Location: Remote - India
Founded in 2012, Bugcrowd is the preemptive security platform that unifies exposure discovery and assessment, offensive testing, and intelligence shaped by AI and human insight to help organizations avoid, discover, and validate real-world risk. Bugcrowd helps security teams move faster by identifying the exposures that matter most so they can act first and stay ahead of attackers. By combining the power of humans and AI, teams can preempt attack paths and prevent breaches. Based in San Francisco and New Hampshire, Bugcrowd is supported by General Catalyst, Rally Ventures, Costanoa Ventures, and others. Visit
www.bugcrowd.com
.
Job Summary
At Bugcrowd, we handle application security assessment at an epic scale. As an Application Security Engineer (ASE) you will curate and manage the incoming security vulnerability submissions to some of the world’s biggest companies’ bug bounty programs. Here are just a few of the reasons why we are the best:
A tenure at Bugcrowd often means you have worked on not only one company’s security program but potentially on hundreds.
As an ASE at Bugcrowd you will be exposed to the Internet’s best security researchers and their cutting-edge security testing methodologies. Our ASEs quickly become technically fluent in obscure/complex XSS, SQLi, XXE, IDOR, SSTI, SSRF, and many other vulnerability types. There is no other organization that offers the learning opportunity that Bugcrowd does.
You will be exposed to things outside of your comfort zone. We routinely run security programs for cars, IoT devices, embedded systems, mobile applications, and more!
We have an awesome team and tons of perks. We’ve even been selected as one of “The 10 Coolest Security Startups Of 2016” by crn.com.
Essential Duties & Responsibilities
An ASE is responsible for the ongoing triage and validation services of Bugcrowd managed programs. Under the direction of the Director of Technical Operations, you will take incoming submission data and curate it for validity, accuracy, and severity as well as communicate directly with Bugcrowd’s clients or researchers when additional information is required. ASEs also handle Incident Response – escalating and communicating about the highest severity bugs to clients. ASEs need to have strong knowledge of OWASP Top Ten type vulnerabilities. They also usually require a strong skill set in one scripting/development language, often to assist with the design or development of tooling for improving the triage/validation process. The ASE position is perfect for security professionals looking to take their skills to the next level.
Education, Experience, Skills, & Abilities
Bachelor’s degree or previous security consulting experience
Published and demonstrated passion for security assessment research
High proficiency with Burp Suite (or any other interception proxy) and a working level of experience with other industry standard tools (nmap, sqlmap, anything included in Kali Linux)
Ability to execute on individual projects but still contribute to the team
Ability to complete tasks on time
Strong organization, influencing, and communication skills
Working Conditions
The ideal candidate must be able to complete all physical requirements of the job with or without reasonable accommodation.
Sitting and/or standing - Must be able to remain in a stationary position 50% of the time
Carrying and /or lifting - Must be able to carry / move laptop as needed throughout the work day.
Environment - remote, work-from-home 100% of the time.
ADA Statement
Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ada@bugcrowd.com.
Culture
At Bugcrowd, we understand that diversity in the workplace is vital to a company’s success and growth. We strive to make sure that people are included and have a sense of being part of making Bugcrowd not only a great product but a great place to work.
We regularly hear from both customers and researchers that Bugcrowd feels like a family, and we strive to maintain that internally as well.
Our team consists of a broad range of people: musicians, adventure sports junkies, nature lovers, parents, cereal enthusiasts, night owls, cyclists, artists—you get the point.
At Bugcrowd, we are solving security threats and vulnerabilities that are relevant to everyone, therefore we believe solving these problems takes all kinds of backgrounds. We value the perspectives and experiences people from underrepresented backgrounds bring.
Disclaimer
This position has access to highly confidential, sensitive information relating to the technologies of Bugcrowd. It is essential that the applicant possess the requisite integrity to maintain the information in the strictest confidence.
The company is authorized to obtain background checks for employment purposes under state and federal law. Background checks will be conducted for positions that involve access to confidential or proprietary information (including trade secrets).
Background checks may include Social Security verification, prior employment verification, personal and professional references, educational verification, and criminal history. Applicants with conviction histories will not be excluded from consideration to the extent required by
law.
