Вакансии

Location: Tel Aviv-Yafo, Tel Aviv District, Israel About Aidoc Aidoc is the market leader in healthcare AI and has developed the world's largest clinical frontier model, supporting nearly 50 million patients each year. Aidoc is deployed in more than 2,000 medical centers worldwide. Since our founding in 2016, Aidoc has raised over $500 million and achieved a record number of FDA-cleared solutions. Medical diagnosis is hitting a breaking point, where the number of physicians hasn't kept up with the rapidly growing patient load. This leads to misdiagnosis and treatment delays that result in hundreds of thousands of deaths every year. Aidoc assists clinicians by precisely highlighting diseases directly on medical images, preventing misdiagnosis and ensuring that urgent patients receive the immediate attention they need. About this role As a SecOps Engineer, you will help protect Aidoc’s cloud environments, products, corporate systems, and sensitive healthcare data by investigating SIEM alerts, supporting incident response, and improving the quality of security monitoring and operations. This is a hands-on security operations role for someone who can analyze security signals, understand real risk, communicate clearly, and help the organization detect, investigate, and respond quickly and effectively to security events. You will work closely with real production environments, where accurate investigation, clear documentation, and practical escalation are critical to protecting sensitive healthcare data, customer trust, and the reliability of Aidoc’s clinical AI platform. Responsibilities Own the end-to-end investigation of SIEM alerts across cloud, product, identity, endpoint, and SaaS environments: analyze the relevant evidence, separate false positives from real threats, and prioritize cases based on risk and impact. Escalate high-risk findings with a clear summary of what happened, what is affected, why it matters, and what actions are required. Support incident response by collecting evidence, assisting with containment, tracking remediation, and maintaining clear investigation records for internal reviews, compliance needs, and post-incident learning. Improve SIEM rules, dashboards, alert logic, playbooks, telemetry coverage, and detection quality to reduce noise and strengthen security monitoring. Work with Security, IT, DevOps, R&D, Product Security, and Compliance teams to resolve issues and improve security operations. Requirements 2+ years of experience in Security Operations, SOC analysis, detection and response, incident response, cloud security operations, or a similar hands-on security role. Hands-on experience with SIEM-based investigations, including alert triage, log analysis, event correlation, evidence review, case prioritization, and escalation. Experience working with security telemetry from cloud platforms, identity providers, endpoints, SaaS systems, network tools, application logs, and production environments. Familiarity with cloud-native environments, including IAM, storage access, workloads, Kubernetes, containers, APIs, logging, monitoring, and CI/CD pipelines. Understanding of common attack techniques, including credential compromise, phishing, privilege escalation, suspicious API activity, malware, data exposure, lateral movement, and cloud misconfigurations. Experience with identity and endpoint investigation, including SSO, MFA, service accounts, privileged access, EDR alerts, and suspicious user or device activity. Ability to use query or scripting languages such as KQL, SPL, SQL, Python, Bash, or similar. Familiarity with incident response workflows, case management, evidence collection, remediation tracking, and post-incident review. Strong analytical judgment, with the ability to separate false positives from real risk and explain findings clearly. Ability to work independently, document investigations clearly, and escalate issues with the right level of urgency. Strong communication skills and the ability to work with Security, IT, DevOps, R&D, Product Security, Compliance, and business stakeholders. Close attention to detail, strong ownership, and comfort working in a fast-moving production environment. Additional Strengths Experience in healthcare, healthtech, medical devices, digital health, or regulated software environments. Familiarity with HIPAA, GDPR, SOC 2, ISO 27001, NIST CSF, or similar security and privacy frameworks. Familiarity with MITRE ATT&CK, detection logic, attacker behavior, and investigation playbooks. Experience with threat hunting, detection engineering, malware analysis, forensics, or advanced incident response. Experience with SOAR platforms, case management systems, threat intelligence feeds, detection-as-code, or SOC automation. Experience improving SOC metrics such as alert noise, false-positive rate, time to triage, time to escalation, and investigation quality. Experience working with sensitive data, PHI/PII, customer-facing environments, or audit-ready evidence collection. Working at Aidoc Our Perks: Be part of something big - using cutting-edge technologies to transform the Healthcare industry (while saving patients’ lives) We work in a hybrid model, with our new offices located at 34 HaMasger Street in Tel Aviv and parking for employees. Amazing and healthy breakfasts and lunches prepared daily by our personal chef! Stocked up kitchen & meal card Wellness: Aidoc employees-only gym, plus Pilates, Yoga, and functional workouts classes. Amazing culture - collaborative, transparent & fun! Attractive compensation package & benefits Aidoc is deeply committed to creating an inclusive workplace, and to the principle of equal opportunity for all individuals. We prohibit discrimination and harassment based on race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other status protected by law.

Location: Dubai, United Arab Emirates; Riyadh, Saudi Arabia; Amman, Jordan; Bucharest, Romania; Delhi, India Summary We are looking for a Senior ServiceNow SecOps QA Consultant to ensure the quality of ServiceNow Security Operations implementations. You will plan and run functional, integration and regression testing across SecOps modules and integrations, and build test automation using the ServiceNow Automated Test Framework (ATF). ⚠️ Must Have: Hands-on QA/testing experience on ServiceNow, including SecOps modules (SIR and/or VR). Onsite in Dubai. Responsibilities Create test strategies, test plans and test cases for ServiceNow SecOps implementations. Run functional, integration, regression, and user acceptance testing across SIR, VR and related modules. Test integrations between ServiceNow and security tools (SIEM, vulnerability scanners, EDR), including data flows and automated actions. Build and maintain automated tests using the ServiceNow Automated Test Framework (ATF). Validate security workflows, playbooks, SLAs, assignment rules, notifications and access controls (roles, ACLs). Log, track and manage defects, and work with developers to resolve them. Perform regression testing for ServiceNow upgrades, patches and releases. Support UAT with business and security teams and prepare test reports. Ensure test coverage of requirements and maintain testing documentation. Improve QA processes and best practices across the project. Requirements 6+ years of QA/testing experience, including significant experience testing ServiceNow. Must: Hands-on testing experience on ServiceNow SecOps modules (SIR and/or VR). Strong experience with the ServiceNow Automated Test Framework (ATF). Experience testing integrations (REST/SOAP APIs), ideally with security tools. Good understanding of security operations processes: incident response and vulnerability management. Experience with test and defect management tools (Jira, ServiceNow Test Management, Azure DevOps). Experience working in Agile environments. Bachelor’s degree in IT, Computer Science or a related field. Nice to Have ServiceNow certifications: CSA, CIS – Security Incident Response, CIS – Vulnerability Response. Testing certifications (ISTQB Foundation or Advanced). Experience with other automation tools (Selenium, Tricentis Tosca, Postman). Experience in banking, government or other regulated sectors in the UAE/GCC.

