requests.
2. Tax Governance & Regulatory Compliance
Filing Oversight:
Ensure accurate, on-time submission across VAT, Withholding Tax (WHT), Corporate Income Tax, and country-specific statistical and national bank reporting — delivered through local reporting teams and external accountants, with you owning quality and timeliness.
Tax Team Liaison:
Standardize and oversee submission of supporting data to the central Tax team; ensure schedules provided for assessments are reconciled and audit-ready.
Notice & Assessment Management:
Proactively manage tax notices and audits, coordinating evidence-gathering and working with the Tax team to ensure timely, well-supported responses.
Corporate Secretarial Support:
Oversee annual filings and coordinate with Legal on board meeting minutes (financial aspects) and other local regulatory requirements.
3. Process Improvement & Digital Transformation
Root Cause Analysis:
Identify recurring audit adjustments or tax queries and implement structural fixes to eliminate them at the source.
Internal Controls:
Strengthen the control environment across the region to minimize audit findings.
Technology & Automation:
Identify and champion tools — including AI and dashboarding — to reduce manual work and increase consistency across the region's reporting.
What We're Looking For:
Mindset & Soft Skills (critical to this role)
A challenger, not a process-follower — someone who questions how things are done today and proposes a better way, rather than simply executing an existing playbook.
Comfortable operating in a fast-moving, high-volume, occasionally chaotic environment, and energized rather than fatigued by it.
Strong communicator and team player who can build trust quickly across Tax, Legal, Transfer Pricing and local finance teams.
Strategic mindset with the ability to zoom out across markets while staying close enough to the detail to be credible with auditors and tax authorities.
Experience & Technical Skills
Currently operating at Manager level (or equivalent) within an audit firm or a multinational's in-house compliance/audit function — this is not a developmental hire.
10–12+ years of post-qualification experience, with hands-on exposure to multi-country compliance in Europe.
Chartered Accountant (CA), CPA, or ACCA qualification.
Solid working knowledge of IFRS, European tax regulations, and Transfer Pricing fundamentals.
Advanced proficiency with Tier-1 ERP systems (SAP, Oracle, or NetSuite).
Fluent English, written and spoken — required given daily interaction with regional and global stakeholders.
Strong project management and negotiation skills, with the ability to work confidently across time zones and cultures.
In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is 15,871,000 HUF.
In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.
#ALEPH
Why Join Us?
Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.
We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.
#ALEPH
Location: Bucharest, Romania
Workplace: hybrid
Are you ready to join our digital revolution journey?
At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.
Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.
With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career.
Role Purpose
As Audit & Compliance Manager, Europe, you will be the primary owner of audit readiness and tax regulatory compliance across all Europe entities. You will set the standard, structure and cadence for how the region prepares for and manages statutory audits, global group audits, and tax authority engagement — working through the local reporting teams and external accountants who handle data preparation, review and submission, rather than performing that work yourself. Your role is to define how things get done, ensure consistent quality across every market, and be the region's face in front of auditors and tax authorities.
What Makes This Role Different:
Build, don't just maintain.
You're stepping into a newly created position with a mandate to design the region's audit and compliance approach from the ground up — not inherit a fixed process.
Full regional ownership.
This role spans the entire Europe region.
High visibility, real stakes.
You'll be the direct point of contact with external auditors and tax authorities on some of the company's most sensitive matters, with senior leadership relying on your judgment.
A technology-forward environment.
The business is actively investing in automation, AI and dashboarding to modernize reporting — you'll be expected to bring ideas here, not just adopt what's handed to you.
Cross-functional reach.
You'll work closely with the Tax, Transfer Pricing and Legal teams, and directly with hub-entity finance teams, on issues spanning VAT, customer transactions and company-wide reviews.
What You'll Do:
1. Statutory & Global Audit Leadership
Audit Lifecycle Ownership:
Lead the end-to-end process for local statutory audits and global group audits across all 23 countries — planning, coordinating PBC (Provided by Client) lists, and driving on-time sign-off.