Any personal data you submit in connection with your application will be processed in compliance with Bugcrowd's Privacy Policy, which you may review here:
https://www.bugcrowd.com/privacy
.
Equal Employment Opportunity:
Bugcrowd is EOE, Disability/Age Employer.
Individuals seeking employment at Bugcrowd are considered without regards to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, or sexual orientation.
Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ADA at bugcrowd.com.
Apply at:
https://www.bugcrowd.com/about/careers/
В объединённой компании Wildberries и Russ нужно развивать безопасность Kubernetes: внедрять политики и runtime-защиту, настраивать NetworkPolicies, управлять секретами. В задачи также входят анализ событий, архитектурные ревью и моделирование угроз, автоматизация через GitOps/CI.
Location: Warsaw, Poland; Prague, Czechia; Sofia, Bulgaria; Bucharest, Romania; Madrid, Spain; Tbilisi, Georgia
CloudLinux
is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful.
Check out our website for more information:
cloudlinux.com
Imunify360 Security Suite
is an innovative security solution designed specifically for shared and VPS/Dedicated servers. The automated, easy-to-use solution with the six-layer approach to security delivers comprehensive and complete attack prevention.
We are looking for a Lead Security Engineer - Vulnerability Response to join our Web Protection Team.
The challenge ahead
When a critical vulnerability in a popular web application or WordPress plugin goes public, attackers start exploiting it within hours. Most site owners can't patch that fast. We want our customers protected before the first attack reaches them, and we want them to know it.
That's the challenge we're hiring for:
AI-driven vulnerability response.
Build and run a pipeline that detects new high and critical vulnerabilities, generates WAF rules with AI assistance, validates them, and ships them to production in a short window.
Protection plus public announcement, both automated.
The same pipeline that ships the rule also produces the public advisory. Every critical vulnerability we cover is announced soon after the rule ships, so customers and the market see that Imunify closed it first.
Build on what works.
An AI-assisted pipeline already runs for our WordPress protection plugin. The first big project is to extend this approach to ModSecurity/Coraza WAF rules.
Speed without breaking sites.
On shared hosting, a rule that blocks legitimate traffic is a customer incident. Fast and precise both matter.
Make it measurable.
Time-to-protection, coverage of critical vulnerabilities, and false-positive rate are the numbers this role owns.
About the role
You will own the vulnerability response pipeline end to end and be its main builder. You combine deep web application security expertise with strong automation skills, and you think about the product: what customers need, what to measure, what to build next. You'll lead a small team of security analysts and work closely with automation, QA, and marketing.
What you'll do
Design and build the AI-driven pipeline from disclosure to announcement: vulnerability intake, triage, rule drafting, testing, release, and the public advisory.
Lead the extension of our existing WordPress-plugin pipeline to ModSecurity/Coraza rules.
Write and review WAF rules (ModSecurity/SecLang) for real-world web vulnerabilities.
Build test harnesses that check rules against exploits and real traffic before release.
Lead and mentor security analysts: set priorities, review their work, remove blockers.
Define and track time-to-protection, coverage, and false-positive rate, and improve them.
Automate advisory generation as part of the pipeline, and agree the format and review flow with marketing.
Requirements
What we're looking for:
5+ years in web/application security: vulnerability research, detection engineering, WAF engineering, or similar.
Deep understanding of web attack classes (SQLi, XSS, RCE, auth bypass, path traversal, file upload, deserialization) and how to detect them in HTTP traffic.
Hands-on experience writing WAF rules (ModSecurity/SecLang, OWASP CRS, or similar) and regular expressions.
Able to read PHP code and understand a vulnerability from an advisory or a patch diff.
Strong Python: you've built automation pipelines that run in production. CI/CD and automated testing.
Hands-on daily use of AI/LLM tools; you know where to trust them and how to verify their output.
Proven track record of leading a technical project end to end.
Product mindset: you reason about customer impact, not only technical correctness.
Upper-intermediate English or better.
Nice to have:
WordPress ecosystem security: plugin vulnerabilities, vulnerability feeds (Wordfence, Patchstack, WPScan), CVE credits or bug bounty.
Coraza or other WAF engines.
Exploit analysis or threat intelligence background.