Location: Dubai, United Arab Emirates; Riyadh, Saudi Arabia; Amman, Jordan; Delhi, India; Bucharest, Romania Summary We are looking for a Senior ServiceNow SecOps Technical Consultant to design, configure and implement ServiceNow Security Operations solutions. You will build and customise SecOps modules, integrate ServiceNow with security tools, and make sure the platform supports the client’s security operations effectively. ⚠️ Must Have: Hands-on technical implementation experience with ServiceNow SecOps (Security Incident Response and/or Vulnerability Response). Onsite in Dubai. Responsibilities Design, configure and implement ServiceNow SecOps modules: Security Incident Response (SIR), Vulnerability Response (VR), Configuration Compliance and Threat Intelligence. Develop customisations using JavaScript, Business Rules, Script Includes, Client Scripts, UI Policies and Flow Designer. Build and maintain integrations with security tools: SIEM (Splunk, QRadar, Sentinel), vulnerability scanners (Qualys, Tenable, Rapid7) and EDR (CrowdStrike, Microsoft Defender). Configure security playbooks, workflows, assignment rules, SLAs and automated response actions. Make sure the CMDB is properly set up and populated to support vulnerability and incident correlation. Build dashboards, Performance Analytics and reports for security operations. Translate business requirements into technical designs with Business Analysts. Support testing, deployment, upgrades and post-go-live support. Follow ServiceNow best practices for performance, security and upgradeability. Mentor junior developers and create technical documentation. Requirements Requirements 6+ years of ServiceNow development/implementation experience. Must: Hands-on implementation experience with ServiceNow SecOps (SIR and/or VR). Strong ServiceNow scripting skills: JavaScript, Glide API, Business Rules, Script Includes, Client Scripts. Experience with IntegrationHub, Flow Designer, REST/SOAP APIs, MID Server and security integration spokes/plugins. Good knowledge of the CMDB and its role in SecOps. Understanding of security operations: incident response, vulnerability management, threat intelligence. Experience integrating ServiceNow with SIEM, vulnerability scanners and EDR tools. Bachelor’s degree in IT, Computer Science, Information Security or a related field. Nice to Have ServiceNow certifications: CSA, CAD, CIS – Security Incident Response, CIS – Vulnerability Response. Experience with Security Posture Control, Configuration Compliance or Threat Intelligence. Security certifications (Security+, CEH, CISSP). Experience in banking, government or other regulated sectors in the UAE/GCC.

Location: Dubai, United Arab Emirates; Riyadh, Saudi Arabia; New Delhi, India; Amman, Jordan; Bucharest, Romania ummary We are looking for a Senior ServiceNow SecOps Business Analyst to lead requirements gathering and process design for ServiceNow Security Operations (SecOps). You will work closely with security teams, SOC analysts and technical consultants to turn security processes into effective ServiceNow solutions across Security Incident Response, Vulnerability Response and related modules. ⚠️ Must Have: Hands-on business analysis experience on ServiceNow Security Operations (SecOps) implementations. Onsite in Dubai. Responsibilities Run workshops with security, SOC and IT stakeholders to gather and document business requirements. Analyse current security processes and design future-state workflows in ServiceNow SecOps. Write clear user stories, acceptance criteria, process flows and functional specifications. Map requirements to ServiceNow SecOps capabilities: Security Incident Response (SIR), Vulnerability Response (VR), Configuration Compliance and Threat Intelligence. Work with technical consultants and developers to make sure solutions meet business needs. Support integration requirements with security tools (SIEM, vulnerability scanners, EDR). Define security KPIs, SLAs, dashboards and reporting requirements. Support UAT planning and execution, training and change management. Manage the backlog and prioritise requirements with product owners. Act as the main link between business, security and technical teams. Requirements 6+ years of experience as a Business Analyst, including significant experience on ServiceNow. Must: Hands-on business analysis experience on ServiceNow SecOps (SIR and/or VR) implementations. Strong understanding of security operations processes: incident response, vulnerability management, threat intelligence, SOC workflows. Knowledge of security frameworks such as NIST, ISO 27001 and MITRE ATT&CK. Experience writing user stories and functional specifications in Agile environments (Jira, ServiceNow Agile). Familiarity with security tools such as Splunk, QRadar, Microsoft Sentinel, Qualys, Tenable, Rapid7 or CrowdStrike. Excellent communication, workshop facilitation and stakeholder management skills. Bachelor’s degree in IT, Computer Science, Information Security or a related field. Nice to Have ServiceNow certifications: CSA, CIS – Security Incident Response, CIS – Vulnerability Response. Business analysis certifications (CBAP, CCBA, PMI-PBA). Experience in banking, government or other regulated sectors in the UAE/GCC. Arabic language skills.

Location: US Remote Workplace: Remote Synthesia is the world’s leading AI video platform for business, used by over 90% of the Fortune 100. Founded in 2017, the company is headquartered in London, with offices and teams across Europe and the US. As AI continues to shape the way we live and work, Synthesia develops products to enhance visual communication and enterprise skill development, helping people work better and stay at the center of successful organizations. Following our recent Series E funding round, where we raised $200 million, our valuation stands at $4 billion. Our total funding exceeds $530 million from premier investors including Accel, NVentures (Nvidia's VC arm), Kleiner Perkins, GV, and Evantic Capital, alongside the founders and operators of Stripe, Datadog, Miro, and Webflow. Location: Remote (US East Coast/Central) As our team and customer base grow, we need to make sure our security efforts scale accordingly. For that, we are looking to expand the Synthesia Infosec team by onboarding an additional Security Engineer (L6)! You will report to the Head of Security and work within the Security Operations team. KEY RESPONSIBILITIES: - Build and own deeply technical security improvements across our Cloud Infrastructure(s) and associated territory (AWS/GCP, Kubernetes, CI/CD), including shipping production changes yourself when needed. - Design, implement, and iterate on detection and response capabilities (SIEM, EDR/MDR, cloud-native detections, CNAPP) with an engineer’s bias for automation, reliability, and measurable outcomes. - Hunt, investigate, and respond to security alerts and suspicious activity end-to-end (triage → containment → eradication → recovery → learnings), including writing tooling and detection logic to prevent recurrence. - Build internal security tooling and automations (IaC, scripts, integrations) that reduce toil and raise the security bar by default. EXPERIENCE & QUALIFICATIONS: - You’re a deeply technical security engineer with a builder/hacker mindset, able to go from idea → prototype → production and comfortable making changes directly in Cloud Infra / DevOps systems. - You have 5+ years of hands-on security engineering experience, ideally in a cloud-first SaaS environment. - Have worked in a fast-growing startup, scale-up and/or SaaS company WE WOULD EXPECT YOU TO HAVE EXPERIENCE IN: - Cloud security engineering in AWS and/or GCP, with the ability to implement improvements hands-on (IAM, networking, compute, storage, logging). - Kubernetes security (cluster hardening, workload isolation, runtime security, policy controls) and container ecosystems. - DevOps fundamentals: CI/CD security, secrets management, artifact integrity, and secure-by-default platform patterns. - Incident response and investigation, including creating repeatable playbooks and automating response where appropriate. - Strong programming/scripting ability (Python or similar) plus comfort with infrastructure-as-code (e.g., Terraform) and automation. - Serious agent coding - ideally you’re on the bleeding edge in the space. - Endpoint security tooling, such as CrowdStrike Bonus points for: - Hands on experience with any/all of: Hunters, Wiz, Falcon, Tracebit, Torii, Okta, Google Workspace, StrongDM, Github, StepSecurity, Dope Security - Any relevant Information Security certification, e.g AWS Certified Security, GIAC GWEB, OSCP, or CSSLP. THE GOOD STUFF.. In addition to being a part of a great team, working in a fun and innovative environment, we offer: - A competitive salary + stock options in our fast-growing Series E startup - Remote-friendly environment - 100% Medical, Dental & Vision - 401k Plan - Paid parental leave - 25 days of annual leave + Public holidays + paid sick leave - Fun culture with regular socials - A generous referral scheme - A brand new computer + monitor - Budget and support for conference travel, community events, and content production