External Auditor Relationship:
Act as the primary regional point of contact for audit firms, owning timelines and resolution of open items.
Consolidation Alignment:
Ensure local statutory filings align with Global/Group reporting timelines (IFRS/US GAAP/local GAAP) for a seamless audit process.
Pre-Audit Structuring:
Work with local teams ahead of each audit cycle to define what needs to be prepared and how — so the region walks into every audit with a consistent, proactive structure rather than reacting to auditor requests.
2. Tax Governance & Regulatory Compliance
Filing Oversight:
Ensure accurate, on-time submission across VAT, Withholding Tax (WHT), Corporate Income Tax, and country-specific statistical and national bank reporting — delivered through local reporting teams and external accountants, with you owning quality and timeliness.
Tax Team Liaison:
Standardize and oversee submission of supporting data to the central Tax team; ensure schedules provided for assessments are reconciled and audit-ready.
Notice & Assessment Management:
Proactively manage tax notices and audits, coordinating evidence-gathering and working with the Tax team to ensure timely, well-supported responses.
Corporate Secretarial Support:
Oversee annual filings and coordinate with Legal on board meeting minutes (financial aspects) and other local regulatory requirements.
3. Process Improvement & Digital Transformation
Root Cause Analysis:
Identify recurring audit adjustments or tax queries and implement structural fixes to eliminate them at the source.
Internal Controls:
Strengthen the control environment across the region to minimize audit findings.
Technology & Automation:
Identify and champion tools — including AI and dashboarding — to reduce manual work and increase consistency across the region's reporting.
What We're Looking For:
Mindset & Soft Skills (critical to this role)
A challenger, not a process-follower — someone who questions how things are done today and proposes a better way, rather than simply executing an existing playbook.
Comfortable operating in a fast-moving, high-volume, occasionally chaotic environment, and energized rather than fatigued by it.
Strong communicator and team player who can build trust quickly across Tax, Legal, Transfer Pricing and local finance teams.
Strategic mindset with the ability to zoom out across markets while staying close enough to the detail to be credible with auditors and tax authorities.
Experience & Technical Skills
Currently operating at Manager level (or equivalent) within an audit firm or a multinational's in-house compliance/audit function — this is not a developmental hire.
10–12+ years of post-qualification experience, with hands-on exposure to multi-country compliance in Europe.
Chartered Accountant (CA), CPA, or ACCA qualification.
Solid working knowledge of IFRS, European tax regulations, and Transfer Pricing fundamentals.
Advanced proficiency with Tier-1 ERP systems (SAP, Oracle, or NetSuite).
Fluent English, written and spoken — required given daily interaction with regional and global stakeholders.
Strong project management and negotiation skills, with the ability to work confidently across time zones and cultures.
In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is 220,800 RON.
In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.
#ALEPH
Why Join Us?
Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.
We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.
#ALEPH
Location: San Francisco, California; New York, New York
Workplace: Hybrid
WHO WE ARE
Notion is the collaborative AI workspace where teams and agents think together https://www.youtube.com/watch?v=vkpYpWfEK5s. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion.
Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work.
ABOUT THE ROLE
Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build.
We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion.
You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next.
We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters
WHAT YOU'LL ACHIEVE
- Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments, with review and mentorship from senior teammates as you ramp up.
- Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
- Build tooling and automation that speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
- Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements.
- Take part in investigations, incident response, and postmortems, and help turn what we learn into lasting fixes.
- Help define and track metrics such as coverage, MTTD, and alert quality.
- Join a shared on-call rotation for incident response.
SKILLS YOU'LL NEED TO BRING
- We're hiring across a range of experience levels. If you have some of these skills but not all, we'd still like to hear from you.
- 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role.
- Have written or tuned detections that run in production, and care about signal quality and cutting noise.
- Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly.
- An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect.
- Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs.
- Have used SIEM, EDR, or SOAR tools in any size of environment.
- Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end.
NICE TO HAVE
- Have led purple team, blue team, or adversary emulation exercises that improved detections or telemetry.
- Experience running SIEM, EDR, or SOAR platforms at large scale.
- Experience building or maintaining detection-as-code workflows (version control, CI, and tests for detections).
- Experience applying LLMs or agent-style tooling to security workflows.
- Experience securing AI-enabled systems or endpoint tooling.
- Kubernetes or container detection experience.
- Background in threat intelligence, malware analysis, or digital forensics.
- Contributions to the security community through research, tooling, CTFs, or talks.
- Experience at a high-growth startup or AI company.
Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role’s scope and complexity, and the candidate’s experience and expertise, and may vary from the range provided below. For roles based in San Francisco or New York City, the estimated base salary range for this role is $185,000 - $280,000 per year.
By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy https://notion.notion.site/Notion-Global-Recruiting-Privacy-Policy-fc3eb4e829354a26a2bb6fd5e289b550 and and NYLL 144 https://notion.notion.site/Ashby-AI-Bias-Audit-2b0efdeead05803bbbfae159ec86c528.
#LI-Onsite
A NOTE ON AI
You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on.
EQUAL OPPORTUNITY & ACCOMMODATIONS
We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know.
Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.
Location: Dublin, Ireland
Workplace: Hybrid
WHO WE ARE
Notion is the collaborative AI workspace where teams and agents think together https://www.youtube.com/watch?v=vkpYpWfEK5s. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion.
Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work.
ABOUT THE ROLE
Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build.
We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion.
You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next.
We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters
WHAT YOU'LL ACHIEVE
- Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments, with review and mentorship from senior teammates as you ramp up.
- Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety.
- Build tooling and automation that speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful.
- Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements.
- Take part in investigations, incident response, and postmortems, and help turn what we learn into lasting fixes.
- Help define and track metrics such as coverage, MTTD, and alert quality.
- Join a shared on-call rotation for incident response.
SKILLS YOU'LL NEED TO BRING
- We're hiring across a range of experience levels. If you have some of these skills but not all, we'd still like to hear from you.
- 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role.
- Have written or tuned detections that run in production, and care about signal quality and cutting noise.
- Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly.
- An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect.
- Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs.
- Have used SIEM, EDR, or SOAR tools in any size of environment.
- Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end.
NICE TO HAVE
- Have led purple team, blue team, or adversary emulation exercises that improved detections or telemetry.
- Experience running SIEM, EDR, or SOAR platforms at large scale.
- Experience building or maintaining detection-as-code workflows (version control, CI, and tests for detections).
- Experience applying LLMs or agent-style tooling to security workflows.
- Experience securing AI-enabled systems or endpoint tooling.
- Kubernetes or container detection experience.
- Background in threat intelligence, malware analysis, or digital forensics.
- Contributions to the security community through research, tooling, CTFs, or talks.
- Experience at a high-growth startup or AI company.
Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role's scope and complexity, and the candidate's experience and expertise, and may vary from the range provided below. The estimated base salary range for this role is €75,000–€142,000 per year.
By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy https://notion.notion.site/Notion-Global-Recruiting-Privacy-Policy-fc3eb4e829354a26a2bb6fd5e289b550?pvs=74.
#LI-Onsite
A NOTE ON AI
You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on.
EQUAL OPPORTUNITY & ACCOMMODATIONS
We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know.
Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.
• Исследовать актуальные угрозы, тактики, техники и процедуры (TTP) APT, анализировать современные методы проведения кибератак; • Разрабатывать алгоритмы выявления угроз: создавать правила и сценарии детектирования;
Location: Madrid, Spain
Workplace: hybrid
Are you ready to join our digital revolution journey?
At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.
Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.
With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career.
We are looking for an experienced and operationally sharp Security Operations & Incident Response Analyst (L3) to join Aleph's global IT Security team.