Linux server administration, hosting industry.
Personal skills:
Strong ownership: you take a goal, not a task list.
See the whole process and find the bottleneck, not only fix individual issues.
Communicate clearly and raise risks early.
Calm under pressure: critical vulnerabilities don't wait for working hours.
Comfortable making decisions with incomplete information.
Benefits
What's in it for you?
A focus on professional development.
Interesting and challenging projects.
Fully remote work with flexible working hours, that allows you to schedule your day and work from any location worldwide.
Paid 24 days of vacation per year, 10 days of national holidays, and unlimited sick leaves.
Compensation for private medical insurance.
Co-working and gym/sports reimbursement.
Budget for education.
The opportunity to receive a reward for the most innovative idea that the company can patent.
By applying for this position, you consent to the processing of your personal data as described in our Privacy Policy (
https://cloudlinux.com/candidate-privacy-notice
), which provides detailed information on how we maintain and handle your data.
Location: Boston, MA
Workplace: OnSite
At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP empowers members to perform at a higher level through a deeper understanding of their bodies and daily lives.
WHOOP is seeking a Security Detection Engineer to join our growing Information Security team, reporting directly to the Information Security Manager. In this hands-on technical role, you'll be responsible for designing, building, and continuously improving scalable, high-fidelity detection capabilities that safeguard the sensitive biometric and health data of millions of WHOOP members.
You'll play a critical role in strengthening our detection capabilities across cloud, identity, endpoint, and application environments, with a focus on identifying emerging threats, improving detection accuracy, and reducing security risk. This is an opportunity to take meaningful ownership of our detection engineering program, influence its technical direction, and help shape the future of security at WHOOP as we continue to scale.
RESPONSIBILITIES
- Design, build, and scale high-signal detections across cloud, identity, endpoint, network, and application layers using Detection-as-Code principles.
- Develop and maintain detection logic aligned to real-world attacker behavior and frameworks such as MITRE ATT&CK across modern security platforms.
- Translate threat intelligence into actionable detections and validate effectiveness through adversary emulation and testing.
- Build behavioral detections to protect against threats such as account takeover, credential abuse, API misuse, automation attacks, privilege escalation, and data exfiltration.
- Continuously improve detection quality by tuning alerts, reducing false positives, and implementing automated enrichment and triage.
- Define and track detection KPIs (e.g., precision, recall, false positive rate, MTTD) and implement processes to measure and improve detection health.
- Support and lead incident investigations, including containment, root cause analysis, and post-incident detection improvements.
- Contribute to the on-call rotation while proactively reducing operational overhead through automation.
- Partner with Engineering, IT, Infrastructure, Product, and GRC to ensure systems launch with strong monitoring and detection coverage.
- Map detections to threat models, identify visibility gaps, and continuously improve coverage as the environment scales.
- Explore and apply advanced analytics and machine learning techniques to improve detection fidelity, reduce noise, and enhance triage and investigation workflows.
- Stay ahead of evolving threats by researching emerging attack techniques and incorporating learnings into detection strategy.
QUALIFICATIONS
- 4+ years of hands-on experience in Information Security, with a focus on detection engineering, threat detection, or security operations.
- Demonstrated experience writing and tuning detections across cloud, identity, endpoint, or application environments.
- Familiarity with detection frameworks and tooling such as YARA, SIGMA, Suricata, or similar rule-based detection methodologies.
- Strong understanding of attacker techniques across identity compromise, cloud abuse, lateral movement, and data exfiltration.
- Expertise analyzing and building detections on cloud and SaaS telemetry, including authentication events, API activity, and system logs.
- Strong scripting skills in a scripting language such as Python, Go, or PowerShell for automation and tool development.
- Ability to operate effectively in a fast-paced, high-growth environment.
- Strong analytical mindset with a systems-thinking approach to reducing noise and increasing signal fidelity.
- Experience supporting incident response investigations and participating in on-call rotations.
- Experience building detective controls for consumer-facing platforms or detecting authentication and API abuse at scale is a strong plus.
- Effective communicator who can collaborate with engineers and explain detection strategy clearly to both technical and non-technical stakeholders.
