Location: London, United Kingdom - Deliveroo
Our Global Structure
Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team.
The head of EMEA Refund Fraud will lead Doordash’s EMEA strategy for preventing and managing refund abuse across our marketplace.
You will be accountable for the performance of the Credit and Refund (C&R) Fraud domain: setting the long-term vision, determining where we focus our resources, and building the team, controls and capabilities required to reduce fraud sustainably while protecting the experience of genuine customers.
This is a senior leadership role at the intersection of Integrity, Customer Care, Product, Engineering, Analytics and Finance. You will lead a team of experienced fraud and strategy professionals and work with senior leaders across Deliveroo to make complex decisions about fraud risk, customer experience, operational cost and product investment.
You will need to be comfortable operating in ambiguity, identifying problems before they become material, and turning complex and sometimes incomplete signals into a clear strategy. Success will come not from personally solving every problem, but from creating the direction, operating mechanisms and team that enable Deliveroo to manage refund fraud effectively at scale.
What You’ll Be Doing
Setting the C&R Fraud Strategy
Set and own the 1–2 year vision and strategy for C&R Fraud, translating wider Integrity and business priorities into a focused roadmap.
Proactively identify emerging risks, systemic vulnerabilities and opportunities rather than waiting for problems to be assigned.
Determine the highest-value problems for the team to solve and make clear choices about where we should (and should not) invest.
Define how we balance fraud loss, customer experience, operational cost and growth when designing controls.
Build compelling business cases for significant product, policy and operational investments.
Owning Performance and Risk
Be accountable for C&R Fraud performance and establish a clear set of outcomes, targets and guardrails.
Develop a comprehensive view of fraud exposure, including fraud cost, abuse rates, loss per order, false positives, customer impact and operational cost.
Partner with Finance and senior leadership to quantify financial exposure and inform risk appetite decisions.
Establish mechanisms to identify material changes in performance, understand their drivers and ensure effective action is taken.
Ensure the organisation can detect and respond quickly to new abuse patterns and emerging threats.
Build Scalable Fraud Prevention Capabilities
Own the effectiveness of the overall C&R fraud framework across customer and partner journeys.
Identify systemic control gaps and ensure the right preventative, detective and responsive controls are in place.
Set the direction for product decisioning, eligibility logic, automation, friction, policies and operational interventions.
Ensure rules, models and controls are continually evaluated against both fraud outcomes and customer-experience guardrails.
Create effective feedback loops between frontline investigations, Analytics, Product and Engineering so that new insights translate into better prevention.
Challenge legacy processes and controls, simplifying or retiring them where they no longer provide sufficient value.
Lead Cross-Functional Strategy and Investment
Act as the senior C&R Fraud partner to Product, Engineering, Customer Care, Merchant, Finance, Analytics and other Integrity teams.
Translate fraud problems into clear product and business opportunities and influence roadmaps outside your direct reporting line.
Lead complex decisions where fraud prevention, customer experience, commercial performance and operational efficiency are in tension.
Create alignment around priorities, decision rights and accountability without relying on excessive consensus.
Make longer-term trade-offs and ensure resources are concentrated on the initiatives with the greatest expected impact.
Communicate complex risks and recommendations clearly to senior and executive stakeholders.
Build and Lead a High-Performing Team
Lead and develop a team of experienced fraud, strategy and operations professionals.
Translate your strategy into clear, measurable outcomes for individual team members.
Empower your team to own significant problems independently while providing effective challenge, coaching and direction.
Establish strong operating mechanisms and rituals for reviewing performance, prioritisation, delivery and emerging risks.
Build capability and succession within the team, identifying development opportunities and future talent needs.
Create an inclusive environment in which different perspectives are actively sought and people are able to challenge assumptions.
Hold yourself and others accountable for delivering ambitious outcomes while maintaining focus and sustainable ways of working.
