Вакансии

Location: Paris, France; London, United Kingdom; Lisbon, Portugal; Milan, Italy; Rome, Italy; Berlin, Germany; Athens, Greece; Barcelona, Spain; Bari, Italy; Split, Croatia; Copenhagen, Denmark; Oslo, Norway; Tallinn, Estonia; Limassol, Cyprus; Budapest, Hungary; Florence, Italy; Amsterdam, Netherlands; Stockholm, Sweden; Warsaw, Poland; Kraków, Poland; Lublin, Poland; Aarhus, Denmark; Antwerp, Belgium; Baku, Azerbaijan; Basel, Switzerland; Belfast, United Kingdom; Belgrade, Serbia; Bergen, Norway; Bern, Switzerland; Birkirkara, Malta; Birmingham, United Kingdom; Bologna, Italy; Bordeaux, France; Bratislava, Slovakia; Brno, Czechia; Bruges, Belgium; Brussels, Belgium; Bucharest, Romania; Burgas, Bulgaria; Cardiff, United Kingdom; Celje, Slovenia; Chișinău, Moldova; České Budějovice, Czechia; Cluj-Napoca, Romania; Cologne, Germany; Constanța, Romania; Cork, Ireland; Coventry, United Kingdom; Craiova, Romania; Crete, Greece; Daugavpils, Latvia; Debrecen, Hungary; Derby, United Kingdom; Dnipro, Ukraine; Dresden, Germany; Dublin, Ireland; Düsseldorf, Germany; Edinburgh, United Kingdom; Frankfurt, Germany; Galway, Ireland; Gdańsk, Poland; Geneva, Switzerland; Genoa, Italy; Ghent, Belgium; Glasgow, United Kingdom; Gothenburg, Sweden; Graz, Austria; Hamburg, Germany; Helsinki, Finland; Heraklion, Greece; Iași, Romania; İstanbul, Türkiye; Kaunas, Lithuania; Kazan, Russia; Kharkiv, Ukraine; Kyiv, Ukraine; Košice, Slovakia; Larnaca, Cyprus; Leeds, United Kingdom; Leipzig, Germany; Lille, France; Liverpool, United Kingdom; Ljubljana, Slovenia; Łódź, Poland; Lviv, Ukraine; Lyon, France; Madrid, Spain; Maastricht, Netherlands; Málaga, Spain; Malmö, Sweden; Manchester, United Kingdom; Maribor, Slovenia; Marseille, France; Munich, Germany; Moscow, Russia; Nantes, France; Naples, Italy; Newcastle, United Kingdom; Nice, France; Nicosia, Cyprus; Niš, Serbia; Nizhny Novgorod, Russia; Novi Sad, Serbia; Nuremberg, Germany; Palermo, Italy; Patras, Greece; Pécs, Hungary; Pljevlja, Montenegro; Plovdiv, Bulgaria; Podgorica, Montenegro; Porto, Portugal; Poznań, Poland; Prague, Czechia; Pristina, Kosovo; Riga, Latvia; Rotterdam, Netherlands; Salzburg, Austria; Samara, Russia; San Marino; Sarajevo, Bosnia and Herzegovina; Seville, Spain; Skopje, North Macedonia; Sliema, Malta; Sofia, Bulgaria; The Hague, Netherlands; Thessaloniki, Greece; Timișoara, Romania; Tirana, Albania; Toulouse, France; Turin, Italy; Utrecht, Netherlands; Valencia, Spain; Valletta, Malta; Varna, Bulgaria; Saint Petersburg, Russia; Hanover, Germany; Zürich, Switzerland; Stuttgart, Germany; Venice, Italy; Verona, Italy; Vienna, Austria; Vilnius, Lithuania; Wrocław, Poland; Zagreb, Croatia; Zaragoza, Spain; Zrenjanin, Serbia Workplace: fully David Kennedy Recruitment is working with a rapidly growing technology company with over 50 million users worldwide that is seeking to onboard a Security Engineer to join their R&D team. As the company's sole dedicated Security Engineer, the successful candidate will take end-to-end ownership of security operations, covering application security, vulnerability management, governance and risk, and emerging AI security challenges. The company's products include adult/NSFW content, so candidates must be fully comfortable working with this material. Position: Security Engineer (AppSec / GRC / AI Security) Location: Europe/ASIA, Remote Employment type:  B2B engagement preferred DUTIES AND RESPONSIBILITIES: Application security (core of the role) Review code every week to catch vulnerabilities before they ship Find and prioritise real vulnerabilities across the stack, and drive them through to fixes Audits and pentests Coordinate external security audits and penetration tests Challenge findings where needed and follow them through to fixes Engineering and automation Automate security work and build the tools needed to scale it Use AI tools daily for code review, pentesting and scripting Ownership and communication Own security end to end with little support, deciding what matters most Explain technical risk in plain language to the team and leadership Cover security alerts, including occasional night and weekend on-call Also part of the role (lighter) Maintain a simple risk register and GRC documentation Share security updates with the team and run awareness training Monitor emerging AI threats (prompt injection, jailbreaks, content filter bypass) and incidents at AI providers Advantages AI/LLM security testing (prompt injection, jailbreaking), a strong plus Experience at an AI company or a scale-up GRC awareness Familiarity with MDM and access management REQUIREMENTS: 2+ years of hands-on security experience Hands-on AppSec experience, not compliance only: reviews code regularly and can walk through a real vulnerability found and fixed Experience coordinating an external audit or pentest and following the findings through to fixes Ships code with Git/GitHub, scripts in Python or Bash, and has recent hands-on experience on a modern web stack (e.g. Rails, Node; GCP, Heroku or similar) Has been the sole or lead security person, or owned a security area independently, with weekly code review or system testing over the last 2 years Clear communicator of risk to non-technical colleagues Uses AI tools every day in security work Hacker mindset, with security as a passion as well as a job (bug bounties, CTFs, research, write-ups or personal tools) Perfectly fluent English Comfortable working with products built on uncensored models and NSFW content BENEFITS: Fully remote working from Europe Opportunity to own security for a fast-growing AI platform with over 50 million users Direct collaboration with engineering leadership Hands-on, non-advisory role with real responsibility for security outcomes And many more!!!

Location: Georgia; European Union Workplace: Remote 🌍 Remote | UTC+8 | Core collaboration hours: 13:00–19:00 Manila Time Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia, starting in the Philippines. We combine global fintech expertise with deep local market knowledge to make financial services simple, accessible, and useful for millions of people across the region. 7M+ app downloads. 2M+ monthly active users. 7,000+ partner stores. US$310M+ raised from leading global investors. Manila-based, globally distributed, and hybrid-first — our team spans 45+ countries. If you want to solve complex problems at scale and impact how millions of people access and manage money, come build with us. Southeast Asia's fintech moment starts here. About the role: You'll build individual Android features end-to-end in Kotlin, working closely with product, design, and backend teams to ship reliable, user-facing functionality. What you'll do: - Work within a Kotlin/Jetpack Compose codebase, shipping through GitLab with automated release trains every 3 weeks - Collaborate daily with designers, product managers, backend engineers, and QA to define and deliver features - Operate inside a modern app architecture (MVI + Clean) with dependency injection and reactive data flows What you'll own: - Develop and implement individual features from scratch with high-quality, maintainable code - Integrate RESTful APIs into the Android app using OkHttp - Conduct code reviews, give feedback, and refactor code to uphold quality standards - Troubleshoot and resolve issues surfaced by users or through testing - Partner with QA to ensure proper test coverage and release quality What makes you a strong fit: - 4+ years of Android development experience with Kotlin - Strong knowledge of Android SDK and Jetpack Compose - Experience with modern app architecture (MVI + Clean principles) and dependency injection (Dagger) - Solid experience integrating RESTful APIs (OkHttp) and working with coroutines and Kotlin Flow - Practical experience writing Unit/Integration tests (Mockito, JUnit) - Comfortable with Git-based workflows and structured release cycles (GitLab, release trains) What we offer: Ownership and flexibility - Fully remote work with core collaboration hours from 13:00 to 19:00 Manila time (UTC+8) - Company-provided tools and equipment Health and time off - Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits - Access to an internal mental health support specialist - 22 vacation days, Philippine public holidays, and 15 sick days Growth and team experience - Opportunities to learn and share your expertise through internal expert meetups, external conferences, speaking opportunities, and industry publications - Company-sponsored trips to Manila to meet and work with your team in person - High-performing teams can earn a dedicated beach house week in Southeast Asia We believe strong teams are built by people with different backgrounds, experiences, and points of view. Salmon is an equal opportunity employer, and we make hiring decisions based on skills, experience, and potential.