Location: Paris, Remote Workplace: remote Our Security and IT team keeps the 360Learning platform secure, compliant and auditable for the 1,500 organisations that learn on it every day. As a Senior DevSecOps Engineer, your mission is to make our infrastructure secure by design, detectable by default, and provable at audit time. 360Learning runs its learning platform on Azure and Kubernetes, certified ISO 27001:2022 and SOC 2 Type II. Over the past two years the technical security workload has grown on every front: a larger and more regulated customer base sending their own scans and security assessments, a wider detection and response scope, more infrastructure to keep hardened and auditable, and a growing backlog of security engineering projects that never reach the top of the queue. We are creating this position to add real technical capacity on the infrastructure side of security, and to move part of our security posture from manual effort to automated guardrails. You will be the bridge between security and platform engineering: deep enough in infrastructure to fix things yourself, and close enough to security operations to know what to look for. “Ours is a small, senior team with a broad scope: information security, compliance, infrastructure governance and internal tooling, with dual audit accountability on ISO 27001:2022 and SOC 2 Type II. That means direct impact and no layers between you and the decision. Roughly half of this role is greenfield build work you will own end to end.” Guillaume Seigneuret, CISO and Hiring Coach. Within 1 month, you will: Complete our onboarding and learn how we work through our own platform and our Convexity culture Map our Azure and AKS environment, our detection and logging coverage, and our ISO 27001 and SOC 2 control scope with the CISO and the Security Engineer Meet the DevOps, platform engineering and IT teams you will work with daily Shadow alert triage and one customer security assessment end to end Within 3 months, you will: Be autonomous on our AKS and Azure environment and handle infrastructure related alerts end to end Have shipped at least one concrete hardening or automation improvement in production Own the infrastructure scope of vulnerability management, from triage to remediation follow up Within 6 months, you will: Have the honeypot live and producing high fidelity alerts Have measurably widened SIEM connector coverage, with documented log sources and retention Run infrastructure vulnerability remediation on a predictable cycle with SLA reporting Within 12 months, you will: Manage detection content as code, with reviewed and tested rules and documented runbooks Have largely automated audit evidence on the infrastructure scope Have eliminated long lived credentials on the critical paths, so engineering teams ship on secure defaults they did not have to think about The Skill Set: 5+ years in infrastructure, cloud or platform engineering with a strong security focus, or in security engineering with hands on infrastructure practice Production experience with Kubernetes: RBAC, network policies, admission controllers, secrets handling, workload identity, runtime security Solid cloud experience, ideally Azure. Strong AWS or Google Cloud experience with a genuine interest in converting works too Infrastructure as code: Terraform, GitOps workflows, CI/CD pipelines Scripting and automation: Python or Go, plus shell. Comfortable reading and writing code, and opening pull requests on repositories owned by other teams Log analysis and investigation: cloud audit logs, query languages, correlation across identity, network and application sources Fluent English (US/UK) / B2 level or equivalent (FR). Enthusiasm for our working environment explained here: https://bit.ly/Convexity360L What we offer: Compensation: Package includes base salary, a variable component and equity 📈 Benefits/Perks : Work From Home stipend, RTT, lunch vouchers, medical insurance, gym subscription, 1 month parental leave for the second parent. Balance: Flexible hours, full remote work possible anywhere in France 🏠 Diversity, Equity, and Inclusion : We have 6 active ERGs including Mental Health, Environmental/Sustainability, Women, Parents, LGBTQIA2S+, and Ethnic Diversity. Each group has at least one executive team member serving as a member of the group, bringing greater awareness to each group’s activities and providing a quick path to impact 🤝 Corporate Social Responsibility : Review our CSR Charter: 360learning.com/blog/corporate-social-responsibility-charter 🌎🌏🌍 Culture: A framework that will help you make an impact - envision our way of working and our Convexity Culture: https://bit.ly/Convexity360L & find out more about the teams, product and processes https://bit.ly/42H1ggC 🚀👩🏻‍💻🏆 Interview Process: Phone Screen with our Talent Acquisition Manager Discovery Meeting with our Head of Security Live exercise with our Head of Security and our Head of Devops: investigation of an incident scenario, or review of an insecure infrastructure configuration Clarification Meeting with the Security Engineer and a DevOps engineer Culture Fit Meeting with our VP of Engineering Offer! Who We Are 360Learning enables companies to upskill from within by turning their experts into champions for employee, customer, and partner growth. With our LMS for collaborative learning, Learning & Development teams can accelerate upskilling with the help of internal experts instead of slow top-down training. 360Learning is the easiest way to onboard and upskill employees, train customer-facing teams, and enable customers and partners–all from one place. 360Learning powers the future of work at 1,700 organizations. Founded in 2013, 360Learning has raised $240 million with 400+ team members across North America and EMEA. Learning Includes Everyone. In concert with our culture, 360Learning believes learning includes everyone and that means embracing the strengths of diversity, connectedness, and inclusion. Through conscientious efforts, our global footprint celebrates cultures, perspectives, and experiences from all over the world to support our platform that is built for all regardless of race, ethnicity, gender identity or expression, sexual orientation, religion, age, neurodiversity, disability status, citizenship, veteran status or any other aspect which makes an individual unique or protected by laws and regulations in the locations where we operate. Thus, 360Learning is proud to be an equal opportunity workplace, and we commit to continue this throughout our processes for recruitment, compensation, benefits, performance, promotion, and all other conditions and terms of employment. We want to learn from and with you!