- Familiarity with applying data analysis or machine learning techniques to security detection or alert triage is a plus.
- Bachelor’s degree in Computer Science, Information Security, or a related technical field, and/or relevant security certifications are a plus.
Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.
WHOOP is an Equal Opportunity Employer and participates in E-verify to determine employment eligibility. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values.
At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success.
The U.S. base salary range for this full-time position is $130,000 - $170,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.
In addition to the base salary, the successful candidate will also receive benefits and a generous equity package.
These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.
Задачи:
— исследование устройств различного назначения, бинарного кода (без исходного кода), программного обеспечения и внутреннего программного обеспечения (ВПО);
— исследование внутреннего ПО устройств на наличие уязвимостей и недокументированных возможностей;
— анализ защищенности программного обеспечения устройств;
— разработка PoC по результатам проведенного анализа;
— модификация внутреннего ПО для устранения ошибок.
Требования:
— опыт работы в качестве Team lead/Ведущий Reverse engineer от 2 лет;
— навыки управления командой, умение грамотно распределять задачи и нагрузку;
— понимание принципов обратного проектирования (исследования) программного обеспечения;
— владение инструментами обратной разработки (IDA Pro, Radare2 или др.);
— языки программирования: Python, C/С++, Assembler;
— понимание архитектуры ОС;
— опыт использования ОС Linux;
— знание английского языка на уровне чтения технической документации.
Плюсом будет:
— знакомство с аппаратной архитектурой и схемотехникой различных устройств;
— опыт исследования программного обеспечения на безопасность, поиска уязвимостей;
— опыт разработки низкоуровневого кода для x86, MIPS, ARM, RISC-V;
— опыт автоматизации исследования при помощи мультиагентной среды (MML).
Условия:
— официальное трудоустройство в аккредитованной IT-компании и возможность пользоваться соответствующими льготами;
— гибкое начало рабочего дня, гибридный график (офис + удаленка), полностью удаленный формат невозможен;
— офис в пешей доступности от метро Электрозаводская, Семеновская;
— полис ДМС с расширением ВЗР (страхование выезжающих за рубеж);
— премирование за высокие производственные показатели и результаты труда по итогам успешной работы Общества за год;
— предложение по заработной плате и условиям труда формируется по результатам собеседования, в зависимости от опыта и знаний.
Sardine is looking for a Senior Application Security Engineer to automate vulnerability management, eliminate security bug classes, and secure applications and APIs.
Location: USA (Remote)
Workplace: Remote
Mysten Labs’ mission is to advance the internet through step-function improvements in what technology makes possible. We build foundational infrastructure and products that give people, businesses, and developers new ways to interact, transact, and create value.
Our work spans on-chain finance and the emerging agent economy. Through Sui, Move, and our broader technology stack, we’re building the systems that make these experiences possible - from secure, scalable blockchain infrastructure to new ways for businesses and AI agents to interact.
Responsibilities
- Build and operate the Security Observability & Data Platform (tens of TB/month and growing). This covers ingestion, normalization and retention, plus the query and detection layer on top. Detections are code: tested, reviewed, and measured for precision.
- Own endpoint security across the fleet: deploy, tune and respond with EDR; run and configure binary authorization; and set hardening baselines with IT Operations.
- Lead threat hunting, internal investigations and insider-threat work. Handle security incidents end to end: triage, containment, forensics, root cause, and the control that prevents a repeat.
- Build the next generation of security services and run them in production: zero-trust AuthN/AuthZ, a uniform blocking service, an application proxy, asset inventory, developer portal, and compliance as code.
- Build and run the agent platform (local and Kubernetes). Use LLM agents to automate triage, enrichment, investigation and response, with deterministic checks wherever a model's answer isn't enough.
- Review infrastructure and cloud designs (Kubernetes, AWS/GCP, bare metal, CI runners) for security, and help engineering teams adopt the shared services instead of building their own.
- Run red-team and adversary-emulation exercises, and turn the results into detections and fixes.
- Write runbooks and post-mortems that someone who wasn't in the room can follow at 3 a.m.
Minimum Qualifications
- Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
- 5+ years in security engineering, detection and response, or infrastructure/SRE with a security focus, including hands-on incident response on endpoints and in the cloud.