Задачи: — разработка backend на .NET и frontend на Angular — реализация бизнес-логики — вёрстка интерфейсов по макетам в Figma — проектирование архитектуры программных решений — написание unit-тестов — участие в code review — взаимодействие с разработчиками, дизайнерами, тестировщиками, аналитиками и менеджерами проекта Требования: — уверенное владение .NET 8.0 — опыт работы с Entity Framework и PostgreSQL — практический опыт разработки на Angular 20+: RxJS, Dependency Injection, Reactive Forms — знание TypeScript, HTML и CSS — понимание принципов работы веб-приложений: HTTP, REST API, GraphQL — понимание процессов CI/CD: автоматизация сборки, тестирования и деплоя — умение проектировать чистую архитектуру и писать слабосвязанный, поддерживаемый код — знание и практическое применение архитектурных паттернов — будет плюсом: опыт разработки систем на основе микросервисной архитектуры

Описание проекта: ФастФуд. MVP корпоративной базы знаний маркетинговых исследований: одно место, где исследования хранятся, находятся и переиспользуются. Обязательные требования: — Высшее техническое образование. — Fullstack production web от 3 лет. — Готов работать на стеке продукта: TypeScript и Python. — HTTP, REST/JSON, реляционные БД, транзакции, миграции. — Системный дизайн небольшого приложения, без усложнения заранее. — Docker, Linux, Git, CI/CD, базовая наблюдаемость. — Модульные, интеграционные и end-to-end тесты. — OWASP, аутентификация и авторизация, секреты, защита данных. — Разработка в Cursor или сопоставимой ИИ-IDE по спецификациям: от технического дизайна до кода, тестов и документации Желательные навыки: — Docker/Kubernetes и облако (VK Cloud - преимущество). — Интеграция LLM: prompt management, structured output, RAG, оценка качества, стоимость, защита от prompt injection. — Keycloak, Kafka, корпоративные интеграции. — GitLab, Cursor, ADR, диаграммы как код. Задачи: — Уточнять спецификацию вместе с аналитиком и переводить ее в технический дизайн и план реализации (spec-driven development) — Проектировать прикладную архитектуру: компоненты, API, модель данных, интеграции, безопасность, логирование — Реализовывать frontend и backend, миграции, автотесты и нужные интеграции — Работать в Cursor или сопоставимой ИИ-IDE: контекст и правила проекта, декомпозиция для агента, ревью и правка сгенерированного кода — Держать инженерное качество: code review, тесты, зависимости, секреты, без критических уязвимостей — Настраивать CI/CD, контейнеры и мониторинг вместе с инфраструктурой — Выпускать небольшими инкрементами, разбирать дефекты, сопровождать в эксплуатации — Держать техническую документацию и архитектурные решения актуальным

Location: New York, NY, United States About Us Fanatics is a leading global sports platform redefining how fans connect with the teams, players and moments they love. Our businesses — Fanatics Commerce, Fanatics Collectibles, Fanatics Betting & Gaming, Fanatics Events, Fanatics Advertising, Fanatics Markets and Fanatics Studios — maximize the presence and reach for hundreds of partners globally and create a one-stop experience that allows fans to buy, bet, collect, and earn, while engaging with sports in deeper, more immersive ways. This includes licensed fan gear and lifestyle products, sportsbook and iGaming, physical and digital trading cards, live events, premium sports entertainment content, credit card offerings and more. Together, they form a powerful, integrated ecosystem — connected by the Fanatics ONE loyalty program and FanCash, the currency of sport — delivering personalized experiences to over 100 million fans worldwide. Fanatics holds partnerships with over 900 sports properties, from professional leagues and players’ associations to teams, colleges and retail partners; over 7,000 athletes and celebrities; and over 2,000 retail locations, including all Lids stores. Backed by a team of more than 22,000 employees, Fanatics is committed to relentlessly enhancing the fan experience. Overview As an Android Staff Engineer at Fanatics, you are a recognized technical leader. You operate both strategically and hands-on while leading ambitious projects, and your solutions set the standard for the team. Your bold decisions balance immediate business needs with long-term technical excellence. Through your leadership, you cultivate a culture of excellence and innovation that leaves a lasting impact on both your immediate team and the broader mobile team. We own the Fanatics App, the mobile app at  Fanatics that encompasses elements from  all of our different brands and businesses. The Fanatics App brings together Free to Play games, live events, ecommerce, and new product experiences to deliver a best-in-class  Sports platform. Fundamentally, we are one team in everything we do, from the user experience to coding and architecture. We aim to deliver on our Customer Promise by delighting our millions of monthly active users. Responsibilities Drive the development, testing, documentation, and deployment of high-quality, scalable software into production Develop a comprehensive understanding of the industry, product, and roadmap, leveraging this knowledge to shape team strategy and influence the direction of the organization Lead the end-to-end technical execution of complex features and systems, from ideation and architecture to deployment and refinement Define and enforce engineering principles, guidelines, and best practices Partner closely with product, design, and other stakeholders to make high-impact technical decisions that align with both business goals and long-term scalability Lead incident resolution as part of the on-call rotation, ensuring swift diagnosis and remediation of critical software issues Proactively identify and remove roadblocks, occasionally collaborating cross-team collaboration to maintain momentum on complex projects Conduct and elevate code reviews, sharing expertise to enhance code quality Steer team planning and design discussions, introducing innovative approaches to solve technical challenges and optimize design patterns Champion improvements to software quality, testability, operational metrics, and team documentation, setting a higher standard for the organization Mentor and coach engineers at all levels, fostering a culture of continuous learning and professional growth across the team Be open to occasional travel to Fanatics offices and other locations for conferences, events, meetings, and team-building activities Required Qualifications 7+ years of experience building highly scalable Android applications with MVI Architecture Expert-level proficiency in Kotlin, with the ability to drive best practices and mentor others in its effective use Android domain expertise, knowing the platform best practices, trends, and end user considerations Experience using Jetpack Compose and Direct Injection or ServiceLocator patterns Team-first mentality, with a willingness to do what it takes to get the job done and a desire to strive for better Excels at communicating complex technical concepts clearly and effectively to diverse audiences, including engineers, executives, and non-technical stakeholders Expertise in Agile software delivery and SCRUM methodology, with a track record of driving process improvements across teams Thrives in a high-growth environment where priorities evolve regularly and decisions are made quickly Proven ability to collaborate cross-functionally across diverse teams within large enterprise environments, driving alignment and shared success Preferred Qualifications Experience with Kotlin Multiplatform and Compose Multiplatform Experience with Material Design, ideally Material 3 Client API Design and Client Backend experience Experience with GoLang, Swift, and Java If you possess some of these qualifications but not all of them, we still encourage you to apply! #LI-AC2 Ranges will change based on country and state of residence, which are reflected in Geographical Zones defined by Fanatics Betting and Gaming. The range incorporates all of our Geographical Compensation Zones and is subject to change as the Zone associated with the actual offer is confirmed. In addition to the base and bonus, full-time employment, and more. For information about our benefits, please visit https://benefitsatfanatics.com/ Salary Range $144,000 — $235,000 USD By submitting your application, you agree to our terms of service and acknowledge you have read our Candidate Privacy Policy. Fanatics will never ask candidates for money, banking information, or other sensitive personal information as part of the interview process. If you receive a suspicious message claiming to be from Fanatics recruiting, please do not respond and report it here .

Location: London DRW is a diversified trading firm with over 3 decades of experience bringing sophisticated technology and exceptional people together to operate in markets around the world. We value autonomy and the ability to quickly pivot to capture opportunities, so we operate using our own capital and trading at our own risk. Headquartered in Chicago with offices throughout the U.S., Canada, Europe, and Asia, we trade a variety of asset classes including Fixed Income, ETFs, Equities, FX, Commodities and Energy across all major global markets. We have also leveraged our expertise and technology to expand into three non-traditional strategies: real estate, venture capital and cryptoassets. We operate with respect, curiosity and open minds. The people who thrive here share our belief that it’s not just what we do that matters–it's how we do it. DRW is a place of high expectations, integrity, innovation and a willingness to challenge consensus. About the Role DRW is building out its offensive security capability, and we’re looking for a Senior Offensive Security Engineer to lead the charge. In this role, you’ll plan and execute red team engagements, penetration tests, and adversary simulations against our trading infrastructure, corporate environment, and cloud platforms, acting as a trusted adversary who helps us find and fix weaknesses before anyone else does. You’ll work closely with our security, infrastructure, and trading teams to translate what you find into real improvements, and you’ll help shape the methodology, tooling, and roadmap for offensive security at DRW as the function matures. This is a hands-on, high-trust role for someone who thinks like an attacker, communicates like a partner, and cares about making the firm measurably harder to compromise. What You'll Do Plan and execute red team engagements and adversary simulations against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidance Design and build custom tooling, scripts, and exploits to emulate adversary behavior, test control effectiveness, and validate detection coverage Partner with the Security Engineering and SOC teams in purple-team exercises to close gaps between what attackers can do and what defenders can see Run social engineering and phishing simulations to assess and improve organizational security awareness Identify, validate, prioritize, and track vulnerabilities and control weaknesses through to remediation in collaboration with infrastructure, platform, and application owners Present engagement results and risk narratives to both technical teams and senior leadership in a way that drives action Stay current on the threat landscape, emerging TTPs, and offensive tooling, and bring that knowledge back into DRW’s defenses Assess the security of AI and LLM-integrated systems, including prompt injection, model manipulation, data poisoning, and abuse of agentic workflows, and work with teams building these systems to harden them Leverage AI-assisted tooling to accelerate reconnaissance, vulnerability discovery, and exploit development, and evaluate new AI-powered offensive techniques as they emerge Help define and mature DRW’s offensive security methodology, standards, and tooling, and mentor other engineers on the security team What We're Looking For 5+ years of hands-on experience in offensive security, penetration testing, or red teaming, including full engagement lifecycle work: reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration Strong scripting or programming ability for building and adapting offensive tooling Solid understanding of networking fundamentals, Windows, macOS, and Linux internals, identity providers, and cloud platforms Practical experience with common offensive security tools (e.g., Cobalt Strike, Metasploit, BloodHound, Burp Suite, Nmap) and a track record of building your own when the situation calls for it Working knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improve A track record of clear, precise reporting and communication and you can translate technical findings into risk that both engineers and executives understand Experience with smart contract auditing and blockchain security Familiarity with AI/ML security risks, including adversarial attacks on models, prompt injection, and the offensive and defensive implications of LLM-powered tooling A collaborative mindset: you see red teaming as a way to make the whole organization more secure, not just to find flaws For more information about DRW's processing activities and our use of job applicants' data, please view our Privacy Notice at https://drw.com/privacy-notice . California residents, please review the California Privacy Notice for information about certain legal rights at https://drw.com/california-privacy-notice . #LI-BL1