Location: Remote - Americas Who We Are: Alpaca is a US-headquartered, global leader in agent-first brokerage infrastructure for stocks, ETFs, options, crypto, fixed income, 24/5 trading, and more. Amongst our subsidiaries, Alpaca is a licensed financial services company, serving hundreds of financial institutions across 40 countries with our institutional-grade APIs. This includes broker-dealers, investment advisors, wealth managers, hedge funds, and crypto exchanges, totalling over 10 million brokerage accounts. Our global team is a diverse group of experienced engineers, traders, and brokerage professionals who are working to achieve our mission of opening financial services to everyone on the planet. We're deeply committed to open-source contributions and fostering a vibrant community, continuously enhancing our award-winning, developer-friendly API and the robust infrastructure behind it. Alpaca is proudly backed by $400 million in funding from top-tier global investors including Portage Ventures, Spark Capital, Tribe Capital, Social Leverage, Horizons Ventures, Opera Tech Ventures, SBI Group, Derayah Financial, Unbound, Peak XV, Elefund, and Y Combinator. Our Team Members: We're a dynamic team of 400+ globally distributed members who thrive working from our favorite places around the world, with teammates spanning the USA, Canada, Japan, Hungary, Nigeria, Brazil, the UK, and beyond! We're searching for passionate individuals eager to contribute to Alpaca's rapid growth. If you align with our core values—Stay Curious, Have Empathy, and Be Accountable—and are ready to make a significant impact, we encourage you to apply. Your Role: We are seeking a Security Operations Engineer to own the daily operation and continuous improvement of Alpaca’s SIEM and SOAR capabilities. You will onboard security logs, develop and tune detections, keep alerts actionable, maintain operational dashboards, and automate repeatable response actions. You will be hands-on and operationally minded. You will keep log onboarding, detection quality, and alert handling consistent, and you will turn security signals into action as the business grows. This role reports to the Enterprise Security Architect and works closely with Security, IT, DevOps, and Engineering. The Security Team is 100% distributed and remote. Things You Get To Do: The core responsibilities of the Security Operations Engineer are focused on detection, response automation, operational excellence, and cross-functional coordination. SIEM Operations and Detection Engineering: Log Onboarding: Onboard new security log sources across cloud, identity, endpoint, SaaS, and application systems, including parsing, normalization, and data quality checks. Detection Development: Build, test, and tune detection rules based on threat intelligence, incident learnings, and emerging attack techniques, mapped to frameworks such as MITRE ATT&CK. Alert Quality: Tune, enrich, and manage the lifecycle of detections so alerts stay actionable. Detection Coverage: Maintain detections for critical systems and priority attack techniques. Operational Dashboards: Build and maintain dashboards for alert volume, ingest health, and response status. Incident Response & Metrics: Incident Support: Support security incidents with evidence collection, detection queries, and containment actions, working with IT, Engineering, and external partners. Runbooks: Develop and improve alert-handling and incident response runbooks and escalation paths. Operational Metrics: Track and report security operations metrics, including mean time to detect (MTTD) and mean time to respond (MTTR). On-Call: Participate in the Security Operations on-call rotation after onboarding and cross-training. SOAR and Response Automation: Playbooks: Design, build, and maintain SOAR playbooks that automate repeatable response actions, including enrichment, containment, ticketing, and notification. Triage and Investigation: Triage, investigate, and respond to security alerts across endpoints, identity, cloud, network, and application logs. Threat Hunting: Run hypothesis-driven hunts based on threat intelligence and incident learnings, and turn findings into new detections. Who You Are (Must-Haves): Excited about Alpaca’s mission and what we’re building 3+ years of experience in Security Operations or detection engineering roles Hands-on experience operating and tuning a SIEM Experience building SOAR playbooks or equivalent response automation Working with Linux Scripting or automation experience (Python, Bash) for security operations tasks Experience onboarding and parsing log sources from cloud, identity, and SaaS platforms Strong alert investigation skills across identity, endpoint, network, and cloud environments Understanding of common attacker techniques and detection methodologies Experience supporting security incidents, including evidence collection, detection queries, and containment Willing to participate in an on-call rotation Strong written and verbal communication skills, especially during incidents Comfortable working cross-functionally and handling escalations calmly and decisively Who You Might Be ( Nice-to-Haves): Experience securing financial, trading, or other highly regulated platforms Familiarity with compliance frameworks such as SOC 2 or ISO 27001 Experience with detection-as-code, GitOps, and CI/CD pipelines Knowledge of cloud security logging (AWS/GCP/Azure) and SaaS security telemetry Familiarity with Kubernetes-hosted security tooling Experience working with a managed SOC or MSSP Security certifications (GCIA, GCIH, GCED, or similar) Ability to balance security rigor with operational efficiency and business needs How We Take Care of You: Competitive Salary & Stock Options Health Benefits New Hire Home-Office Setup: One-time USD $500 Monthly Stipend: USD $150 per month via a Brex Card Alpaca is proud to be an equal opportunity workplace dedicated to pursuing and hiring a diverse workforce. Recruitment Privacy Policy

Location: Cluj-Napoca, Romania; Bucharest, Romania; Bucuresti, Romania; Belgrade, Serbia; Chișinău, Moldova, Republic of; Tiraspol, Moldova, Republic of; Sofia, Bulgaria; Erevan, Armenia; Almaty, Kazakhstan; Astana, Kazakhstan; Budapest, Hungary; Miskolc, Hungary; Bryanston, South Africa; Cape Town, South Africa; Johannesburg, South Africa; Aya Napa, Cyprus; Larnaca, Cyprus; Limassol, Cyprus; Nicosia, Cyprus; Paphos, Cyprus; Paralimni, Cyprus; Amman, Jordan; Alexandria, Egypt; Cairo, Egypt; Lebanon; Dnipro, Ukraine; Kharkiv, Ukraine; Kyiv, Ukraine; Lviv, Ukraine; Sambir, Ukraine; Odesa, Ukraine; Berat, Albania; Batumi, Georgia; Cebu City, Philippines; Ljubljana, Slovenia; Manila, Philippines; Sarajevo, Bosnia and Herzegovina; Singapore; Skopje, North Macedonia; Banská Bystrica, Slovakia; Tbilisi, Georgia; Zagreb, Croatia; Davao City, Philippines; Iloilo City, Philippines; Makati, Philippines; Quezon City, Philippines; Taguig, Philippines; Ahmedabad, India; Pondicherry, India; Delhi, India; Fatorda, India; Hyderabad, India; Bangalore, India; Jakarta, Indonesia; Mumbai, India; Sahibzada Ajit Singh Nagar (Mohali), India; Kuala Lumpur, Malaysia; Bangkok, Thailand; Ho Chi Minh, Vietnam Workplace: remote At TechBiz Global, we are providing recruitment service to our TOP clients from our portfolio. We are currently seeking a Detection & Response Engineer to join one of our clients' teams. If you're looking for an exciting opportunity to grow in a innovative environment, this could be the perfect fit for you. Key Responsibilities: Investigate security cases and targeted hunts using CrowdStrike Falcon Next-Gen SIEM and CQL; correlate telemetry, assess scope and impact, document findings, and recommend appropriate actions. Develop, test, deploy, tune, and maintain detection logic, queries, dashboards, analyst guides, and version-controlled detection content. Build and maintain Falcon Fusion SOAR workflows for enrichment, evidence capture, routing, escalation, and authorized response. Validate telemetry coverage and quality; troubleshoot parsing, normalization, mapping, and source-data issues. Translate validated investigations into platform workflow specifications and co-build scripts, API integrations, workflow components, and prototypes with Product and Engineering. Test workflows and detections against representative cases; monitor outcomes, exceptions, and production feedback, and document ownership and support handoffs. Provide technical support, troubleshooting, knowledge transfer, and coaching; coordinate assigned analysis and platform work. Must have: 5+ years of relevant security experience, including at least 2 years developing, testing, and tuning detection logic, or equivalent demonstrated capability. Production proficiency with CrowdStrike Falcon Next-Gen SIEM, including CQL, cross-source investigations, detection content, telemetry interpretation, and tuning. Hands-on Falcon Fusion SOAR workflow experience and practical use of Charlotte AI with evidence verification and awareness of approval boundaries. Practical Python, REST/Falcon APIs, JSON, authentication, error handling, and secure credential management; familiarity with PowerShell or another relevant scripting language. Experience with telemetry onboarding, parser/normalization troubleshooting, MITRE ATT&CK, Windows/Linux events, and controlled changes, version control, peer review, and regression testing. Strong investigation judgment, defensible documentation, communication, and cross-functional collaboration skills. Nice to have: Experience converting SOC runbooks or manual analysis into production workflows or internal security platforms. CrowdStrike resident, responder, partner implementation, or customer-embedded Falcon experience; FalconPy or comparable API tooling. Experience partnering with Product and Engineering on analyst-facing features, case lifecycle integration, acceptance testing, or iterative delivery. Managed security services, multi-client or follow-the-sun SOC operations, and ITSM integrations such as ServiceNow or Jira. Relevant CrowdStrike training or credentials, GIAC invest