- Experience operating an EDR, writing and tuning detections. Knowledge of macOS and Linux internals as attackers use them: persistence, credential theft, process injection, living-off-the-land binaries.
- Experience building or operating telemetry pipelines and a SIEM or security data lake at TB scale. Strong SQL, including detection logic over large datasets.
- Hands-on production engineering: Linux, containers, Kubernetes, at least one major public cloud, infrastructure as code, monitoring and alerting.
- Proficiency in Python or Go, and comfort with Rust or willingness to work in it (most of Mysten's stack are Rust).
- Working knowledge of identity: SSO (OIDC/SAML), phishing-resistant MFA, device trust, and how session and token theft work.
- Strong written communication: can run an incident channel and write the post-mortem.
- Interest in the web3 space is required.
Preferred Qualifications
- Experience building zero-trust access, identity-aware proxies or policy engines.
- Binary authorization or allowlisting at fleet scale
- Familiarity with the threat actors that target crypto companies and their methods, from social engineering and fake campaigns to supply chain compromises.
- Digital forensics (memory, disk, macOS unified logs) and malware analysis.
- Experience building security tooling with LLM agents (Claude Code skills or comparable), and a clear sense of where models help and where deterministic tooling has to do the work.
- Compliance as code (CIS benchmarks); experience in ISO 27001 or SOC 2 environments.
- Publications, conference talks or open-source security tooling.
Employment is contingent upon the successful completion of a background check, which may include verification of employment history, education credentials, criminal history, and other relevant information.
Regarding the recent rash of technology job scams: Be aware that emails from genuine Mysten Labs group recruiters will always come from the @mystenlabs.com http://mystenlabs.com domain or related subdomains (e.g., mystenlabs.com/careers http://mystenlabs.com/careers). Remember: you can always verify positions on our job boards at www.mystenlabs.com/careers http://www.mystenlabs.com/careers.
To support an efficient and fair hiring process, we may use technology-assisted tools, including artificial intelligence (AI), to help identify and evaluate candidates. All hiring decisions are ultimately made by human reviewers.
Our team is remote first and we are hiring across the world. Here at Mysten Labs, you’ll be joining a world-class team with tremendous growth potential as we bring the next billion users to web3. We raised a $300M Series B round from top Silicon Valley led venture funds like Jump Crypto, Andreessen Horowitz (a16z), Binance Labs, Redpoint, Lightspeed, Coinbase Ventures, Electric Capital, Standard Crypto, NFX, Slow Ventures, Scribble Ventures, Samsung Next, Lux Capital, among other investment firms and strategic partners. Come join us and build the future of web3!
Location: US - Headquarters - Maryland - Columbia
Who is Tenable?
Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey!
What makes Tenable such a great place to work?
Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together!
Your Role:
Join our InfoSec team at Tenable as a hands-on Mid Risk and Compliance Analyst. Drive compliance and assurance efforts for our products and cloud services while assisting with external risk assessments, security assessments, and audits. Make a real impact on our organization's security and customer trust and come join us at Tenable!
Your Opportunity:
Serve as a company representative with prospects, customers, and partners for security questionnaires, assessments, and audits
Collaborate with Sales, Engineering, Information Security, IT, and Product Development teams to communicate compliance obligations and requirements
Complete Third-Party Risk Assessments (TPRM Program) for new and potential vendors
Educate stakeholders on their responsibilities
Coordinate and participate in internal and external audit walkthroughs
Help guide and perform remediation of issues identified during third-party assurance or internal reviews
Support special projects as needed, which may include:
Assisting in the development and execution of the internal compliance program, involving preparation for audits, certifications, and risk assessments.
Assisting in the development, administration, and continuous monitoring of internal security controls.
What You'll Need:
Able to work hybrid/onsite location at HQ in Columbia MD. This position is US-based only
4+ years of experience performing information security and vendor risk assessments based upon industry accepted standards
4+ years of experience in responding to security assessments, SAQs, compliance requirements, etc
4+ years of experience with implementation, monitoring, and reporting of control processes, documentation, and remediation items
Experience working with the Federal Risk and Authorization Management Program (FedRAMP)
Be self-driven with the ability to work independently and comprehend all requirements
Strong communication skills and ability to collaborate effectively with all levels
Analytical mindset with a rational, pragmatic, and realistic approach to security, risk, and compliance
Ability to adopt and utilize technology, with advanced proficiency in Excel, PowerPoint, and Vizio.