Reporting to the Global CISO, you will be the first line of defence when incidents occur and the engine behind the team's threat detection and response capabilities. You will own the end-to-end incident response process, lead threat hunting and intelligence activities, and manage the vulnerability and identity governance programmes — ensuring Aleph is both able to detect threats quickly and respond to them effectively across a complex, globally distributed environment.
What you'll do:
Incident Response
Own and coordinate the
end-to-end incident response process
: identification, triage, containment, eradication, recovery, and post-incident review (lessons learned).
Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources.
Maintain and continuously improve
incident response playbooks
for the most relevant threat scenarios (ransomware, phishing, account compromise, data breach, insider threat, etc.).
Manage the
security incident log and register
: track all incidents, document timelines and actions, and produce trend analysis and reporting for the CISO.
Coordinate with external
SOC or MDR providers
where applicable: review daily reports, validate alert quality, and manage escalation workflows.
Data Breach Management
Lead
data breach investigations
: scope the breach, gather and preserve evidence, assess PII exposure, and coordinate response with Legal, Privacy, and HR.
Produce breach investigation reports with findings, root cause, and recommendations.
Threat Hunting & Intelligence
Conduct
proactive threat hunting
across the environment: develop hypotheses based on threat intelligence, search for indicators of compromise (IoCs), and investigate anomalous behaviour.
Manage the
Threat Intelligence function
: track relevant threat actors, TTPs (MITRE ATT&CK), and sector-specific threat campaigns; integrate intelligence into SIEM/XDR detection rules and hunting queries.
Produce threat intelligence summaries and briefings for the CISO and relevant stakeholders.
Vulnerability Management
Own the
vulnerability management programme
: schedule and execute periodic vulnerability scans across infrastructure, endpoints, and cloud environments.
Analyse scan results, prioritise findings by risk and exploitability, and coordinate remediation with IT Operations within agreed SLAs.
Track remediation progress, produce vulnerability metrics, and report status to the CISO.
Validate remediation effectiveness through re-scanning and spot-checks.
Identity & Access Management (IAM)
Manage
periodic access reviews
: coordinate with system owners and HR to review and certify user permissions across critical systems, ensuring least privilege is maintained.
Oversee the
Privileged Access Management (PAM)
programme: define PAM policies, monitor privileged account usage, and review access rights for administrator-level accounts.
Investigate and respond to identity-related anomalies and access policy violations.
What we are looking for:
3–5 years in a SOC analyst, incident response, or security operations role, with at least 1–2 years at L3 level is a plus.
Experience implementing or managing IAM and PAM solutions
Experience working within international or multinational environments.
Hands-on experience with incident response engagements (internal or consulting) is strongly valued.
Relevant certifications:
GCIH, GCFE, GCFA, CEH, CompTIA CySA+
, or equivalent. OSCP is a plus.
Strong hands-on experience with
SIEM platforms
(alert triage, rule writing, query development) and
EDR/XDR tools
.
Solid knowledge of the
MITRE ATT&CK framework
and its application to threat hunting and incident response.
Experience conducting
vulnerability scans
using tools such as Tenable Nessus, Qualys, Rapid7, or similar.
Familiarity with
IAM and PAM
concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM, or equivalent).
Experience with
digital forensics and incident response (DFIR)
methodologies: evidence collection, log analysis, and timeline reconstruction.
Knowledge of
threat intelligence platforms
and feeds (e.g. MISP, VirusTotal, threat intel feeds).
Understanding of
ISO 27001 incident management controls, NIS2 incident reporting obligations, and PCI DSS requirement 12.10
.
Calm and decisive under pressure.
Strong investigative mindset with structured problem-solving approach, excellent documentation skills.
Ability to communicate incident status and findings clearly to both technical teams and executive stakeholders.
Collaborative and proactive, comfortable working asynchronously across time zones.
English
: full professional proficiency (C1/C2) — primary working language.
Spanish
: professional proficiency is a plus.
In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is EUR 48,000 EUR.