You’ve got the spark, the curiosity that makes you ask “why?” when others move on. You love solving puzzles, learning new tools, and understanding how things work (and how they break).

Location: Kazakhstan; Serbia; Poland; Georgia Workplace: Remote 🌍 Remote | UTC+8 | Core collaboration hours: 12:00–6:00 PM Manila Time Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia, starting in the Philippines. We combine global fintech expertise with deep local market knowledge to make financial services simple, accessible, and useful for millions of people across the region. 7M+ app downloads. 2M+ monthly active users. 7,000+ partner stores. US$310M+ raised from leading global investors. Manila-based, globally distributed, and hybrid-first — our team spans 45+ countries. If you want to solve complex problems at scale and impact how millions of people access and manage money, come build with us. Southeast Asia's fintech moment starts here. ABOUT THE ROLE You'll help run and improve practical security controls across Salmon, a regulated group spanning banking, consumer finance, and a shared technology platform, and drive recurring risks to resolution. WHAT YOU'LL DO - Work across Microsoft Defender, Intune, Entra ID, Microsoft 365 and Sentinel to find security issues, judge how much they matter, and get them fixed. - Work daily with the Manager, Security Operations and with IT and engineering teams, moving issues from identification to remediation. - Take cases from the Security Service Desk, find the underlying cause, and fix recurring problems instead of closing tickets one by one. WHAT YOU'LL OWN - Own the operational side of vulnerability management: review findings, prioritise by risk, track remediation, and escalate material or overdue issues. - Own security update, patch compliance, and device configuration follow-up for corporate laptops. - Own day-to-day DLP and access controls: alert review, investigations, suspicious sign-ins, privileged access monitoring, SSO coverage, and periodic access reviews. - Run the security awareness platform and LMS: training campaigns, completion tracking, reporting, and phishing simulations. - Investigate and resolve security Service Desk cases covering endpoints, access, policy exceptions, and suspicious activity. - Improve recurring Security Operations work through better processes, KQL queries, playbooks, documentation, and lightweight automation, including Sentinel detections where useful. WHAT MAKES YOU A STRONG FIT - Hands-on experience with Microsoft Defender XDR / Defender for Endpoint, Intune, Entra ID, and Microsoft 365 security and audit telemetry - Working knowledge of Microsoft Sentinel and KQL for investigation and correlation - Experience running vulnerability management and patch compliance, including follow-up with system owners - Experience with DLP and access controls - Ability to understand the risk behind operational issues, set sensible priorities, and work independently - Track record of following problems through to resolution and documenting findings so others can act on them WHAT WE OFFER OWNERSHIP AND FLEXIBILITY - Fully remote work with core collaboration hours from 12:00 to 6:00 PM Manila time (UTC+8) - Company-provided tools and equipment HEALTH AND TIME OFF - Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits - Access to an internal mental health support specialist - 22 vacation days, Philippine public holidays, and 15 sick days GROWTH AND TEAM EXPERIENCE - Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publications - Company-sponsored trips to Manila to meet and work with your team in person - High-performing teams can earn a dedicated beach house week in Southeast Asia We believe strong teams are built by people with different backgrounds, experiences, and points of view. Salmon is an equal opportunity employer, and we make hiring decisions based on skills, experience, and potential.

Location: PL Workplace: remote Overview: Infrastructure engineering with security embedded across the entire technology stack, including CI/CD, Kubernetes, cloud environments, secrets management, and access control. Key responsibilities: Core Responsibilities Integrate security checks into CI/CD pipelines, including dependency, container image, Infrastructure as Code (IaC), and secret scanning Harden servers, Kubernetes clusters, and cloud environments in accordance with CIS benchmarks Manage secrets, certificates, and the PKI lifecycle using Vault Manage access control (SSO, IAM, least privilege) and conduct regular access reviews Track and remediate vulnerabilities, coordinating patching activities across development and infrastructure teams Support security incident investigations, incident response, audits, and compliance activities Enforce Kubernetes runtime and policy security, including RBAC, network policies, Pod Security Standards (PSS), and Kyverno/OPA Infrastructure Responsibilities Set up and maintain production and staging infrastructure, including updates and incident resolution Improve infrastructure setup and maintenance processes Support and develop GitLab CI pipelines Contribute to the design of complex IT systems Collaborate with product development teams and stakeholders Handle monitoring events, including periodic day and night on-call duties Required Experience: 3+years of experience as a System Engineer, SRE, or DevOps Engineer Solid Linux administration and troubleshooting skills Experience with configuration management tools such as Ansible, SaltStack, Terraform, or Pulumi Experience with Kubernetes and Helm Experience configuring GitLab CI/CD pipelines Experience with Anti-DDoS solutions, WAF, and WAAP (Cloudflare, Fastly, Akamai, etc.) Experience with monitoring tools (Prometheus stack, Zabbix) Strong understanding of information security fundamentals, including least privilege, defense in depth, network security, and TLS/PKI Experience with secrets management solutions such as HashiCorp Vault or similar Strong problem-solving skills Higher technical education English level B1+ and strong command of Russian Main Advantages Private health insurance Sports benefits Comprehensive Mental Health Program Free English lessons (online) Local language courses Paid time off Maternity leave support Referral program rewards Upskilling, internal workshops, and participation in professional conferences and corporate events