And Ideally:
Knowledge of governance, risk and compliance frameworks (GRC)
Experience performing or undergoing internal and external audits
Relevant security certifications (SSCP, Sec+, CISA, etc)
Experience in a Big 4 or similar security consulting or risk assurance role
Experience with conducting audits, privacy, BC & DR Program Management
BS, BA in Information Technology, Computer Science, Information Security, or other related field
#LI-Hybrid #LI-MM1
This is the base pay range for this position. Compensation for the role will depend on a number of factors, including the candidate's qualifications, skills, competencies, location and experience, and may fall outside of the range shown. Employees are also eligible for variable compensation in addition to base pay (commission for sales roles, bonus for non-sales roles), depending on company and individual performance. Tenable also offers a variety of comprehensive and competitive benefits which include: medical, dental, vision, disability and life insurance; 401(k) retirement savings with company match; an employee stock purchase plan; an employee referral program; flexible spending accounts; an Employee Assistance Program (EAP); education assistance; parental leave; paid time off (PTO); company-paid holidays; health and wellness events; and community programs.
US Pay Range
$80,500
—
$107,166.67 USD
We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels. If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact
Recruiting@Tenable.com
for further assistance.
Tenable Data Consent Statement
Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you:
General Applicant Privacy Notice
California Applicant Privacy Notice
EU/EEA/UK Applicant Privacy Notice
Команда безопасности ИИ ищет специалиста для whitebox-анализа LLM-приложений, AI-агентов, RAG и векторных БД. Нужно выявлять prompt injection и другие AI-угрозы, проверять защитные фильтры и контроль вызовов инструментов.
Location: Serbia; Armenia; Bulgaria
On behalf of
SafetyTech Client #1
, SD Solutions is looking for a talented
Adversarial Task Writer for AI Security RL Gyms.
SD Solutions is a staffing company operating globally. Contact us to get more details about the benefits we offer.
Responsibilities:
Design adversarial prompt injection scenarios in YAML for Alice’s RL Gym platform.
Run scenarios against frontier models, validate success rates, and refine tasks based on testing results.
Submit high-quality, validated tasks for review and acceptance.
Work on a flexible, freelance basis
, choosing task contributions according to your availability.
Contribute to ongoing AI security evaluation projects, with opportunities to receive additional tasks based on your activity, consistency, and task quality.
Requirements:
Adversarial mindset: you think like an attacker and understand how to exploit an AI agent’s helpfulness, authority assumptions, or trust in its environment
Prompt injection expertise: direct (role-play, encoding, context flooding) and indirect/environment-embedded (poisoned tool responses, malicious content in documents, cross-context leakage)
Technical writing in YAML
Comfortable with Docker, CLI tools, and running systematic tests against multiple models
Domain realism in at least one vertical: e-commerce, finance, HR, enterprise SaaS, healthcare, travel
Background in pentesting, appsec, LLM security research, or red teaming strongly preferred
The Task
You build adversarial prompt injection tasks for Alice’s RL Gym platform. Each task is a self-contained YAML scenario simulating a realistic AI agent deployment, testing whether the agent can be manipulated into violating its safety policies.
This is a freelance, task-based opportunity with flexible workload and no fixed weekly commitment. You can contribute according to your availability, with the possibility of receiving more tasks over time based on your activity and the quality of your submissions.
About the company:
A company building specialized evaluation infrastructure for AI safety and robustness testing. Their platform simulates adversarial conditions used by AI development teams to validate agent behavior before deployment. Currently expanding a freelance contributor pool for scenario and environment development.
By applying for this position, you agree to the terms outlined in our Privacy Policy. Please take a moment to review our Privacy Policy
https://sd-solutions.breezy.hr/privacy-notice
, and make sure you understand its contents. If you have any questions or concerns regarding our Privacy Policy, please feel free to contact us.
Location: Global
We are the creators of a new fintech era!