Location: New York City DRW is a diversified trading firm with over 3 decades of experience bringing sophisticated technology and exceptional people together to operate in markets around the world. We value autonomy and the ability to quickly pivot to capture opportunities, so we operate using our own capital and trading at our own risk. Headquartered in Chicago with offices throughout the U.S., Canada, Europe, and Asia, we trade a variety of asset classes including Fixed Income, ETFs, Equities, FX, Commodities and Energy across all major global markets. We have also leveraged our expertise and technology to expand into three non-traditional strategies: real estate, venture capital and cryptoassets. We operate with respect, curiosity and open minds. The people who thrive here share our belief that it’s not just what we do that matters–it's how we do it. DRW is a place of high expectations, integrity, innovation and a willingness to challenge consensus. About the Role DRW is building out its offensive security capability, and we’re looking for a Senior Offensive Security Engineer to lead the charge. In this role, you’ll plan and execute red team engagements, penetration tests, and adversary simulations against our trading infrastructure, corporate environment, and cloud platforms, acting as a trusted adversary who helps us find and fix weaknesses before anyone else does. You’ll work closely with our security, infrastructure, and trading teams to translate what you find into real improvements, and you’ll help shape the methodology, tooling, and roadmap for offensive security at DRW as the function matures. This is a hands-on, high-trust role for someone who thinks like an attacker, communicates like a partner, and cares about making the firm measurably harder to compromise. What You'll Do Plan and execute red team engagements and adversary simulations against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidance Design and build custom tooling, scripts, and exploits to emulate adversary behavior, test control effectiveness, and validate detection coverage Partner with the Security Engineering and SOC teams in purple-team exercises to close gaps between what attackers can do and what defenders can see Run social engineering and phishing simulations to assess and improve organizational security awareness Identify, validate, prioritize, and track vulnerabilities and control weaknesses through to remediation in collaboration with infrastructure, platform, and application owners Present engagement results and risk narratives to both technical teams and senior leadership in a way that drives action Stay current on the threat landscape, emerging TTPs, and offensive tooling, and bring that knowledge back into DRW’s defenses Assess the security of AI and LLM-integrated systems, including prompt injection, model manipulation, data poisoning, and abuse of agentic workflows, and work with teams building these systems to harden them Leverage AI-assisted tooling to accelerate reconnaissance, vulnerability discovery, and exploit development, and evaluate new AI-powered offensive techniques as they emerge Help define and mature DRW’s offensive security methodology, standards, and tooling, and mentor other engineers on the security team What We're Looking For 5+ years of hands-on experience in offensive security, penetration testing, or red teaming, including full engagement lifecycle work: reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration Strong scripting or programming ability for building and adapting offensive tooling Solid understanding of networking fundamentals, Windows, macOS, and Linux internals, identity providers, and cloud platforms Practical experience with common offensive security tools (e.g., Cobalt Strike, Metasploit, BloodHound, Burp Suite, Nmap) and a track record of building your own when the situation calls for it Working knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improve A track record of clear, precise reporting and communication and you can translate technical findings into risk that both engineers and executives understand Experience with smart contract auditing and blockchain security Familiarity with AI/ML security risks, including adversarial attacks on models, prompt injection, and the offensive and defensive implications of LLM-powered tooling A collaborative mindset: you see red teaming as a way to make the whole organization more secure, not just to find flaws The annual base salary range for this position is $175,000 to $275,000 depending on the candidate’s experience, qualifications, and relevant skill set. The position is also eligible for an annual discretionary bonus. In addition, DRW offers a comprehensive suite of employee benefits including group medical, pharmacy, dental and vision insurance, 401k (with discretionary employer match), short and long-term disability, life and AD&D insurance, health savings accounts, and flexible spending accounts. For more information about DRW's processing activities and our use of job applicants' data, please view our Privacy Notice at https://drw.com/privacy-notice . California residents, please review the California Privacy Notice for information about certain legal rights at https://drw.com/california-privacy-notice . #LI-BL1

Location: Chicago DRW is a diversified trading firm with over 3 decades of experience bringing sophisticated technology and exceptional people together to operate in markets around the world. We value autonomy and the ability to quickly pivot to capture opportunities, so we operate using our own capital and trading at our own risk. Headquartered in Chicago with offices throughout the U.S., Canada, Europe, and Asia, we trade a variety of asset classes including Fixed Income, ETFs, Equities, FX, Commodities and Energy across all major global markets. We have also leveraged our expertise and technology to expand into three non-traditional strategies: real estate, venture capital and cryptoassets. We operate with respect, curiosity and open minds. The people who thrive here share our belief that it’s not just what we do that matters–it's how we do it. DRW is a place of high expectations, integrity, innovation and a willingness to challenge consensus. About the Role DRW is building out its offensive security capability, and we’re looking for a Senior Offensive Security Engineer to lead the charge. In this role, you’ll plan and execute red team engagements, penetration tests, and adversary simulations against our trading infrastructure, corporate environment, and cloud platforms, acting as a trusted adversary who helps us find and fix weaknesses before anyone else does. You’ll work closely with our security, infrastructure, and trading teams to translate what you find into real improvements, and you’ll help shape the methodology, tooling, and roadmap for offensive security at DRW as the function matures. This is a hands-on, high-trust role for someone who thinks like an attacker, communicates like a partner, and cares about making the firm measurably harder to compromise. What You'll Do Plan and execute red team engagements and adversary simulations against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidance Design and build custom tooling, scripts, and exploits to emulate adversary behavior, test control effectiveness, and validate detection coverage Partner with the Security Engineering and SOC teams in purple-team exercises to close gaps between what attackers can do and what defenders can see Run social engineering and phishing simulations to assess and improve organizational security awareness Identify, validate, prioritize, and track vulnerabilities and control weaknesses through to remediation in collaboration with infrastructure, platform, and application owners Present engagement results and risk narratives to both technical teams and senior leadership in a way that drives action Stay current on the threat landscape, emerging TTPs, and offensive tooling, and bring that knowledge back into DRW’s defenses Assess the security of AI and LLM-integrated systems, including prompt injection, model manipulation, data poisoning, and abuse of agentic workflows, and work with teams building these systems to harden them Leverage AI-assisted tooling to accelerate reconnaissance, vulnerability discovery, and exploit development, and evaluate new AI-powered offensive techniques as they emerge Help define and mature DRW’s offensive security methodology, standards, and tooling, and mentor other engineers on the security team What We're Looking For 5+ years of hands-on experience in offensive security, penetration testing, or red teaming, including full engagement lifecycle work: reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration Strong scripting or programming ability for building and adapting offensive tooling Solid understanding of networking fundamentals, Windows, macOS, and Linux internals, identity providers, and cloud platforms Practical experience with common offensive security tools (e.g., Cobalt Strike, Metasploit, BloodHound, Burp Suite, Nmap) and a track record of building your own when the situation calls for it Working knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improve A track record of clear, precise reporting and communication and you can translate technical findings into risk that both engineers and executives understand Experience with smart contract auditing and blockchain security Familiarity with AI/ML security risks, including adversarial attacks on models, prompt injection, and the offensive and defensive implications of LLM-powered tooling A collaborative mindset: you see red teaming as a way to make the whole organization more secure, not just to find flaws The annual base salary range for this position is $175,000 to $275,000 depending on the candidate’s experience, qualifications, and relevant skill set. The position is also eligible for an annual discretionary bonus. In addition, DRW offers a comprehensive suite of employee benefits including group medical, pharmacy, dental and vision insurance, 401k (with discretionary employer match), short and long-term disability, life and AD&D insurance, health savings accounts, and flexible spending accounts. For more information about DRW's processing activities and our use of job applicants' data, please view our Privacy Notice at https://drw.com/privacy-notice . California residents, please review the California Privacy Notice for information about certain legal rights at https://drw.com/california-privacy-notice . #LI-BL1