Location: Foster City, CA Workplace: Hybrid Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. About the role: We are looking for a SOC Engineer to join our Security Operations team and help defend a fast-moving, cloud-native AI vibe-coding platform. In this role, your primary mandate will be building and evolving our security data lake, engineering reliable security telemetry, and owning high-fidelity detection engineering end-to-end. You will unify cloud, identity, endpoint, and application telemetry, staying on top of emerging threats to rapidly build and tune detections across our environment. Alongside this data and detection mandate, you will support incident investigations as needed to translate real-world threats into stronger automated defenses. This is a hands-on engineering role requiring strong technical depth, understanding of modern software engineering and CI/CD systems, familiarity with cloud-native infrastructure (especially GCP), and expertise in security data pipelines and detection workflows. What You'll Do: - Security Data Lake & Detection Engineering: Architect, expand, and maintain our security data lake while designing, testing, and tuning custom detection rules to maximize threat coverage and minimize noise across our cloud-native stack. - Threat Awareness & Rapid Assessment: Continuously monitor emerging threats (0-days, bad actor activity, public exploitation campaigns, bug bounty reports, customer security issues) and rapidly assess their applicability to Replit's infrastructure, SaaS services, internal tools, and platform components. - Investigation & Impact Analysis: Conduct targeted investigations to determine impact, analyze logs, telemetry, and system behaviors using SIEM, metrics, and Cloud Logging and identify gaps in detection/visibility. Required Skills & Experience: - Building and evolving the security data lake, unifying cloud, identity, endpoint, and application telemetry; hands-on experience with SIEM, Cloud Logging, and log-based investigation workflows. - Engineering reliable security infrastructure and automation using infrastructure-as-code to close visibility gaps and perform log-based investigations. - Proven expertise in detection engineering end-to-end, specifically developing, testing, and tuning custom detection rules to maximize threat coverage and reduce noise across complex environments. - Strong understanding of software engineering fundamentals (code structure, build systems, dependencies, package ecosystems). - Understanding of CI/CD pipelines and DevOps workflows. - Solid knowledge of cloud architecture, especially Google Cloud Platform (GCP) services in modern cloud-native deployments. - Familiarity with SaaS architectures, identity systems, and integration patterns. Bonus Qualifications: - Experience with threat intelligence, security research, or vulnerability analysis. - Familiarity with Kubernetes, containers, serverless infrastructure, or modern distributed systems. - Ability to write scripts or small tools for investigation or automation (Python, Go, Bash). - Experience working with bug bounty programs or coordinated vulnerability disclosure workflows. - Experience in fast-paced, cloud-native, or AI/ML-driven environments. Full-Time Employee Benefits Include: 💰 Competitive Salary & Equity 💹 401(k) Program with a 4% match (US Only) ⚕️ Health, Dental, Vision and Life Insurance 🩼 Short Term and Long Term Disability 🚼 Paid Parental, Medical, Caregiver Leave 🏝 Flexible Time Off (FTO) + Holidays 🚗 Commuter Benefits (In-Office & US Only) 📱 Monthly Wellness Stipend 🧑‍💻 Autonomous Work Environment 🖥 In Office Set-Up Reimbursement (In-Office Only) 🚀 Quarterly Team Gatherings ☕ In Office Amenities (In-Office Only) Want to learn more about what we are up to? - Self-driving Company https://replit.com/blog/self-driving-company - Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale - AI Adoption https://replit.com/blog/ai-adoption - Build Open-Source Apps https://replit.com/build/open-source-app-builder   Interviewing + Culture at Replit - Operating Principles https://blog.replit.com/operating-principles - Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.