Requirements
We are looking for an experienced leader who has previously owned a meaningful fraud, risk, trust & safety, operational or related business domain. You will ideally bring:
Significant experience in fraud, risk strategy, trust & safety, marketplace integrity, strategy & operations or a related domain, typically gained over 10+ years.
Experience leading and developing experienced individual contributors and/or managers.
Demonstrated ownership of a substantial business outcome, risk domain or portfolio rather than solely individual projects.
A track record of defining and executing strategies across a 1–2 year horizon.
Experience identifying complex problems, setting direction and making high-quality decisions where the answer is not immediately clear.
Strong commercial judgement and the ability to evaluate financial impact alongside customer and operational consequences.
Experience influencing senior stakeholders across Product, Engineering, Operations, Analytics and Finance.
Strong analytical judgement and the ability to use data, customer insight and operational evidence to challenge assumptions and make decisions.
Experience translating complex problems into scalable product, policy or operational solutions.
Strong people leadership, with evidence of developing talented individuals and creating teams that operate effectively with increasing autonomy.
Excellent written and verbal communication, including the ability to turn complex analysis into clear executive-level recommendations.
Experience with refund abuse, customer claims fraud, payments fraud, marketplace abuse or adjacent fraud domains would be valuable, but deep expertise in refund fraud itself is not essential. We are equally interested in leaders who have demonstrated the ability to quickly understand a complex risk domain and build the strategy and organisation required to improve it.
What Success Looks Like
In this role, you will have built a clear and widely understood C&R Fraud strategy, established measurable outcomes and guardrails, and focused the organisation on a number of high-impact priorities.
You will have materially improved our ability to prevent and respond to refund abuse while protecting genuine customers, created a scalable control and monitoring framework, and influenced the product investments required to address systemic vulnerabilities.
You will have built a team capable of owning complex problems independently — creating an organisation that anticipates risk and continuously improves rather than reacting to the fraud we see today.
Diversity, Equity and Inclusion
At Deliveroo, we know that a great workplace reflects the world around us and that true diversity and inclusion make us stronger, more creative, and better at what we do. We’re committed to fostering an environment where everyone can do their best work and feel they belong.
We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief.
If you have a disability or long-term health condition and need support to apply for one of our roles, or require any reasonable adjustments during the recruitment process, you’ll have the opportunity to let us know once you’ve submitted your application. We’ll share details on how to request support so we can ensure you have a fair and equitable experience.
If you’re excited about making a real impact in a fast-moving marketplace and growing your career alongside ambitious, supportive teams, we’d love to hear from you!
Beware of recruitment scams: DASH Brands will never ask you to pay money or share sensitive financial information during hiring — learn more about DASH Brands' legitimate recruiting process at
careersatdoordash.com/recruitment-scam-awareness
.
headWe believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief
• Проектировать, разрабатывать и внедрять LLM/AI агентов и AI-ассистированные инструменты для процессов команды ИБ (анализ инцидентов, threat intelligence, vulnerability management, автоматизация рутинных операционных задач и др.). • Выстраивать новые рабочие процессы команды на базе AI-решений — от пилотов и MVP до продуктивной эксплуатации.
УдалённоseniorГеография найма не уточнена
Не хотите искать каждый день?
Настройте подбор один раз, и подходящие вакансии будут сами приходить в Telegram.
Настройте подбор, и подходящие вакансии будут приходить в Telegram.
Location: Belgrade; Lisbon
Workplace: OnSite
Aghanim is an integrated commerce, liveops automation, community engagement, and payments platform for video games.
Mobile games have traditionally depended on app stores for distribution, payments, and player relationships. We believe there is a better way. Aghanim helps game studios build direct relationships with players, sell directly, and build their future on their own terms. Today, more than 100 games worldwide are already building this future with Aghanim.
Our team brings together people across Los Angeles, New York, Seoul, Beijing, London, Lisbon, Belgrade and other locations around the globe, with deep expertise in gaming, fintech and technology. We move quickly, keep communication direct, and focus on getting things done. We believe the best people thrive when they have autonomy, ownership, and a stake in the company's success.