Our mission is to change this world by making blockchain accessible to everyone in everyday life. WhiteBIT is a global team of over 1,200 professionals united by one mission — to shape the new world order in the Web3 era. Each of our employees is fully engaged in this transformative journey.
We work on our blockchain platform, providing maximum transparency and security for more than 8 million users worldwide. Our breakthrough solutions, incredible speed of adaptation to market challenges, and technological superiority are the strengths that take us beyond ordinary companies. Our official partners include the National Football Team of Ukraine, FC Barcelona, Lifecell, FACEIT and VISA.
The future of Web3 starts with you: join us as an Application Security Engineer!
Requirements
2+ years of experience in Application Security, Product Security, or a related security role.
Strong knowledge of web application security, OWASP Top 10, common attack techniques, and secure coding practices.
Hands-on experience with threat modeling, security architecture reviews, vulnerability assessment, and penetration testing.
Ability to review source code and identify security vulnerabilities.
Experience with SAST, DAST, SCA, secrets scanning, and vulnerability-management tools.
Understanding of CI/CD pipelines and experience integrating security checks into the SDLC.
Knowledge of API security, authentication, authorization, and common security protocols.
Familiarity with cloud, container, or Kubernetes security.
Basic knowledge of Web3 and smart contract security.
Basic scripting or programming skills, preferably in Python or another relevant language.
Ability to clearly communicate security risks and remediation guidance to technical and non-technical stakeholders.
Responsibilities
Perform application security assessments, source-code reviews, and penetration testing.
Participate in threat modeling and security architecture reviews for new and existing products.
Triage Bug Bounty submissions: validate and reproduce vulnerabilities, assess their severity and business impact, identify duplicates and false positives, communicate with researchers, and coordinate remediation with engineering teams.
Identify, prioritize, and track vulnerabilities throughout the remediation process.
Provide developers with clear remediation guidance and secure coding recommendations.
Support the integration and operation of SAST, DAST, SCA, secrets scanning, and other security tools within CI/CD pipelines.
Participate in defining and reviewing security requirements throughout the software development lifecycle.
Validate security-tool findings and help reduce false positives.
Support investigations and remediation of application-related security incidents.
Contribute to application security standards, guidelines, and reusable security controls.
Help deliver security training and promote secure development practices across engineering teams.
Collaborate with developers, DevOps, QA, product teams, and other security specialists.
Monitor emerging application security threats and contribute to improving AppSec processes.
Ukrainian (Native)
English (B1)
Working terms
Immerse yourself in Crypto & Web3:
Master cutting-edge technologies and become an expert in the most innovative industry.
Work with the Fintech of the Future:
Develop your skills in digital finance and shape the global market.
Take Your Professionalism to the Next Level:
Gain unique experience and be part of global transformations.
Drive Innovations:
Influence the industry and contribute to groundbreaking solutions.
Join a Strong Team:
Collaborate with top experts worldwide and grow alongside the best.
Work-Life Balance & Well-being:
Modern equipment.
Comfortable working conditions, and an inspiring environment to help you thrive.
24 calendar days of paid leave.
Additional days off for national holidays.
With us, you’ll dive into the world of unique blockchain technologies, reshape the crypto landscape, and become an innovator in your field. If you’re ready to take on challenges and join our dynamic team, apply now and start a new chapter in your career!
Let’s Build the Future Together!
WhiteBIT offers all candidates an equal opportunity to join the team. All hiring decisions are made without regard to race, national origin, gender identity or sexual orientation, age, religion, disability, medical condition, marital status, familial status, veteran status, or any other legally protected characteristic of an individual.
Your privacy matters to us. You can learn more about how we handle your personal data with regard to your application in our
Candidate Privacy Notice
.
Location: United Kingdom, Remote
Workplace: remote
Olo is a leading SaaS platform accelerating digital transformation in the restaurant industry, by helping customers deliver more personalised and profitable guest experiences. As a result, our digital ordering, payment, and guest engagement solutions enable brands to do more with less and make every guest feel like a regular.
Reporting to the Security Engineering Director, the Staff Security Engineer will act as technical lead of the Olo Security Blue Team and work on security defences that allow our systems to keep running while protecting the data of our clients and their customers.