Location: Australia What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 17M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, Security Operations Center Location: Remote Australia Compensation Range: $180,000 to $215,000 AUD base plus bonus and equity. What You’ll Do: As our Principal SOC Analyst in Australia, you're the most senior technical voice on the APAC SOC floor, working Monday to Friday. You'll take ownership of the hardest intrusions, turn what the floor sees every day into durable detection and product improvements, and raise the bar for every analyst around you. You'll lead by example as a cultural driver for the team, and you'll help build our Human Led Agentic SOC, where agents handle volume and humans own quality. You'll work closely with Product, Product Research and Detection Engineering & Threat Hunting. We'll also support you in publishing your research through Huntress blogs, webinars and conference talks. Responsibilities: Own complex, multi-host intrusions end to end, from triage through forensic timelining, root cause and remediation, across endpoint, identity (Microsoft 365 / Google Workspace) and SIEM telemetry Act as the SOC's technical partner to Product, Product Research and DE&TH: turn recurring floor pain points into lasting detection, suppression and product fixes rather than workarounds Perform advanced static and dynamic malware analysis, research emerging tradecraft, and publish findings through Huntress content Find repeatable investigation patterns and toil, then design, build and maintain both automation and human-led agentic workflows with Workflow Engine owners, Product and Engineering, with inline QC/QA built in from the start Own quality on the floor: grade AI agent and analyst output, trace misses to their root cause and fix them at the source, and act as final technical reviewer on detection tuning, suppression decisions and high-impact incident reports Provide technical leadership and mentoring across every level of the team: set investigation standards, run case reviews, ride-alongs and knowledge sessions, advise the Senior Manager on SOC direction, and help assess candidates in the hiring process Be a cultural driver for the team: model Give a $hit, Warrior Spirit and Outcome-Obsessed, keep a low-ego, share-everything team culture, and champion the “agents handle volume, humans own quality” mindset Handle threat-related escalations from SOC Support, writing clear explanations of complex activity and its business risk for technical and non-technical audiences What You Bring To The Team: 6+ years in SOC, Incident Response, DFIR or MDR roles, including leading multi-host intrusion investigations Deep knowledge of attacker tradecraft across MITRE ATT&CK (credential access, lateral movement, persistence, defense evasion, living-off-the-land) and how to detect it Deep forensic and investigation experience across Windows, macOS and Linux Strong cloud identity investigation and remediation experience in Microsoft 365 / Entra ID and Google Workspace Advanced static and dynamic malware analysis, including extracting IOCs and determining capability and intent Strong enterprise Windows administration (Active Directory, Group Policy, PowerShell, domain trusts) and core networking knowledge Strong hands-on AI skills: daily use of tools such as Claude and Codex for analysis, research and building automation and agentic workflows (Python, PowerShell or similar), with sound judgment about validating their output Understanding of inline quality delivery: building QC/QA into workflows as they run (quality gates, statistical sampling, drift detection and regression testing) rather than relying on after-the-fact review Proven technical leadership and mentoring: you've raised the standard of a team, not just your own work, and you explain complex findings clearly in writing and verbally Preferred Qualifications: Published research, blogs, conference talks or open-source security tooling Detection engineering experience: writing and tuning detections and SIEM queries Investigations in other cloud platforms such as Azure, AWS or GCP Previous MSP/MSSP/MDR experience and familiarity with RMM tools What We Offer: Fully remote work At least one annual trip to the US for Summer Summit, with additional local events in Australia! New starter home office set up reimbursement ($800 AUD) 12 weeks paid parental leave for both primary and secondary carers Monthly digital allowance for personal phone and internet costs ($185 AUD) Monthly home office tech stipend to upgrade or replace equipment ($40 AUD) Subsidised private health insurance through our preferred provider Stock options for all full-time employees Access to the BetterUp platform for coaching, personal, and professional growth People from all culturally diverse backgrounds, including Aboriginal & Torres Strait Islander Peoples, are encouraged to apply. Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Amsterdam, Netherlands About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. Role Overview Nebius is seeking an experienced Security Analyst - Tier 2 for its Security Operations Center (SOC). This role is a hands-on position built for depth, serving as the investigative core of the SOC, focused on evidence and grounded conclusions. This role reports to the SOC Manager, under the Detection and Response function within the CISO Office. You are welcome to work in our offices in Tel Aviv, Israel. Key Responsibilities Investigate escalated security alerts across endpoint, identity, cloud, email, and network layers. Determine scope, impact, and root cause using EDR, SIEM, and supporting telemetry. Escalate suspected incidents to the Incident Response team and complex investigations to Tier 3. Provide structured feedback to relevant stakeholders on detection or prevention quality, false-positive patterns, and coverage gaps discovered during investigations. Contribute to and refine SOC runbooks, triage guides, and investigation procedures. Review Tier 1 escalations, coach on handoff quality, and act as the analytical reference during triage. Document investigations to a standard that supports handoff, quality review, and lessons learned. Participate in the on-call rotation, acting as the investigative point of contact outside business hours. Required Qualifications: Experience Around 5-7 years of hands-on security operations experience, with proven depth in alert investigation. Experience taking investigations to a clear verdict, including confirmed incidents. Technical Expertise Strong working command of EDR platforms and SIEM-based investigation, including writing and adapting queries independently. Solid understanding of attacker techniques, with the ability to map findings to MITRE ATT&CK in analysis and reporting. Investigation capability across at least two of: endpoint, identity, cloud, email, or network domains. Windows and Linux internals at the depth required for log and artifact analysis: processes, authentication flows, and persistence mechanisms. Solid networking fundamentals: TCP/IP, DNS, HTTP/S, and the ability to interpret network telemetry. Scripting ability (Python or similar) for analysis at scale, and familiarity with SOAR platforms. Certifications such as BTL2, OSDA, or CDSA are an advantage. Leadership & Communication Intellectual honesty, clearly distinguishing important and vague data, what is known, what is assumed, and what is still unknown. Collaborative escalation habits, hands off with context and stays available to support what comes next. Structured written communication, writing investigation notes that tell the story on their own. Fluent in English, written and verbal, comfortable working with international teams and stakeholders. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Москва Workplace: Гибрид, Удаленно, Офис Объединённая компания Wildberries и Russ — это международная технологическая компания, образованная в результате слияния двух лидеров рынка — IT-компании Wildberries и оператора наружной рекламы Russ. Вместе с масштабным развитием IT направления Wildberries и Russ развивает информационную безопасность. Мы решаем сложные и разнообразные задачи: от повышения защищенности каждого сервиса до развития безопасности в рамках всей нашей инфраструктуры. Мы ищем дежурного аналитика SOC, готового учиться и развиваться. Эта позиция отлично подходит для старта карьеры в SOC. Мы не требуем идеальных знаний, но нам важно ваше желание расти как профессионал. Обязанности Обнаружение, расследование и реагирование на инциденты Разработка инструкций по разбору и верификации алертов Требования Желание развиваться в сфере ИБ Опыт работы с системами мониторинга (Log management, SIEM) Опыт работы с Linux и Windows системами на уровне администратора, в частности — работа с логами Понимание работы сети и основных сетевых прикладных протоколов Будет плюсом, если у тебя есть: Опыт разработки правил корреляции событий Опыт работы с ELK Stack/OpenSearch/Wazuh Опыт работы с IRP/SOAR на уровне пользователя Знание современных тактик и техник компьютерных атак, методов и средств их обнаружения Базовые навыки программирования на Python, PowerShell или Bash для автоматизации рутинных задач Участие в CTF Условия Обучение и развитие: языковые клубы, собственный корпоративный университет, программы развития управленческих навыков и многое другое; Благополучие сотрудников: корпоративный пакет ДМС со стоматологией, корпоративный спорт, консультации психолога и дополнительные возможности аккредитованной IT-компании; Множество сообществ: клуб спикеров, футбола, йоги, шахмат и т.д.; Забота о семьях: создаем условия, в которых легко сочетать карьеру и заботу о близких – от гибкого подхода до масштабных проектов для детей сотрудников; Скидки и партнерские программы: на обучение, страхование, покупки и многое другое; Комфортная рабочая среда: бесплатное питание в офисе, современные офисы рядом с метро, корпоративная техника и портал для сотрудников.

Location: Riyadh, Saudi Arabia Role Summary The SOC L2 Specialist delivers SMC's managed security operations service. The role handles escalated alerts from L1, leads incident response, and supervises day-to-day SOC activity. Key Responsibilities Investigate and triage alerts escalated from L1 analysts, and confirm or close them with clear reasoning Lead incident response: containment, eradication, recovery and root cause analysis Perform deep-dive analysis of logs, network traffic, endpoint telemetry and email threats Tune SIEM correlation rules and use cases to reduce false positives Run threat hunting based on threat intelligence and MITRE ATT&CK Create and maintain incident response playbooks and SOAR workflows Supervise and mentor L1 analysts, review their work, and manage shift handovers Write incident reports and present findings to technical and management stakeholders Report incidents in line with NCA requirements and SMC's escalation matrix Track SOC KPIs such as MTTD, MTTR and SLA compliance. Requirements Bachelor's degree in Cybersecurity, Computer Science, IT or related field 4–6 years in a SOC, with at least 2 years at L2 level Strong hands-on SIEM experience (Splunk, IBM QRadar, Microsoft Sentinel, or similar) Experience with EDR/XDR (CrowdStrike, Defender for Endpoint, SentinelOne) and SOAR platforms Solid knowledge of MITRE ATT&CK, the cyber kill chain, malware analysis basics and network protocols Experience in an enterprise or managed SOC (MSSP) environment Saudi national, fluent in Arabic and English Willing to support on-call or shift rotation if required Preferred Certifications GCIH, GCIA, CySA+, CEH, Splunk Core Certified Power User, Microsoft SC-200, IBM QRadar certification