[https://app.ashbyhq.com/api/images/user-content/4f457f07-466b-477b-b552-fbbabd850111/2de3a7cd-8843-41a9-8bbe-ceb897a42c4a/Logo%20(horizontal).svg]
We’re looking for a hands-on DevSecOps Engineer to build security into our cloud infrastructure and delivery pipelines. You’ll work closely with DevOps and development teams to establish practical security standards as our platform grows.
KEY RESPONSIBILITIES
- Own cloud security on GCP: IAM, org policies, network security, and edge protection with Cloudflare.
- Harden our GKE clusters and container supply chain.
- Build automated security checks into CI/CD (SAST, dependency, container, and IaC scanning).
- Own secrets management and least-privilege access across the platform.
- Drive vulnerability and cloud posture management to remediation.
- Build security monitoring and lead incident response.
- Actively drive SOC 2 Type 2 and PCI DSS Level 1 work: implement controls, prepare evidence.
REQUIRED QUALIFICATIONS
- 5+ years in DevSecOps, cloud security, or a security-heavy DevOps/Platform role.
- Strong production experience with GCP (AWS/Azure acceptable).
- Hands-on experience securing Kubernetes and Terraform-managed infrastructure.
- Practical knowledge of CI/CD security, cloud IAM, secrets, vulnerability management, and security monitoring.
- Ability to build security practices from scratch and get teams to adopt them.
- Strong English communication skills.
NICE TO HAVE
- Experience with Cloudflare, Datadog, Wiz, Drata, or GitHub Actions.
- Prior SOC 2 or PCI DSS audit experience.
- Background in payments, gaming, or high-load products.
WHY JOIN US
- World-class team – work alongside experienced professionals from around the globe who have built products used by millions of players
- High growth, high impact – be part of a fast-growing company where ideas turn into products and reach customers in days, not months
- Autonomy and ownership – we trust people to make decisions, take initiative, and drive results
- Modern tools and technology – use AI, automation, and modern tools as part of your everyday work
- Equity – participate in the company's growth and long-term success
Location: Paris
Workplace: OnSite
Company Description
We’re http://checkout.comCheckout.com http://Checkout.com. You might not know our name, but companies like eBay, Spotify, Klarna, Uber, and Sony do, because we’re behind many of the digital experiences you use every day.
We are where the world checks out, enabling over 10 billion transactions yearly for more than one billion global shoppers.
Whether you want to book a holiday, order food, renew a subscription, or check out online, there’s a good chance our tech powers the payments behind the scenes. Our platform helps the most ambitious businesses deliver effortless digital experiences, at scale.
If you want to do career-defining work, you’ve come to the right place. We move fast, think globally, and believe great teams are built by hiring exceptional people with conviction, curiosity, and the desire to make an impact.
With 20 offices across six continents and London as our HQ, we’re shaping the future of fintech – and we’re just getting started.
Please make your application, including your CV, in English Language. We are a global compliance team headquartered out of London.
About the role
As a Senior Analyst – Permanent Controls, you will join the Permanent Controls team, a global Second Line of Defence (2LoD) function based across Paris and Mauritius. Reporting directly to the Head of Permanent Controls within the Compliance department, you will focus on the financial perimeter, exercising second-line control, independent oversight, and framework monitoring over the organization's finance domain. You will partner closely with the First Line of Defence (1LoD) to establish control standards, design control matrices, and provide guidance when needed. You will also execute 2LoD control plans, issue formal findings, and track recommendations through to resolution.
Sitting in the Second Line of Defense, the global Permanent Controls team serves as an ongoing, trusted advisor and objective challenge to operational teams (1LoD), helping them design robust controls and ensure operational integrity across the organization.
Unlike periodic audit functions, Permanent Controls operates continuously to proactively identify vulnerabilities, standardize control frameworks, and foster a strong risk culture.