In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.
#Aleph
Why Join Us?
Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.
We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.
#ALEPH
Задачи:
— исследование устройств различного назначения, бинарного кода (без исходного кода), программного обеспечения и внутреннего программного обеспечения (ВПО);
— исследование внутреннего ПО устройств на наличие уязвимостей и недокументированных возможностей;
— анализ защищенности программного обеспечения устройств;
— разработка PoC по результатам проведенного анализа;
— модификация внутреннего ПО для устранения ошибок.
Требования:
— опыт работы в качестве Team lead/Ведущий Reverse engineer от 2 лет;
— навыки управления командой, умение грамотно распределять задачи и нагрузку;
— понимание принципов обратного проектирования (исследования) программного обеспечения;
— владение инструментами обратной разработки (IDA Pro, Radare2 или др.);
— языки программирования: Python, C/С++, Assembler;
— понимание архитектуры ОС;
— опыт использования ОС Linux;
— знание английского языка на уровне чтения технической документации.
Плюсом будет:
— знакомство с аппаратной архитектурой и схемотехникой различных устройств;
— опыт исследования программного обеспечения на безопасность, поиска уязвимостей;
— опыт разработки низкоуровневого кода для x86, MIPS, ARM, RISC-V;
— опыт автоматизации исследования при помощи мультиагентной среды (MML).
Условия:
— официальное трудоустройство в аккредитованной IT-компании и возможность пользоваться соответствующими льготами;
— гибкое начало рабочего дня, гибридный график (офис + удаленка), полностью удаленный формат невозможен;
— офис в пешей доступности от метро Электрозаводская, Семеновская;
— полис ДМС с расширением ВЗР (страхование выезжающих за рубеж);
— премирование за высокие производственные показатели и результаты труда по итогам успешной работы Общества за год;
— предложение по заработной плате и условиям труда формируется по результатам собеседования, в зависимости от опыта и знаний.
Задачи:
— Проводить оценку архитектуры решений и готовности сервиса к запуску с точки зрения безопасности;
— Анализировать отчеты SSDLC сканеров, bug bounty;
— Разрабатывать рекомендации по устранению уязвимостей, ставить задачи на команды, проверять устранения;
— Дорабатывать правила для SSDLC сканеров и WAF;
— Заниматься построением и развитием процессов SSDLC;
— Заниматься написанием политик и инструкций по информационной безопасности в своей зоне ответственности;
— Обучать и консультировать команды разработки в области информационной безопасности.
Требования:
— Знаешь принципы безопасной разработки;
— Имеешь опыт анализа архитектуры приложений и отдельных технологических процессов с точки зрения безопасности;
— Имеешь навыки определения и устранения уязвимостей в веб и мобильных приложениях;
— Работал с инструментами SAST, DAST, SCA, WAF;
— Знаешь типовые протоколы аутентификации, базовые принципы криптографии;
— Имеешь навыки работы в команде.
Желательно, но не обязательно:
— Умение разбираться в чужом коде (Java, JavaScript, TypeScript, Kotlin, Swift);
— Навыки автоматизации задач с помощью скриптовых языков (Python, Go);
— Практический опыт работы с Linux, Docker, Kubernetes.
Условия:
— Оформление по трудовому кодексу. Полностью белая зарплата.
— Каждый месяц отдельная сумма на питание.
— Регулярные тимбилдинги, спортивные забеги, корпоративные праздники.
— ДМС включает стоматологию и полис путешественника.
— Обучение за счёт компании: тренинги, конференции, митапы, курсы английского.
— Выдача ноутбука и всего необходимого для работы.
— Возможность работать в красивом и удобном офисе с кофе, сладостями и фруктами.
— Бесплатные онлайн-консультации психологов, юристов, специалистов по финансам и ЗОЖ, ветеринаров.
— Офисы в Нижнем Новгороде, Москве и Петербурге.