Location: Montreal, Canada 📍 Location: Montreal, Quebec, Canada 📄 Employment Type: Contract-to-Permanent (Preferred) / Contract 🏢 Work Arrangement: Remote Opportunity for US and Canadian citizens. Relocation assistance + bonus for European and UK candidates. 🚀 Start Date: Immediate 💰 Compensation: TBD -- based on skills and experience Important Screening Requirements Must be legally eligible to work in Canada . Must be capable of obtaining the required security clearance . English proficiency is required. French is considered an asset. Candidates must have strong experience with fault-tolerant embedded systems supporting LEO, MEO, and/or GEO spacecraft missions. About the Role We are seeking an experienced Satellite Bus Flight Software Systems Engineer to lead and support the system-level definition, architecture, integration, verification, and operational readiness of flight software for current and next-generation spacecraft platforms. This is a systems engineering and technical leadership role at the intersection of spacecraft architecture, platform subsystems, embedded flight software, avionics, mission operations, and verification. You will ensure that spacecraft bus flight software meets platform and payload functional, performance, autonomy, safety, reliability, and operational requirements throughout the full spacecraft lifecycle—from early architecture and detailed design through integration, launch preparation, commissioning, and on-orbit operations. Key Responsibilities Translate functional, performance, safety, and security requirements into flight software requirements and architecture. Allocate requirements to software modules and execution threads while maintaining bidirectional requirements traceability. Define Flight Software (FSW) architecture, including: RTOS Initialization PUS services Autonomy Health monitoring Fault management Payload interfaces Define FDIR algorithms , isolation logic, recovery actions, safe-mode sequencing, and redundancy management. Guide the integration of FDIR logic into flight software. Develop and maintain Interface Control Documents (ICDs) for payload, platform, and ground-segment interfaces. Support Satellite Reference Database development and validation. Collaborate with payload, platform, ground-segment, and mission-operations teams to identify and resolve integration issues. Develop and support Flight Software Verification Plans and integration testing. Support SIL, HIL, fault-injection, performance, and security testing . Support verification and test automation frameworks, test case development, results analysis, and test-report certification. Support spacecraft mode and operational procedure development. Analyze on-orbit telemetry and support software updates and operational improvements. Support SOOH development and operator training. Participate in major design reviews, including SRR, PDR, CDR, MRR/TRR . Mentor junior engineers and serve as a technical liaison with customers, partners, and vendors. Contribute to engineering standards, process improvements, technology roadmaps, and lessons learned. Required Qualifications Bachelor's degree in Electrical Engineering, Aerospace Engineering, Computer Science, Embedded Systems , or a related field. 10+ years of experience working with fault-tolerant embedded systems on LEO, MEO, and/or GEO satellite missions . Experience with: CCSDS ECSS PUS services MIL-STD-1553 SpaceWire RS-422/485 CAN Ethernet Experience with real-time computing cores and/or embedded Linux . Experience with auto-coding or automated code-generation workflows. Strong understanding of aerospace systems engineering fundamentals. Hands-on experience supporting systems integration, testing, troubleshooting, and problem resolution . Experience with Confluence and JIRA . Ability to work independently with minimal supervision. Strong analytical and problem-solving skills, with the ability to break down complex technical challenges into fundamental components. Excellent written and verbal communication skills in English . Preferred Qualifications Experience with end-to-end spacecraft flight software development and integration. Experience with FDIR, spacecraft autonomy, safe-mode management, and redundancy management . Experience supporting spacecraft commissioning and on-orbit operations . Experience with SIL/HIL , fault injection, and automated verification frameworks. Experience integrating flight software with spacecraft payloads, avionics, and ground systems. French language proficiency. Experience supporting satellite programs from early concept and architecture through launch and on-orbit operations.

Location: Costa Mesa, United States 📍 Location: Costa Mesa, California, USA 📄 Employment Type: Full-Time 🏢 Work Arrangement: Remote Opportunity 🚀 Start Date: Immediate 💰 Compensation: TBD -- based on skills and experience Important Screening Requirements Must be a U.S. Citizen or U.S. Permanent Resident (Green Card holder) . Must be eligible to obtain and maintain a U.S. Department of Defense (DoD) Secret Security Clearance . Candidates should have a strong interest in supporting U.S. defense and national security programs. About the Role We are seeking a Mechanical Engineer to support the design, integration, and development of advanced air vehicle platforms. In this role, you will be responsible for designing mechanical systems, integrating electrical and mechanical subsystems, and collaborating with multidisciplinary engineering teams to deliver innovative aerospace solutions. The ideal candidate has a strong background in mechanical design, aircraft integration, and manufacturing processes, with a passion for developing next-generation air vehicles. Key Responsibilities Design and develop mechanical components and assemblies for advanced air vehicle programs. Integrate electrical and mechanical subsystems into complex aerospace platforms. Create and maintain detailed CAD models and engineering drawings. Evaluate manufacturing methods and ensure designs are optimized for production. Perform engineering analyses to support system performance, reliability, and manufacturability. Collaborate with cross-functional teams throughout the design, integration, testing, and production lifecycle. Participate in design reviews, technical trade studies, and engineering decision-making. Prepare technical documentation, engineering reports, and design specifications. Required Qualifications Bachelor's degree or higher in Mechanical Engineering, Aerospace Engineering, Electrical Engineering , or a related field. 5+ years of mechanical engineering experience supporting advanced air vehicle programs. Experience integrating electrical and mechanical subsystems into aerospace platforms. Experience designing mechanical parts using CAD software. Strong understanding of manufacturing processes, including: Machining Sheet Metal Fabrication Composite Manufacturing 3D Printing Injection Molding Composite Lamination Strong foundation in engineering fundamentals and mechanical system design. Excellent analytical, communication, and problem-solving skills. Preferred Qualifications Experience using Siemens NX and Teamcenter . Experience developing aircraft subsystem layouts and performing architectural trade studies. Experience evaluating vendor performance data and supporting supplier integration. Competency in engineering analysis, including structural, thermal, and electrical analysis. Active U.S. DoD Secret Security Clearance .

Задачи: — Проведение пентестов web-приложений и API (black-box, grey-box, white-box), включая REST, GraphQL, gRPC и WebSocket. — Тестирование безопасности AI/LLM-функциональности (Prompt Injection, Data Leakage, RAG, MCP, Agentic AI и другие сценарии по OWASP Top 10 for LLM). — Проверка механизмов аутентификации и авторизации (OAuth 2.0, OIDC, SAML, JWT, SSO, MFA), а также контроля доступа и поиска ошибок (IDOR/BOLA, эскалация привилегий, multi-tenancy). — Поиск и эксплуатация технических и бизнес-логических уязвимостей, построение сложных цепочек атак (Attack Paths). — Анализ безопасности клиентской и серверной части приложений, зависимостей, Software Supply Chain и исходного кода. — Разработка собственного offensive-инструментария, PoC, расширений Burp Suite и средств автоматизации на Python/JavaScript. — Подготовка технических отчетов с описанием рисков, рекомендациями по устранению и проведение ретестов после исправлений. — Участие в Threat Modeling, Security Architecture Review и, при желании, в активностях Purple Team. Требования: — Опыт проведения ручного пентеста web-приложений и API от 4–5 лет, уверенное владение методиками black-box, grey-box и white-box. — Глубокое понимание современных web-уязвимостей (OWASP Top 10) и практический опыт эксплуатации XSS, SSRF, SSTI, SQL/NoSQL Injection, XXE, Deserialization, CSRF, CORS, Prototype Pollution, Path Traversal и других. — Опыт тестирования REST, GraphQL, gRPC, WebSocket API, поиска бизнес-логических уязвимостей и обхода механизмов защиты приложений. — Практический опыт анализа аутентификации и авторизации (OAuth 2.0, OIDC, SAML, JWT, SSO, MFA), включая поиск ошибок реализации. — Экспертное владение Burp Suite Professional, опыт разработки собственных расширений будет преимуществом. — Уверенное знание Python и JavaScript/TypeScript для разработки PoC, эксплойтов и автоматизации тестирования. — Опыт проведения Security Research, анализа современных фреймворков и архитектур (React, Angular, Vue, Spring, .NET, Node.js, Go и др.). — Будет плюсом опыт тестирования AI/LLM-приложений, участия в Threat Modeling, Security Architecture Review или Purple Team. Условия: — Удаленная работа. — Опыт более 6 лет. — Зарплата обсуждается на собеседовании.