Note on Governance: This is a 2LoD function focused on ongoing control design, execution, and 1LoD enablement. It is distinct and independent from the Internal Audit (3LoD) function within Checkout.com.
Key responsibilities
- Control Design: Collaborate with stakeholders to translate identified risks into comprehensive 2nd line control plans, standards, and templates.
- 1LoD Enablement: Partner with the First Line of Defence teams to design, refine, and assess their control matrices, ensuring alignment with internal standards and regulators' expectations (ACPR, FCA..).
- Execution & Testing: Formalize and execute second line permanent controls across critical perimeters, including:
- Financial regulatory reporting across global entities (France, UK, US, etc.).
- Accuracy of financial data, accounting standards, and reconciliations.
- Internal financial processes, procedures, and statutory compliance (including the Order of 3 December 2014).
- Safeguarding mechanisms (flow of funds, compliance with safeguarding measures, timelines, and incident monitoring).
- Reporting & Escalation: Present detailed control findings and anomaly reports to the Head of Permanent Controls; track the implementation of remediation recommendations.
- Proactive Continuous Improvement: Identify operational control gaps, take the initiative to propose practical solutions, and drive improvements to the overall control framework.
- Tooling & Automation: Contribute to the implementation and optimization of automated control tools, tracking dashboards, and recommendation monitoring systems whenever possible.
About You
- Experience: 5 years of experience in Financial Audit, Internal Control, or Financial Reporting within the financial services (banking, Fintech..) or payments industry.
- Regulatory Context: Familiarity with regulatory frameworks and ACPR expectations is strongly preferred.
- Mindset & Working Style:
- Proactive & Autonomous: A "go-getter" who takes ownership, anticipates control gaps, and brings actionable solutions to the table rather than waiting for direction.
- Naturally Curious: A drive to understand end-to-end business operations, data flows, and complex payment mechanics.
- Rigorous & Analytical: Meticulous attention to detail with an ability to leverage data analytics to evaluate controls, transactions and processes objectively.
- Languages: Fluency in French and English is required.
- Communication: Strong stakeholder management skills, with the ability to communicate clear findings and influence decision-making across lines of defence.
Additional Information
Bring all of you to work
We create the conditions for high performers to thrive, through real ownership, fewer blockers, and work that makes a difference from day one.
Here, you’ll move fast, take on meaningful challenges, and be recognized for the impact you deliver. It’s a place where ambition gets met with opportunity, and where your growth is in your hands.
We work as one team, and we back each other to succeed. So whatever your background or identity, if you’re ready to grow and make a difference, you’ll be right at home here.
It’s important we set you up for success and make our process as accessible as possible. So let us know in your application, or tell your recruiter directly, if you need anything to make your experience or working environment more comfortable.
Life at Checkout.com http://Checkout.com
We understand that work is just one part of your life. Our hybrid working model offers flexibility, with three days per week in the office to support collaboration and connection.
Curious about what it’s like to be part of our team? Visit our Careers Page https://www.checkout.com/careers to learn more about our culture, open roles, and what drives us.
For a closer look at daily life at Checkout.com http://Checkout.com, follow us on LinkedIn https://www.linkedin.com/company/checkout/life/ and Instagram https://www.instagram.com/checkout_com/
Location: Remote USA
Workplace: remote
ABOUT YOU
We're looking for a commercially driven, analytically sharp, and results-oriented Account Manager to join the Xsolla Offerwall team. This is an exciting opportunity to own the advertiser side of a premium rewarded inventory network at the intersection of mobile gaming, user acquisition, and advertising technology. The best candidate is someone who thrives in a fast-paced, highly collaborative environment and is passionate about helping game studios achieve their acquisition goals through performance-driven advertising.