Location: New York; San Francisco Workplace: Hybrid ABOUT ALCHEMY Alchemy is the Web3 infrastructure and developer platform that powers millions of users and the world’s most innovative blockchain applications. From enabling $1+ trillion in financial transactions worldwide to scaling L2s and enabling DeFi, Alchemy provides the infrastructure and tools developers need to build reliable, scalable, and accessible experiences. Trusted by companies like JPMorgan, Stripe, Visa, Franklin Templeton, Nike, and backed by a16z, Coatue, Silver Lake, Lightspeed, and Stanford University, Alchemy is building the foundational layer for a decentralized and AI-enabled Web3 ecosystem. For more information, visit alchemy.com http://alchemy.com.   THE ROLE We're looking for a Security Operations Engineer to improve how Alchemy detects threats, investigates incidents, and reduces operational security risk. This is a hands-on individual-contributor role with no people-management responsibilities. You'll investigate suspicious activity and build the systems that make the next investigation faster and more reliable. AI-assisted engineering and investigation should be part of your daily work: connecting evidence, developing detections, building response workflows, and checking the results against source data. You'll also help the team get better at this work. Through shared tooling, code review, pairing, and practical documentation, you'll give teammates capabilities they can use independently.   WHAT YOU WILL DO - Detect and investigate threats. Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments. Establish what happened from evidence and communicate uncertainty clearly. - Engineer detection coverage. Build and tune detections, onboard useful telemetry, and maintain reliable log pipelines. Test rules against representative attacks and benign activity; address missing coverage and noisy alerts. - Respond to incidents. Participate in the security on-call rotation and incident response, including scoping, containment, recovery, and post-incident improvements. Preserve evidence and coordinate changes with system owners. - Build AI-assisted security workflows. Automate evidence collection, alert enrichment, investigation timelines, and response preparation. Connect agents to approved tools and data sources so they can complete bounded tasks with traceable results. - Verify before trusting. Evaluate AI-assisted workflows against known cases and adversarial inputs. Require evidence for conclusions, test false-positive and missed-threat behavior, and keep human approval for disruptive containment actions. - Reduce operational exposure. Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring. Prioritize findings by exposure and impact, then verify remediation. - Help secure agent operations. Work with platform and product-security partners on operational controls for agent identities, credentials, tool access, and audit logging. Investigate misuse and build detections for suspicious agent behavior. - Improve how the team works. Share reusable code, investigation skills, runbooks, and evaluation cases. Pair with teammates, review automation, and teach approaches they can apply to their own investigations. - Measure defensive outcomes. Track detection coverage, alert quality, investigation effort, response time, and remediation progress. Use those measures to decide what to improve next.   WHAT WE ARE LOOKING FOR - Hands-on security operations experience spanning detection engineering, threat hunting, and incident response. - Strong scripting and software-building ability, especially Python; experience with APIs, version control, tests, and operating automation in production. - Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis. - Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems. Ability to investigate across system boundaries. - Evidence of building and using AI-assisted tools in security or adjacent engineering work. You can show how you validate outputs, handle failures, and protect sensitive information. - Sound incident judgment: you can separate a hypothesis from a finding, preserve evidence, and choose when to escalate or contain. - A record of making teammates more effective through tools, mentoring, code review, or documentation, without needing management authority. - Clear written communication and the willingness to own both urgent investigations and the follow-through that prevents repeat incidents.   HELPFUL EXPERIENCE - AWS, Kubernetes, bare-metal infrastructure, detection-as-code, or SOAR workflows. - Digital forensics, threat intelligence, or testing detections through attack simulation. - Securing AI agents and tool integrations, including prompt injection, credential misuse, and data-exfiltration risks. - Blockchain infrastructure or other environments with sensitive keys and high-impact production systems.   WHAT SUCCESS LOOKS LIKE - Investigations reach evidence-backed conclusions faster. Detection coverage improves, repeat noise declines, and remediation is verified. The team adopts tools and workflows you've built, with clear limits on what agents may do and a tested path for handling failures.   BENEFITS & PERKS 🏥 Private Health Insurance 💪 Gym Reimbursement 🚅 Commuter Benefits 🌴 Flexible Time Off 🥙 In-Office Group Meals 🧠 Learning & Development Stipend 🌎 Company Sponsored Conferences & Events 🎧 Books & Audiobook subscription with Bookster https://landing.bookster.ro/

Location: Riyadh, KSA Workplace: onsite Tabby creates financial freedom in the way people shop, earn and save by reshaping their relationship with money. Over 25 million users choose Tabby to stay in control of their spending and make the most out of their money. The company’s flagship offering allows shoppers to split their payments online and in-store with no interest or fees. Over 70,000 global brands and small businesses, including Amazon, Noon, IKEA, and SHEIN use Tabby to accelerate growth and gain loyal customers by offering easy and flexible payments online and in stores. Tabby generates over $18 billion in annual transaction volume for its partner brands and is the highest-rated, most-reviewed, largest, and fastest-growing FinTech in the GCC region. Tabby launched in 2019 and has since raised +$1 billion in equity and debt funding from global and regional investors, and is now valued at $6,5 billion. As Information Security Engineer , you’ll play a key part in monitoring and defending our infrastructure, applications, and cloud environments from cyber threats. You’ll lead incident response efforts, develop and tune detection rules, investigate security events, and collaborate with cross-functional teams to strengthen our security posture. Key Responsibilities Security Monitoring & Detection Monitor and analyze logs and alerts from a wide range of sources including firewalls, intrusion detection/prevention systems (IDS/IPS), endpoints, servers, and cloud platforms. Perform correlation of events from multiple sources to identify advanced threats and unusual patterns of behavior. Fine-tune alert thresholds and detection logic to reduce false positives and improve signal-to-noise ratio. Maintain dashboards and reporting to provide real-time visibility into security posture. Incident Response & Investigation Serve as a frontline responder for security incidents, managing incidents through their lifecycle – detection, containment, eradication, recovery, and lessons learned. Coordinate with internal stakeholders and external vendors during high-severity incidents or data breaches. Perform root cause analysis and forensic investigations using endpoint and network-based artifacts. Maintain detailed incident documentation and contribute to post-mortem analysis and reports. Threat Intelligence & Detection Rule Development Research emerging threats and trends. Contribute to the creation and tuning of detection rules, threat-hunting queries, and use cases across multiple platforms including cloud environments. Maintaining CTI Platform along with the integration of the CTI feeds with the security controls to have active CTI driven detections. Collaboration and Communication Communicate effectively with cross-functional teams including IT, DevOps, Risk, and Compliance during incidents and investigations. Provide concise and clear updates during incident handling to stakeholders and management. Mentor junior analysts and assist in training efforts within the SOC team. Skills, Knowledge and Expertise 3–4 years of experience in a SOC or cybersecurity operations role, ideally in a fast-paced fintech or enterprise environment. Strong knowledge of security best practices, including incident handling, alert triage, log analysis, and threat modeling. Understanding of online technologies, REST APIs, microservices, and modern application architectures. Experience working in a culturally diverse and collaborative environment. Familiarity with DLP, AV, and anti-malware systems from an operational monitoring perspective. Experience with phishing detection, user behavior analytics, and security awareness campaigns. Security certifications such as Security+, CySA+, eCIR, eCTHPv2, GCIA, or GMON (preferred but not required). Strong communication skills, especially for coordinating incident response and writing clear incident reports. Experience with SIEM platforms , SOAR tools , EDR/XDR , and Threat Intelligence platforms . Familiarity with cloud environments and cloud-native logging and monitoring tools. Scripting experience (e.g., Python ) to automate tasks and improve SOC efficiency.