Location: Remote, Global Workplace: Remote ABOUT SUPABASE Supabase is the Postgres development platform, built by developers for developers. We provide a complete backend solution including Database, Auth, Storage, Edge Functions, Realtime, and Vector Search. All services are deeply integrated and designed for growth. About the Role We are looking for a Head of AI Native Operations to build the autonomous systems that run Supabase. Supabase is building an AI-native internal operating system, where agents carry the operational load end to end. We are standing up a new central team to build that platform and run it in production. This is the role that leads it, and it is hands-on. You design the architecture, build the first versions of the critical pieces, and are accountable for whether every agent we run is correct, safe, and improving over time. We build rather than buy, and there are no settled best practices for most of this yet, so you will be setting them. You will lead a team of senior individual contributors extending the platform and driving adoption across teams. What You’ll Be Responsible For In this role, you’ll: - Own the agent platform architecture: The harness and orchestration layer and connectors into company systems, shared context and memory, and the path from prototype to production. - Catch regressions before they ship: Model, prompt, and tool changes can’t ship until they pass the evals. When a new model comes out, you know within hours whether to adopt it. - Make every agent observable: Every run and every decision is traced. For any agent at any time, you can answer what it did, why, what it cost, and how its quality is trending. - Own safety and trust: Design the controls that let agents act without a human in the loop: least-privilege credentials, hard policy limits, escalation thresholds, audit logs, sandboxing, and prompt-injection defenses. - Replace workflows, don’t assist them: Pick the workflows agents can fully own today and take them to production. - Turn wins into a platform: Package what works into reusable components, templates, and eval harnesses so other teams can ship their own production agents without starting from scratch. - Build and direct the team: Hire and grow senior ICs, review their designs and pull requests, and hold the quality bar. - Measure what matters: Track workflows automated, eval pass rates, cost per run, and work absorbed against the hiring plan. How You’ll Think A Point of View on Where Automation Wins You have a thesis about how AI and automation change the way a company operates, and it comes from building, not reading. You can look at a business and say which workflows agents can own today, which they will own in 12 months as models improve, and which still need people, and why. You defend that view with evidence from systems you have shipped, and you update it when the evals tell you to. Eval-Driven You don’t trust an agent because the demo looked good. You trust it because it passes a test set of real cases, and you know which cases it fails. When anything changes, your first question is “what do the evals say?” Inversion Thinking Left alone, an autonomous system tends to fail quietly, or people route around it. So the first question about any agent isn’t “does it work on the happy path?” but “how will this break, and how will we know?” The design follows from that answer: what the agent is never allowed to do, what it escalates, and which alert fires when quality drifts. Recursive Thinking Every system you build should produce the evidence that grades it. An agent isn’t done when it works. It’s done when it tells you, without you in the loop, that it has stopped working. Must Have - Hands-on agent building: Have personally designed and built autonomous agent or LLM systems that ran in production and that others depended on. Prototypes, demos, and configuring a vendor tool don’t count. You don’t need to be a career software engineer, but you must have built these systems yourself. - Architecture depth: Can explain how the pieces fit together (orchestration, tool and data access, context and memory, tracing, evals, guardrails, deployment), with opinions on current frameworks. - Security judgment: Have shipped agents that take real actions with real permissions, and designed the controls that made that safe. - A tested point of view: Can argue, with examples from your own builds, where autonomous systems create real business leverage and where they don’t yet. - Technical leadership: Have led senior builders and set the quality bar through design and code review. Strong Signal - Have replaced a human-run business workflow (finance, operations, support, release management) end to end with an autonomous system. - Are native to Git, Markdown, and pull requests, and comfortable reading and writing Python or TypeScript. - Have taken an internal platform from zero to adoption by teams you did not control. - A software engineering background is a plus, but not required. What Success Looks Like - Six months: 20+ autonomous agents in production on the shared platform, each with an eval suite, tracing, and a named owner. - Regressions get caught, not discovered: Quality problems surface in an alert or dashboard before a user reports them. - Workflows replaced, not assisted: Multiple high-volume workflows are fully owned by agents, with humans handling only escalations. - Trusted by default: No agent causes material financial, security, or customer harm, and every agent’s permissions and actions can be audited. - Teams ship their own: At least three teams outside the core team run production agents built on the platform. - Autonomous team: Your two reports work independently, and you spend your time on architecture and review rather than execution. WHAT WE OFFER - Fully Remote We hire globally. We believe you can do your best work from anywhere. There are no Supabase offices, but we provide a WeWork membership or co-working allowance you can use anywhere in the world. - ESOP Every team member receives ESOP (equity ownership) in the company. We want everyone to share in the upside of what we’re building together. - Tech Allowance Use this budget to set up your ideal work environment—laptop, monitor, headphones, or whatever helps you do your best work. - Health Benefits Supabase covers 100% of health insurance for employees and 80% for dependents, wherever you are. Your wellbeing and your family’s health are important to us. - Annual Off-Sites Once a year, the entire company gathers in a new city for a week of connection, collaboration, and fun. It’s a highlight of our year. - Flexible Work We operate asynchronously and trust you to manage your own time. You know what needs to be done and when. - Professional Development Every team member receives an annual education allowance to spend on learning—courses, books, conferences, or anything that supports your growth. ABOUT THE TEAM Supabase was born-remote and open-source-first. We believe our globally distributed team is our secret weapon in building tools developers love. - ~400 team members - 60+ countries - 20+ languages spoken - Over $1B raised (including our $500M Series F) - 540,000+ community members We move fast, build in public, and use what we ship. If it’s in your project, we probably use it in ours too. We believe deeply in the open-source ecosystem and strive to support—not replace—existing tools and communities.

Location: Remote (United States | Canada) Workplace: Remote 1Password is growing. We’ve surpassed $500M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up with iconic partners like Oracle Red Bull Racing. About 1Password At 1Password, we’re building the foundation for a safe, productive digital future. Our mission is to unleash employee productivity without compromising security by ensuring every identity is authentic, every application sign-in is secure, and every device is trusted. We innovated the market-leading enterprise password manager and pioneered Unified Access Management, a new cybersecurity category built for the way people and AI agents work today. As one of the most loved brands in cybersecurity, we take a human-centric approach in everything from product strategy to user experience. Over 180,000 businesses, from Fortune 100 leaders to the world’s most innovative AI companies, trust 1Password to help their teams securely adopt the SaaS and AI tools they need to do their best work. If you're excited about the opportunity to contribute to the digital safety of millions, to work alongside a team of curious, driven individuals, and to solve hard problems in a fast-paced, dynamic environment, then we want to hear from you. Come join us and help shape a safer, simpler digital future. Security isn't a feature at 1Password. It is the product. We're looking for a Principal Product Manager to shape security strategy across the company, working with Security Engineering, who hold one of the highest technical bars in the industry, and with the product teams building everything our customers touch. You'll be the bridge. You'll understand cryptographic and architectural detail well enough to earn the trust of our security engineers, and you'll translate what matters into clear priorities for feature teams. Just as importantly, you'll bring a deep respect for the customer: a security control nobody can stand to use makes everyone less safe. You'll help us find the design that's both rigorous and usable, and have the credibility to say so in a room full of experts WHAT YOU'LL DO - Partner with product teams on security early. Work with PMs and feature teams to understand their upcoming roadmaps, identify security requirements and threat-model implications before designs are locked, and make sure those needs are visible, prioritized, and resourced. - Align Security Engineering with product strategy. Translate feature-team needs into prioritized security work, and make Security Engineering's priorities legible to the rest of the company so tradeoffs are made in the open. - Own an independent security roadmap. Set direction for platform-level security investments, such as key management and recovery, the cryptographic foundations of our zero-knowledge architecture, authentication, and our long-term readiness for post-quantum cryptography. - Lead our strategy for the AI era. Define how 1Password approaches agentic access to credentials, secrets for non-human identities and AI agents, and the trust models emerging around tools and protocols like MCP. - Balance risk and usability with evidence. Help security engineers weigh real-world risk against user friction, using adoption, support, and telemetry data alongside threat models. Shipping with accepted, documented residual risk is sometimes the right call, and you'll help us make and defend those decisions. - Represent 1Password to the security community. Engage with security researchers and our bug bounty program, speak at conferences, and contribute to the wider conversation about where credential security is heading. - Raise the bar for product work. Coach PMs on security thinking, challenge assumptions constructively, and set the standard for how security-critical product work gets done. OUR PHILOSOPHY ON PRODUCT CONSISTS OF FIVE CORE PILLARS: - Focus and execution: Can you ship quickly and measure results? - Customer empathy: Are you motivated first and foremost to solve customer problems? - Effective communication: Can you bring the entire organization, horizontally and vertically, along on the journey? - Go to market: Can you understand and drive business outcomes through product decisions? - Technology: Articulating how our technology beats our competitors Product Managers play a highly visible role at 1Password and are critical to the development and execution of our product strategy. As PMs, we are responsible for setting and championing a high bar for our products. At the Principal level, you also set the standard for how product work gets done. You coach, you challenge assumptions, and you make the whole team better. You must excel at prioritization, collaboration, and communication, while holding yourself and others accountable for measuring quality and business results. You will work with Engineering, Design, Security Research, and GTM teams to ensure every decision we make as a product is grounded in our commitment to verifiable security. WHAT WE'RE LOOKING FOR - 10+ years of product management experience, including significant time on security-critical products or platforms in a SaaS environment. We'll also strongly consider exceptional candidates with equivalent depth, such as security engineers or researchers who moved into product. - Deep, demonstrable knowledge of security fundamentals: cryptography, authentication protocols, identity and access management, zero-knowledge and end-to-end encrypted system design, and threat modeling. - Fluency in the credential and identity landscape, including passkeys, WebAuthn/FIDO, and the standards shaping how people sign in. - A track record of earning credibility with security engineering teams, not just working alongside them. - The ability to read and reason through technical specifications, security audits, and cryptographic design documents. - Experience making and defending risk-based tradeoffs, and explaining them clearly to engineers, executives, and customers. - A history of shipping security features that users actually adopt, and of using friction and adoption data to improve them. - Experience setting strategy at the platform or infrastructure level, and influencing roadmaps you don't own without formal authority. - Communication that scales from a security research paper to an executive briefing without losing precision in either direction. - A strong point of view on how the security landscape is shifting, and the ability to connect it to concrete roadmap decisions. STRONG PLUS - Standing in the security community, through conference talks, publications, research, open-source work, or standards participation. - Hands-on experience with AI security: agent identity and authorization, prompt injection, secrets management for automated systems. - Experience with compliance and certification regimes such as SOC 2, FedRAMP, or FIPS. - Prior work in vulnerability disclosure, incident response, or threat intelligence that gives you a practitioner's intuition. - Experience running or working closely with a bug bounty program or researcher community. WHAT YOU CAN EXPECT - Working with a passionate, highly motivated Product and Security team that holds an exceptional bar and genuinely cares about getting it right - A direct line to decisions that shape the security architecture millions of people depend on every day - Empowerment to set long-term security product strategy and drive it through execution - A culture where technical depth is respected, tradeoffs are named honestly, and shipping the right thing matters more than shipping fast - A collaborative environment where the best argument wins, regardless of title USA-based roles only: The annual base salary for this role is between $238,000 USD and $357,000 USD; 15% annual bonus, plus immediate participation in 1Password's benefits program (health, dental, 401k and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs. Canada-based roles only: The annual base salary for this role is between $208,000 CAD and $312,000 CAD; 15% annual bonus, plus immediate participation in 1Password’s generous benefits program (health, dental, RRSP and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs. At 1Password, we approach each individual's compensation with a promise of fair market value and internal equity commensurate with experience and specific skill set. This posting is for an existing vacancy. Our culture At 1Password, we prioritize collaboration, clear and transparent communication, receptiveness to feedback, and alignment with our core values: keep it simple, lead with honesty, and put people first. You’ll be part of a team that challenges the status quo, and is excited to experiment and iterate in search of the best solution. That said, 1Password is not for everyone https://blog.1password.com/inside-the-culture-powering-1passwords-next-chapter/. Our work is demanding, we strive for excellence, and the pace is fast. We need people who are keen to take on challenging problems, who seek feedback to grow, and who are driven to make an impact. If you're looking for a place where you can settle into a comfortable routine, this might not be the right fit for you. We’re looking for individuals who are proven experts in their fields, as well as those who are highly adaptable, can thrive in ambiguity and through change, are curious, and above all deliver results. How we work with AI We are committed to leveraging cutting-edge technology—including AI—to achieve our mission. We also understand that thinking critically about AI in its current forms will help us create better solutions for our customers and ourselves with its future forms, which will help us continue to close the gap between security and privacy and achieve our mission. We want team members at all levels to take the approach of actively learning AI best practices, identifying opportunities to apply AI in meaningful ways, and driving innovative solutions in their daily work. Embracing the future of AI isn't just encouraged—it's an essential part of how we will be successful at 1Password. This approach extends to our hiring process—candidates are welcome to use AI tools responsibly and thoughtfully during the application process. To us, this means we do ask that you join live interviews without using AI tools so we can get to know how you communicate, solve problems, and collaborate with others. Our approach to remote work We believe in the power of remote work, but recognize that in-person connection is important to help us achieve our mission. While we are a remote-first company, travel for in-person engagement is a part of almost all roles, and we require our employees to be ready and willing to take part. Frequency will depend on role and responsibilities, and may include, but is not limited to: annual department-wide offsites, team meetings, and customer/industry events. What we offer We believe in working hard, and rewarding that hard work through our benefits. While not an exhaustive list, here is a glance at what we currently offer: Health and wellbeing 👶 Maternity and parental leave top-up programs 🩺 Competitive health benefits 🏝 Generous PTO policy Growth and future 📈 RSU program for most employees 💸 Retirement matching program 🔑 Free 1Password account Community 🤝 Paid volunteer days 🏆 Peer-to-peer recognition through Bonusly 🌎 Remote-first work environment *Some roles in our GTM team are currently being hired for in-person hybrid work in Toronto and Austin. These roles will specify on the posting. You belong here. 1Password is proud to be an equal opportunity employer. We are committed to fostering an inclusive, diverse and equitable workplace that is built on trust, support and respect. We welcome all individuals and do not discriminate on the basis of gender identity and expression, race, ethnicity, disability, sexual orientation, colour, religion, creed, gender, national origin, age, marital status, pregnancy, sex, citizenship, education, languages spoken or veteran status. Be yourself, find your people and share the things you love. Accommodation is available upon request at any point during our recruitment process. If you require an accommodation, please speak to your talent acquisition partner or email us at nextbit@agilebits.com and we’ll work to meet your needs. Remote work is a part of our DNA. Given that our company was founded remotely in 2005, we can safely say we're experts at building remote culture. That said, remote work at 1Password does mean working from your home country. If you've got questions or concerns about this, your talent partner would be happy to address them with you. Successful applicants will be required to complete a background check that may consist of prior employment verification, reference checks, education confirmation, criminal background, publicly available social media, credit history, or other information, as permitted by local law. 1Password uses artificial intelligence (AI) and machine learning (ML) technologies, including natural language processing and predictive analytics, to assist in the initial screening of employment applications and improve our recruitment process. See here https://www.ashbyhq.com/downloadables/ashby-bias-audit-08-2024.pdf for the latest third party bias audit information. If you prefer not to have your application assessed using AI/ML features, you may opt out by completing this form https://jobs.ashbyhq.com/1password/automation-notice. For additional information see our Candidate Privacy Notice https://1password.com/files/candidate-privacy-notice.pdf.