Additionally, you will help in the identification and prioritisation of future project initiatives based on risk and execute cross-functional projects with a high degree of ownership and excellence, all while actively mentoring other team members and elevating the collective team’s capabilities and skill sets. If you are passionate about reducing risk while supporting innovation, we encourage you to apply!
You can work remotely from anywhere in the United Kingdom.
How you’ll make an impact
Guide and coach Olo’s Blue Team on Information Protection, Incident Detection and Response and Service Delivery.
You will provide strategic and technical oversight to the team and the program.
Technically lead a team of security engineers and analysts who hunt, detect, and respond to internal and external threats.
Collaborate with customers and partners to strengthen their security posture.
Drive ongoing optimisations by implementing new technologies, replacing technologies, addressing evolving threats, scaling practices and automating security activities.
Ultimately you will keep team member and customers data safe by identifying and mitigating vulnerabilities and risks by providing actionable guidance to product teams.
Information Protection
Lead Olo’s Information Protection program including the selection, testing, implementation and maintenance of security tools and services, security awareness, service provider management and the ongoing testing of those controls.
Oversee Vulnerability Management program including vulnerability assessments, risk scoring and vulnerability resolution.
Oversee Threat Hunting program to detect and mitigate advanced threats.
Manage non-event driven security reviews, including concept reviews, design reviews, patching, firewall rules and system configuration checks.
Apply Web application and API security principles and techniques, such as zero trust, RBAC, authentication, authorization, auditing, rate limiting, challenges, etc., to protect our cloud-based services from unauthorized access and abuse.
Incident Detection and Response
Oversee Incident Detection and Response program including ownership of incident response processes, tools and services and the ongoing continuous improvement of those controls.
Coordinate the detection and response to attacks through all incident phases.
Ensure incident reports are accurate, detailed and relevant.
Monitor, detect, and remediate misconfigurations and security risks across our cloud environments.
Participate in a 24/7 on-call rotation.
Security Services
Oversee Security Services program including security support requests, risk assessments, vendor assessments, PCI and SOC audit support and service provider management.
What We'll Expect from You
5+ years of Security Engineering, Security Operations or Security Architecture experience.
CISSP, GCIH or similar certification preferred.
Experience acting as technical lead to distributed teams consisting largely of remote engineers.
Experience complying with PCI-DSS and other compliance and regulatory standards.
Experience with attacker tactics, techniques and procedures.
Knowledge of information technology, evolving threats, attack patterns, incident response and cyber security standards.
Experience developing and leading incident response, remediation and mitigation activities, and providing status updates and reports.
Experience analyzing security events to discern events that qualify as a legitimate security incident as opposed to non-incidents (ie. incident investigation, implementing countermeasures, and conducting incident response).
Deep understanding of operating system, networking and application concepts.
Experience hardening Windows, MacOS, Linux Containers and Kubernetes.
Familiarity with AWS security best practices and Infrastructure-as-Code.
Experience deploying and maintaining security technologies. (e.g. Access Proxies, API Gateway, Anti-Malware, Application Control, Cloud Security Posture, Data Leak Prevention, Data Mapping, Endpoint Detection & Response, Intrusion Detection System, File Integrity Monitoring, Firewalls, Mobile Device Management, Multi Factor Authentication, SIEM, Static Inspection, Vulnerability Assessment, Web Proxies, WAF and Zero Trust).
Adept at working with internal Product & Engineering, Legal, People & Culture, Finance and GTM teams and external partners, auditors and customers.
Ability to work during critical incidents or to support coverage requirements.
About Olo
Olo is a leading restaurant technology provider with ordering, payment, and guest engagement solutions that help brands increase orders, streamline operations, and improve the guest experience. Each day, Olo processes millions of orders on its open SaaS platform, gathering the right data from each touchpoint into a single source—so restaurants can better understand and better serve every guest on every channel, every time. Over 800 restaurant brands trust Olo and its network of more than 400 integration partners to innovate on behalf of the restaurant community, accelerating technology’s positive impact and creating a world where every restaurant guest feels like a regular. Learn more at olo.com.
Applicant Privacy Notice (United Kingdom)
Автоотклики