Задачи:
— Проверять безопасность сервисов, приложений, архитектуры, новых фич и сопровождать внедрение мер по устранению выявленных рисков
— Давать рекомендации по построению безопасной архитектуры, описывать целевую архитектуру по лучшим практикам (в том числе OWASP)
— Анализировать код разрабатываемых сервисов на наличие уязвимостей
— Проводить аудит безопасности сред и приложений (web, API, mobile)
— Проводить аудит и тестирование программ лояльности на предмет безопасности и возможных злоупотреблений, включая анализ бизнес-логики
— Составлять отчеты по результатам аудитов, заводить задачи в Jira с рекомендациями, сопровождать их до закрытия и перепроверки, контролировать недопущение роста технического долга безопасности
— Строить и поддерживать модели угроз по закрепленным сервисам
— Составлять рекомендации по улучшению автоматических сканеров анализа уязвимостей совместно с DevSecOps
— Анализировать уязвимости по программе bug bounty: триаж, оценка, рекомендации
— Оказывать помощь младшим специалистам команды, участвовать в их обучении и передаче экспертизы
Требования:
— Коммерческий опыт работы в AppSec / анализе защищённости от 5 лет
— Глубокие знания web-технологий, понимание архитектуры микросервисных приложений
— Понимание природы уязвимостей из OWASP Top 10 и OWASP Mobile Top 10 и умение их эксплуатировать
— Умение работать с инструментами: nmap, BurpSuite, ZAP, MSF, SQLmap, nuclei, mobsf, gobuster и другими, способность объяснить их работу в боевом режиме
— Опыт построения моделей угроз (STRIDE / threat modeling) и ревью архитектуры
— Опыт анализа кода с точки зрения безопасности хотя бы на одном из распространенных стеков
— Опыт тестирования на проникновение веб-приложений, мобильных приложений и API от 3 лет
— Знания принципов работы средств защиты информации (WAF и решений на уровне сервиса)
— Умение обходить защиту на уровне приложений и средств защиты информации
Преимущества:
— Опыт работы в e-commerce, fintech или маркетплейсах (понимание рисков платежей, авторизации, бонусных систем, программ лояльности)
— Понимание инфраструктурных уязвимостей
— Навыки работы со скриптами (Python, Bash) для автоматизации тестов
— Наличие профильных сертификатов
— Успешный опыт участия в CTF
— Высшее образование в сфере ИБ или ИТ
Условия:
— Аккредитованная IT-компания, развивающая один из ТОП-10 крупнейших интернет-магазинов страны
— Персональное предложение по заработной плате и официальное трудоустройство
— Гибридный формат работы
— Помощь карьерного консультанта для выбора индивидуального направления развития
— Широкий социальный пакет со стоматологией, компенсация питания в офисе, скидки и бонусы от партнеров
— Современное оборудование для работы
— Стильный и уютный офис в центре Екатеринбурга и Москвы
— Корпоративная культура, уважение индивидуальности, отсутствие дресс-кода
— Изучение английского языка, компенсация обучений и развитие в онлайн-университете
О компании и команде
Страховая Группа «СОГАЗ», один из крупнейших в России страховщиков федерального уровня, предлагает присоединиться к высокопрофессиональной команде специалистов, обладающей уникальным для рынка опытом, знаниями и технологиями. Блок ИБ в СОГАЗ активно развивается. Мы создаем новые решения, которые делают нашу работу более технологичной и эффективной. В настоящее время мы находимся в поиске опытного специалиста по безопасности кода.