Responsibilities: — Execution Planning and Detailed Design of the turnaround scope for the Injection Failure Mitigation Project (IFMP) by NCOC. — The project will be carried out offshore at Kashagan. — Review and work with engineering documents and construction drawings. — Support construction teams with engineering deliverables. — Prepare work packages based on detailed design, shop drawings and lookahead schedules. — Resolve technical issues, clashes, construction errors and material/design discrepancies. — Conduct technical and dimensional surveys and update drawings through RLMU. — Prepare technical queries and coordinate solutions with the engineering office. — Prepare MTOs and coordinate material requirements. — Verify materials and equipment against project requirements. — Support inspections and testing of materials and completed works. — Participate in site meetings and coordinate with project stakeholders. — Support RLMU drawing circulation and As-Built documentation. — Review/support construction method statements and lift plans when required. Conditions: — Work schedule 5/2. — Location: Aktau (Teniz Office).

Задачи: — Проектировать и развивать LLM/AI-системы и AI-агентов; — Строить многошаговые agentic workflows: routing, tool calling, state management; — Работать с Prompt Engineering и Context Engineering; — Управлять контекстом, памятью и состоянием диалога; — Реализовывать structured output и function/tool calling; — Строить RAG-пайплайны: chunking, embeddings, retrieval, reranking; — Интегрировать LLM с API, базами данных и внутренними сервисами; — Разрабатывать backend-сервисы на Go и AI-компоненты на Python; — Исследовать новые модели и подходы, быстро проверять гипотезы; — Выбирать модели с учетом качества, latency и стоимости; — Строить систему оценки качества: evals, regression tests, golden datasets, LLM-as-a-judge; — Анализировать логи и traces, улучшать качество и стабильность агентов; — Реализовывать retries, fallbacks, timeouts и обработку ошибок; — Доводить решения от прототипа до стабильного production. Требования: Go: — production-сервисы; — REST/gRPC API; — concurrency; — работа с БД; — микросервисная архитектура. Python: — AI-сервисы и backend; — async; — API; — обработка данных; — быстрое прототипирование. Также важно: — Практический опыт разработки production-приложений с LLM; — Понимание архитектуры современных AI-систем: prompt → context → tools → agent → state → evaluation; — Опыт Prompt Engineering: system prompts, few-shot, prompt chaining, structured output; — Опыт Context Engineering: memory, summarization, динамическая сборка контекста; — Опыт создания AI-агентов и agentic workflows; — Работа с LLM API и понимание особенностей разных моделей; — Понимание RAG: embeddings, vector search, retrieval, reranking, hybrid search; — Понимание evals, regression testing и анализа production-логов; — Опыт с PostgreSQL, MongoDB, Redis, Docker, Git, CI/CD; — Понимание production-подходов: observability, scalability, latency, retries, fallbacks и контроль стоимости. Будет плюсом: — Multi-agent системы; — LangGraph; — MCP; — Langfuse / LangSmith; — Elasticsearch / OpenSearch; — Open-source LLM: Qwen, Llama, DeepSeek и др.; — vLLM / Ollama; — Kafka / RabbitMQ; — Kubernetes; — Оптимизация token usage, latency и стоимости LLM; — Guardrails и защита от prompt injection; — Highload-системы. Важно: Ищем инженера, который воспринимает LLM не как простой API, а как компонент большой production-системы. Важно уметь проектировать всю логику вокруг модели: какие данные передать в контекст, какого агента или инструмент вызвать, как проверить результат, обработать ошибку и определить следующий шаг. Ищем software engineer с сильной AI/LLM-экспертизой, который умеет не только написать хороший промпт, но и довести всю систему до стабильного production-решения.

Location: Canada Workplace: remote About Xsolla Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. About the Role We're looking for a Staff Engineer to own the smart wallet and account abstraction layer of Xsolla's Web3 platform. This is an individual contributor role with outsized technical scope: you'll be the technical anchor for how millions of players get an on-chain account they never have to think about — setting direction, making hard architectural calls, and raising the bar across the org. Concretely, you'll own the account model behind Xsolla ZK, our zkSync-based L2, and the wallet that sits inside Xsolla App. Every player who signs in with Xsolla ID receives a deterministic, non-custodial smart account — derived from their identity claim, identical on every device, with private keys that never leave the client. That account is not a separate "wallet" screen: it is the player's inventory, and it backs minting, gifting, trading on our Bazaar marketplace, Merkle-based reward airdrops, gas sponsorship, and an in-app dApp browser that exposes the same signer to third-party applications through an EIP-1193 provider. You'll own the primitives underneath all of it: the ERC-4337 user operation lifecycle, EIP-7702 delegation, session keys and origin-bound Smart Sessions, paymaster and gas abstraction strategy, and the custody and recovery roadmap — including the move from raw key export to MPC custody. You will own the strategy behind account abstraction, signing, and session management at scale, and evolve our smart account and permissioning model to meet both product and compliance needs. You operate with significant autonomy, but your decisions ripple across teams — so you'll spend real time building buy-in with engineering, product, security, and legal stakeholders, not just designing in isolation. You are technically deep, calm under pressure, and comfortable being the escalation point when production wallet issues get hard — because in this domain, "hard" means a stuck user operation, a drained paymaster, or a signing prompt a player didn't understand. You write the RFCs and design docs that people actually read, and you create leverage for the broader engineering org through documentation, tooling, and mentorship — without needing a management title to do it. Responsibilities Own Smart Wallet & AA Architecture — Own the technical strategy and architecture of our smart wallet platform, covering the account model, signing, session management, and gas abstraction at scale. Design the Account & Signing Model — Design and evolve our ERC-4337 user operation lifecycle (prepare → sign → submit → confirm), EIP-7702 delegation, deterministic address derivation from identity, and the session-key and permission primitives that let players act without a prompt on every transaction. Own Gas Abstraction — Set the paymaster and gas-sponsorship strategy: what we sponsor, how we meter and cap it, how we defend it from abuse, and how it degrades when sponsorship is unavailable. Harden the dApp-Facing Surface — Own the security model where our signer meets third-party applications: EIP-1193 / EIP-6963 provider behavior, origin-bound and policy-versioned sessions, trust tiers, and the transaction and signature confirmation flow. Define what a player is actually approving, and make sure the UI can prove it. Drive Custody & Recovery — Lead the custody roadmap from today's interim mechanisms toward MPC-based custody, and design recovery paths (passkeys, guardians, social recovery) that a non-crypto-native player can complete without losing assets. Drive Cross-Team Technical Decisions — Drive decisions on account architecture, SDK contracts, data modeling, and platform reliability, and build buy-in across the wallet, marketplace, SDK, mobile, and security teams. De-Risk Proactively — Identify systemic risks — key management, signature phishing, reorgs and indexer staleness, bundler and RPC dependencies, contract upgrade paths — and lead initiatives to resolve them before they become incidents. Set Engineering Standards — Define engineering standards, review critical code, contracts, and designs, and create leverage for the team through documentation, tooling, and mentorship. Align with Stakeholders — Collaborate with product, security, legal, and infra teams to align on roadmap and translate business and regulatory needs into well-scoped technical plans. Own Production Escalations — Serve as the go-to escalation point for complex production issues in the wallet and account abstraction domain. What You Bring Account Abstraction & Smart Wallets ERC-4337 Depth — Deep, hands-on understanding of ERC-4337: EntryPoint (v0.6 through v0.8), the UserOperation lifecycle, bundler and paymaster roles, validation rules (ERC-7562), gas estimation and its failure modes, counterfactual deployment, and signature validation for undeployed accounts (ERC-6492). EIP-7702 & the Post-Pectra Landscape — Working knowledge of EOA delegation, its interaction with ERC-4337 EntryPoint v0.8, and the trade-offs and risks it introduces (residual key authority, delegation phishing, storage collisions). Smart Account Implementations — Experience building on or extending production smart account implementations (Safe, Kernel, Biconomy, Coinbase Smart Wallet, or equivalent), and familiarity with modular account standards (ERC-7579 / ERC-6900). Session Keys & Delegated Permissions — Experience designing scoped, time-limited, policy-bound authority: session keys with TTL and contract allowlists, origin binding, permission revocation, and delegated-permission standards (ERC-7710 / ERC-7715). Signature Schemes & Wallet Interfaces — Practical command of EIP-712 typed data, ERC-1271 contract signatures, WebAuthn / passkey (P-256) signers, and the wallet-facing standards: EIP-1193, EIP-6963, EIP-5792 batched calls, ERC-7677 paymaster interfaces. Production Wallet Experience — Experience designing or operating a production smart wallet or account abstraction system serving real users and real value. Production Crypto Track Record Scale in a Major Crypto Organization — Substantial engineering experience at a large crypto product or protocol organization — for example Coinbase, Kraken, Base, Safe, the Ethereum Foundation, Consensys / MetaMask — or a comparable wallet, exchange, or account-abstraction infrastructure team where wallet correctness and custody were core to the product. Operational Judgment Under Value at Risk — You have shipped and operated systems where a bug meant lost funds, and you can talk concretely about the guardrails, reviews, and rollback paths you put in place. Smart Contracts & EVM Solidity & EVM Fluency — Ability to read, review, and write account, paymaster, and module contracts; gas-aware design; upgradeability and migration patterns; working effectively with external auditors. L2 Specifics — Understanding of L2 execution differences and how they affect wallet design: native account abstraction on zkSync-family chains, transaction and fee models, finality and reorg behavior, and RPC and indexer semantics. Backend Engineering Go Engineering — Strong Go (Golang) engineering skills: idiomatic code, concurrency patterns, performance profiling. TypeScript & SDK Design — Ability to design and own client-side SDK surfaces in TypeScript that other engineering teams — internal and external — build on top of. Distributed Systems — Experience with distributed systems and their trade-offs (consistency, availability, failure modes), and with reconciling off-chain state against an authoritative on-chain result. Data & Infrastructure PostgreSQL — Schema design, query optimization, migrations at scale. Kubernetes — Deploying, operating, and debugging services in a k8s environment. Message Streaming — Kafka or NATS — event-driven patterns, consumer groups, at-least-once delivery. Git & CI/CD — Git and modern CI/CD practices. Security Key Management — Hands-on experience with key material in production: platform secure storage (Keychain / Keystore), HSMs, MPC or threshold signing, and the operational discipline around each. Wallet Threat Modeling — Solid grasp of the wallet attack surface: signature and delegation phishing, malicious dApp origins, replay and cross-chain replay, token approval abuse, and paymaster griefing and DoS. Leadership Cross-Team Initiative Leadership — Proven ability to lead multi-quarter technical initiatives across teams. Architectural Influence — Track record of influencing architecture and standards beyond your immediate team. Written & Verbal Communication — You write RFCs and design docs that people actually read. Nice to Have Experience working in the video game industry, building or operating platforms for game developers, publishers, or players Hands-on experience with the zkSync / Elastic Chain ecosystem (ZKsync OS, Matter Labs stack, native AA and paymaster flows, custom L2 operations) Experience with embedded and ecosystem wallet providers or AA infrastructure vendors (thirdweb, Privy, Dynamic, Turnkey, Pimlico, Alchemy, Biconomy, ZeroDev, Safe{Core}) — and clear views on where to build versus buy Experience with MPC / threshold custody, social recovery, or guardian-based recovery in a consumer product Experience with NFT and token infrastructure at scale: ERC-721 / ERC-1155 / ERC-20 mechanics, marketplace contracts, Merkle-based airdrop and claim distribution, chain indexing services Contributions to open-source wallet, security, or identity projects — including authorship or review of ERC / EIP standards Familiarity with compliance requirements relevant to crypto consumer products: KYC / AML, geofencing, MiCA, SOC 2, ISO 27001, GDPR data minimization, audit logging Experience with identity and auth integration for wallet derivation (OAuth 2.0 / OIDC, JWT verification, token scoping) Background in platform or infrastructure engineering — building systems other engineers build on top of Experience owning a mobile wallet surface (React Native / Expo, WebView provider injection, native signing UI) Hands-on, up-to-date experience with modern AI tools (e.g. Claude, Copilot, Cursor) for code generation, review, and accelerating day-to-day engineering work How We Work Xsolla operates across multiple time zones, and the smart wallet underpins identity, ownership, and value transfer for every Web3 product we ship. Strong written communication is essential — your architectural decisions and designs need to stand on their own and be actionable without you in the room. We value directness, technical depth, and follow-through. In this domain that means saying plainly when a design has custody, security, or reversibility implications, defending your position with evidence, and staying engaged until it's resolved. Where a decision touches player funds or key material, we expect the conservative call to be argued for explicitly rather than assumed. Benefits We are passionate about fostering a supportive environment for our team, so we prioritize the physical, mental, and emotional well-being of our employees and their families through a comprehensive Benefits Program. This includes medical, dental, and vision, PTO, and a personalized career roadmap for each employee. By investing in professional development through training and educational opportunities, we ensure that our team thrives both personally and professionally. Together, we’re not just building a business; we’re cultivating a community that values creativity, collaboration, and the transformative power of play.