Задачи:
— развивать цикл и процессы безопасной разработки (S-SDLC) в части статического анализа Web приложений (процессы, автоматизация);
— обеспечивать защиту разрабатываемых и используемых приложений компании;
— проводить аудиты безопасности разрабатываемых сервисов (ручной анализ, статический анализ кода, поиск секретов);
— принимать участие в проектировании безопасной архитектуры разрабатываемых продуктов;
— формировать и формализовывать требования безопасности для продуктов;
— консультировать разработчиков и контролировать устранение выявленных уязвимостей;
— разрабатывать, внедрять и сопровождать системы и процессы информационной безопасности в части статического анализа кода и поиска уязвимостей;
— проводить обучение сотрудников требованиям информационной безопасности в части разработки
Требования:
— умение самостоятельно выявлять уязвимости в Web приложениях;
— понимание циклов CI/CD (Gitlab-CI) и DevOps;
— понимание принципа работы и настройки правил и инструментов статического анализа Web приложений;
— экспертное знание Client-Side и Server-Side уязвимостей (OWASP TOP-10 и немного больше);
— понимание хотя бы одного языка программирования (в приоритете Java и Python);
— понимание принципов работы систем аутентификации и авторизации (PKI, LDAP, OAuth, SAML, 2FA);
— знание Bash, Docker, Python или Go;
— умение читать код и выявлять ошибки;
— опыт работы со сканерами уязвимостей (Burp Suite, OWASP ZAP).
Будет плюсом:
— наличие репортов о найденных уязвимостях в программах Bug Bounty;
— наличие профильных сертификатов (OSCP, OSWE, CDP и т.д.);
— наличие зарегистрированных CVE;
— опыт выступления на профильных конференциях и написания профильных статей
Условия:
— оформление полностью в соответствии с ТК РФ;
— ДМС со стоматологией в лучших клиниках страны;
— премиальные условия на все виды страхования в «СОГАЗе» для вас и близких родственников;
— собственный фитнес-центр в офисе в центре Москвы (оборудование Milon для «умных» тренировок);
— возможность проходить внешнее обучение после успешного прохождения испытательного срока, а также обучаться на курсах корпоративного портала;
— скидки в детские лагеря и подарки на Новый год для детей сотрудников;
— реальные возможности профессионального и карьерного роста;
— настрой на долгосрочное сотрудничество;
— возможность работать гибридно (офис в пешей доступности от м. Чистые пруды).
Задачи:
- Разрабатывать нагруженные бэкенд-приложения
- Участвовать в проектировании внутренней архитектуры приложений и код-ревью
- Разрабатывать unit-тесты
- Прорабатывать метрики в приложении для настройки мониторинга и алертинга
- Участвовать в системном анализе
- Участвовать в проработке и принятии архитектурных решений
Требования:
- Коммерческий опыт разработки на Go: конкурентность, тестирование, профилирование
- Понимание внутреннего устройства macOS и Linux: процессы, сетевой стек, файловые системы, механизмы безопасности
- Умение работать с бинарными данными, парсить системные логи, анализировать память
- Знание сетевых протоколов и методов обеспечения безопасности: TLS, mTLS, криптография
- Опыт командной работы, умение общаться с техническими командами
Будет плюсом:
- Опыт работы с системными вызовами, низкоуровневыми API macOS (IORegistry, XPC, EndpointSecurity) и Linux (inotify, procfs, seccomp, eBPF)
- Опыт с eBPF для мониторинга системных событий, опыт создания резидентных приложений, знание разработки под macOS (Sandboxing, Notarization)
Location: Belgrade, Serbia
Workplace: hybrid
Are you ready to join our digital revolution journey?
At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.
Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.
With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career.
Role Purpose
As Audit & Compliance Manager, Europe, you will be the primary owner of audit readiness and tax regulatory compliance across all Europe entities. You will set the standard, structure and cadence for how the region prepares for and manages statutory audits, global group audits, and tax authority engagement — working through the local reporting teams and external accountants who handle data preparation, review and submission, rather than performing that work yourself. Your role is to define how things get done, ensure consistent quality across every market, and be the region's face in front of auditors and tax authorities.
What Makes This Role Different:
Build, don't just maintain.
You're stepping into a newly created position with a mandate to design the region's audit and compliance approach from the ground up — not inherit a fixed process.
Full regional ownership.
This role spans the entire Europe region.
High visibility, real stakes.