Workplace: none About Utorg Founded in 2019, Utorg builds the infrastructure for stablecoin payments: on- and off-ramps, self-custodial wallets, and crypto cards. Over 2 million users across 130+ countries already buy, hold, and spend crypto through our app. On the B2B side, the same rails power 2,100+ platforms, with $2.4B+ moved to date. Fully MiCA-authorized across the EEA. PCI DSS Level 2 certified, backed by Dragonfly, TA Ventures, and Hypra. Location: Remote Tech stack Frontend: React 18/19, TypeScript, Vite, TanStack Query / Router / Table, Zustand, MUI, Tailwind + shadcn/ui, Next.js, i18next, Sentry Testing: Playwright, Vitest, Testing Library, MSW Backend: Java 17 + Spring Boot 3, Kotlin + Spring Boot 4 (new services), Node.js/TypeScript services, PostgreSQL, Redis, NATS, Temporal Infrastructure: Docker, Kubernetes (GKE), FluxCD, GitHub Actions, Cloudflare Web3: viem, ethers AI: Claude Code, MCP, custom skills and plugins, AI code review in CI The role We are looking for a senior engineer who builds product features end-to-end — mostly on the frontend, with the confidence to change the backend when the feature needs it — and who already works agent-first. Our team plans, writes, tests, and reviews code with AI agents. You will own the frontend of our payment products and help turn good AI habits into shared team workflows. The split is roughly 70% frontend / 30% backend. What you will work on Crypto on/off-ramp widget — an embeddable buy/sell flow with KYC, card payments with 3-D Secure, alternative payment methods, and a customer account area—one codebase, built for multiple white-label brands. Merchant checkout — hosted payment pages, from a simple one-step checkout to a full multi-step flow with KYC and compliance screens. Back-office admin apps — internal tools that operations, compliance, and support use every day. A legacy admin is being replaced by a new one built on a modern stack. Backend changes — API endpoints and business logic in our Java/Spring Boot services, so a feature doesn't stop at the API boundary. Responsibilities Own features from ticket to production: UI, API contract, backend change, tests, release, and monitoring. Make frontend architecture decisions and drive ongoing migrations (legacy admin → new admin, older UI libraries → modern stack, stricter type checks). Build and improve AI-driven development workflows: project context files, shared skills and commands, automated PR review in CI, agent-driven end-to-end and visual checks. Review code — both teammates' and agents' — and keep the quality bar high. Work with product, design (Figma), QA, and backend engineers in a weekly release cycle. Must have 5+ years of commercial frontend development, 3+ years with React + TypeScript in production. Solid modern React: server-state management (TanStack Query or similar), client state (Zustand/Redux), forms, routing, performance. Comfortable with large legacy codebases, not just greenfield projects. Production backend experience in at least one language. Java or Kotlin with Spring is a plus; Node.js/TypeScript, Go, or others are fine. You can design a REST API, work with PostgreSQL (schema, indexes, migrations), and ship changes in our Java services. Agentic development is your daily way of working — with Claude Code, Codex, or a similar agent, not just autocomplete. Specifically: you keep project context files ( CLAUDE.md / AGENTS.md ) and write your own skills, commands, or subagents; you connect agents to real tools through MCP (issue tracker, GitHub, Figma, databases, browser); you work in a plan → implement → verify loop, where the agent proves its work with tests, type checks, and browser automation; you run agents in parallel and headless (for example, an AI review bot in CI); you review agent output critically and know the failure modes: invented APIs, silent scope creep, "fixing" a test instead of the code, leaked secrets, prompt injection; you keep up with how agentic tools change (new features, models, practices) and bring what works into your workflow . Testing: Playwright for end-to-end, Vitest/Jest for unit and integration tests. Security-minded: real money, personal data, auth tokens, iframes, and cross-origin messaging. Fluent Russian (the team's working language). English good enough to read and write technical texts: tasks, pull requests, and docs are in English. Nice to have Payments/fintech: card flows and 3-D Secure, alternative payment methods, KYC SDKs (e.g., SumSub), fraud prevention, open banking. Web3 on the frontend: viem / ethers, wallet connection, EIP-712 signing. Multi-brand (white-label) products, theming and design tokens. OpenAPI-generated clients (Orval), TanStack Router / Table. Kotlin, Spring Boot, NATS, Temporal. Docker, Kubernetes, GitHub Actions, GitOps (FluxCD), Cloudflare Workers. How we work with AI Every main repository has AI context files and repo-specific skills. An internal plugin marketplace ships team-wide skills (code review, release flow, back-office operations). AI code review runs on pull requests in CI. It advises, and humans decide. Custom MCP servers provide agents with secure access to internal systems. The company pays for AI tooling. What we offer Fully remote work in an international team. A team where AI-first engineering is the norm, not an experiment. Real influence on architecture and on how the team works. A product at real scale: millions of users and thousands of partner platforms. Competitive salary based on individual performance review. Transparent feedback culture that values ownership and visible impact. Recruitment process Apply with your CV. Application review. HR interview with a short technical screen. Technical interview. Final interview with the CTO. Offer.

Location: United States; Canada Workplace: Remote ABOUT DOCKER Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout. We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default. _______________________________________________________________________ THE ROLE As a Senior Security Engineer, Offensive Security, you'll help drive offensive security at Docker, putting our products, platforms, and cloud infrastructure under realistic adversarial testing to surface and drive out attack paths before real adversaries find them. You'll partner with engineering, product, and leadership to turn findings into durable fixes and to shape how security is designed into every Docker product. You'll apply your expertise in penetration testing, threat modeling, and exploit development to find and eliminate risks across Docker products and infrastructure. Working across cloud infrastructure (AWS, GCP, Azure), containerized environments, and AI/ML products, you'll implement proactive security solutions that scale with Docker's growth. This role offers the opportunity to help improve security programs at a company whose products are trusted by millions of developers worldwide. You'll work in a fast-paced, technically challenging environment where your security expertise directly impacts both Docker's platform and the broader container ecosystem. _______________________________________________________________________ RESPONSIBILITIES - Contribute to security initiatives that align with business goals, helping ensure security is a core component of our products and infrastructure - Support and help implement key security programs such as automated security design reviews, and vulnerability management - Build deep knowledge of software security and architecture, and act as a go-to resource for engineering teams - Partner with engineering to design and implement security architecture and controls across Docker products and platforms - Plan, scope, and execute penetration tests and red-team / adversary-emulation engagements against Docker's products and services - Develop proof-of-concept exploits and produce clear, risk-rated findings with actionable remediation guidance, then retest fixes to confirm closure - Build and maintain offensive security tooling and automation to expand testing coverage and repeatability - Perform security reviews and threat modeling (design, architecture, and code) across Docker products and services, including emerging AI products, and write automated security tests and exploits - Serve on rotating on-call schedule to respond to security events, investigate threats, and coordinate remediation efforts - Educate and collaborate with cross-functional teams (e.g., engineering, product) to promote security practices - Participate in Security Incident response _______________________________________________________________________ QUALIFICATIONS - Have 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure - Possess 2+ years of hands-on development experience in Python or Golang - Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles. - Have strong hands-on experience with securing cloud ecosystems (e.g. AWS, GCP, Azure) - Have hands-on penetration testing experience across SaaS web applications and APIs., including manual exploitation beyond automated scanners - Are proficient with offensive tooling and techniques such as. Burp Suite, and OWASP frameworks - Can write security tests and develop exploits and proof-of-concepts that find real vulnerabilities in a product - Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks - Have practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows - Have a track record of building security programs and automations from scratch, applying risk-based prioritization - Have experience performing security reviews and building or improving security review automation - Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders - Understand industry standards, and actively keep up with emerging security technologies and models - Are a team player who drives security change via collaboration and cross-functional partnerships - Hold offensive security certifications such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO - Have published CVEs, original security research, or conference talks Bonus if you: - Have experience with container escape, Kubernetes attack paths, or cloud red teaming - Have experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning _______________________________________________________________________ WHAT TO EXPECT FIRST 30 DAYS: - Meet with security team and key partners across engineering - Gain access to team owned systems, and internal documentation - Complete security awareness training and compliance onboarding - Review application architecture, tech stack and data flow - Review risk registry and annual roadmap - Familiarize oneself with team workflows and processes - Shadow a fellow security engineer during their on-call/secops rotations FIRST 90 DAYS: - Conduct security review on emerging Docker products - Scope and execute your first penetration test against a Docker product or service - Actively participate in architecture design reviews with the team - Contribute to a Security-owned project or initiative - Collaborate with Docker developers to validate and resolve discovered vulnerabilities - Enhance incident response capabilities by participating in on-call rotation and post-incident activities - Create and maintain security documentation and runbooks FIRST YEAR OUTLOOK - Contribute to the security roadmap for improving security controls - Strengthen Zero Trust architecture and least privilege access controls - Enhance security monitoring and anomaly detection - Perform security reviews for major product releases - Own and run recurring penetration tests and adversary-emulation exercises across Docker products, and engage with external researchers - Support audits and ensure compliance with SOC 2, ISO 27xxx - Advocate for “security by design” in all product features - Become well versed in Docker products and emerging AI technologies Visa sponsorship: Not available for this role. _______________________________________________________________________   COMPENSATION & EQUITY All full-time roles include equity. Final compensation is determined on factors including but not limited to experience, skills, qualifications, and location. Canada: CA$271,150 – CA$434,000 base United States: $194,150 – $312,950 base ______________________________________________________________________ POSTING INFORMATION - Open vacancy: This posting is for an existing open role. - AI in hiring: Docker may use AI-assisted tools during our recruiting process. - Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent. ______________________________________________________________________ PERKS & BENEFITS - Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration. - Flexibility that fits your life – We trust you to manage your schedule while delivering great work. - Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break. - Home office support – Set up your workspace for comfort and success. - Technology stipend – Equivalent to US$100 net per month to help support your work. - Learning & development – Annual stipend for conferences, courses, certifications, and continued learning. - Parental leave – 16 weeks of paid parental leave after six months of employment. - Equity for all full-time employees – Share in Docker's long-term success as we continue to grow. - Comprehensive benefits – Medical, retirement, and paid holidays vary by country. - Docker swag – Because representing the whale never gets old. Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community. #LI-REMOTE