You'll be the direct point of contact with external auditors and tax authorities on some of the company's most sensitive matters, with senior leadership relying on your judgment.
A technology-forward environment.
The business is actively investing in automation, AI and dashboarding to modernize reporting — you'll be expected to bring ideas here, not just adopt what's handed to you.
Cross-functional reach.
You'll work closely with the Tax, Transfer Pricing and Legal teams, and directly with hub-entity finance teams, on issues spanning VAT, customer transactions and company-wide reviews.
What You'll Do:
1. Statutory & Global Audit Leadership
Audit Lifecycle Ownership:
Lead the end-to-end process for local statutory audits and global group audits across all 23 countries — planning, coordinating PBC (Provided by Client) lists, and driving on-time sign-off.
External Auditor Relationship:
Act as the primary regional point of contact for audit firms, owning timelines and resolution of open items.
Consolidation Alignment:
Ensure local statutory filings align with Global/Group reporting timelines (IFRS/US GAAP/local GAAP) for a seamless audit process.
Pre-Audit Structuring:
Work with local teams ahead of each audit cycle to define what needs to be prepared and how — so the region walks into every audit with a consistent, proactive structure rather than reacting to auditor requests.
2. Tax Governance & Regulatory Compliance
Filing Oversight:
Ensure accurate, on-time submission across VAT, Withholding Tax (WHT), Corporate Income Tax, and country-specific statistical and national bank reporting — delivered through local reporting teams and external accountants, with you owning quality and timeliness.
Tax Team Liaison:
Standardize and oversee submission of supporting data to the central Tax team; ensure schedules provided for assessments are reconciled and audit-ready.
Notice & Assessment Management:
Proactively manage tax notices and audits, coordinating evidence-gathering and working with the Tax team to ensure timely, well-supported responses.
Corporate Secretarial Support:
Oversee annual filings and coordinate with Legal on board meeting minutes (financial aspects) and other local regulatory requirements.
3. Process Improvement & Digital Transformation
Root Cause Analysis:
Identify recurring audit adjustments or tax queries and implement structural fixes to eliminate them at the source.
Internal Controls:
Strengthen the control environment across the region to minimize audit findings.
Technology & Automation:
Identify and champion tools — including AI and dashboarding — to reduce manual work and increase consistency across the region's reporting.
What We're Looking For:
Mindset & Soft Skills (critical to this role)
A challenger, not a process-follower — someone who questions how things are done today and proposes a better way, rather than simply executing an existing playbook.
Comfortable operating in a fast-moving, high-volume, occasionally chaotic environment, and energized rather than fatigued by it.
Strong communicator and team player who can build trust quickly across Tax, Legal, Transfer Pricing and local finance teams.
Strategic mindset with the ability to zoom out across markets while staying close enough to the detail to be credible with auditors and tax authorities.
Experience & Technical Skills
Currently operating at Manager level (or equivalent) within an audit firm or a multinational's in-house compliance/audit function — this is not a developmental hire.
10–12+ years of post-qualification experience, with hands-on exposure to multi-country compliance in Europe.
Chartered Accountant (CA), CPA, or ACCA qualification.
Solid working knowledge of IFRS, European tax regulations, and Transfer Pricing fundamentals.
Advanced proficiency with Tier-1 ERP systems (SAP, Oracle, or NetSuite).
Fluent English, written and spoken — required given daily interaction with regional and global stakeholders.
Strong project management and negotiation skills, with the ability to work confidently across time zones and cultures.
#ALEPH
Why Join Us?
Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.
We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.
#ALEPH
ГибридFoster City, CA
230 000 – 360 000 $
ГибридSofia, Bulgaria; Strong project management and negotiation skills, with the ability to work confidently across time zones and cultures
Зарплата не указана
Не хотите искать каждый день?
Настройте подбор один раз, и подходящие вакансии будут сами приходить в Telegram.
Настройте подбор, и подходящие вакансии будут приходить в Telegram.