In this client-facing role, you'll build and grow relationships with gaming studios and UA teams, optimizing campaign performance and ensuring partners get measurable results through Xsolla's Offerwall. You'll serve as a trusted advisor to advertisers, translating data into actionable strategies, and collaborate closely with Xsolla's product, operations, and technical teams to continuously improve the partner experience.
Strong account management skills, a deep familiarity with mobile gaming and performance advertising, and the ability to balance day-to-day campaign management with long-term partner growth will be key to your success. If you're energized by the intersection of gaming and performance marketing and love building meaningful advertiser relationships, we'd love to hear from you!
ABOUT US
Xsolla is a global commerce company with robust tools and services designed to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help fund, distribute, market, and monetize their games. Headquartered in Los Angeles, California, Xsolla has helped over 1,500+ game developers reach more players and grow their businesses around the world.
For more information, visit xsolla.com.
Responsibilities:
Partner Growth & Account Management
Guide new publisher integrations from onboarding through launch, nurture long-term monetization partnerships, and expand existing accounts by driving adoption and incremental revenue growth through Xsolla's Offerwall.
Balance multiple accounts and priorities in a fast-paced environment, consistently delivering results under shifting timelines.
Maintain deep knowledge of mobile advertising, the rewarded ecosystem, and app monetization models to ensure partner strategies stay competitive.
Problem Solving & Diagnostics
Serve as the first line of defense when a partner reports a performance drop, integration bug, or unexpected revenue anomaly — approaching each issue methodically: isolate the variable, form a hypothesis, and validate it against the data before proposing a fix.
Analyze data to uncover trends, diagnose challenges, and recommend optimization strategies that drive measurable revenue impact, distinguishing symptoms from root causes rather than treating surface-level fixes as solutions.
Own ambiguous, cross-functional problems end-to-end — coordinating with product, engineering, and operations to identify what's broken, why, and what the right fix is, even when the answer isn't immediately obvious.
Anticipate downstream issues before they escalate, using pattern recognition from past partner problems to flag risks proactively rather than reactively.
Strategic Relationships & Executive Communication
Own and cultivate strategic relationships with senior and executive stakeholders at publisher partners, acting as a trusted advisor rather than a transactional point of contact.
Prepare and deliver executive-level business reviews, business cases, and growth roadmaps that translate complex data and problem resolutions into clear, actionable business outcomes for senior decision-makers.
Tailor communication style and depth to the audience — distilling technical or operational detail into strategic narratives when presenting to executives, while retaining the ability to go deep on the details with day-to-day partner contacts.
Represent Xsolla in high-stakes conversations (renewals, escalations, strategic planning) where executive trust and credibility directly influence partner retention and growth.
Collaborate cross-functionally with internal product, operations, and technical teams to implement partner requirements and resolve potential blockers, and know when an issue needs to be surfaced to internal leadership.
Qualifications & Skills:
Experience
3+ years in digital media, mobile advertising, programmatic, or related SaaS/AdTech account management, sales, or business development.
Demonstrated ability to grow client portfolios, negotiate partnerships, and achieve or exceed revenue targets.
Problem-Solving Mindset
A structured approach to ambiguity — comfortable breaking down a messy, undefined problem into testable pieces rather than waiting for someone else to define the issue.
Track record of resolving complex, cross-functional issues independently, knowing when to dig in personally versus when to loop in the right internal stakeholder.
Genuine curiosity about "why" — treats every escalation or performance dip as a question to be answered with data, not just a ticket to be closed.
Resilience and resourcefulness when the first solution doesn't work; iterates rather than stalls.
Analytical Strength
Comfortable interpreting data sets (e.g., KPIs such as CPM, CTR, LTV, retention, or ARPU) and translating insights into strategy and root-cause diagnosis.
Communication & Executive Presence
Exceptional written, verbal, and presentation ability; adept at simplifying technical and performance concepts for diverse audiences, including senior and executive stakeholders.
Demonstrated experience managing strategic relationships with VP or C-level contacts, including leading executive business reviews and high-stakes partner conversations.
Proven success working with cross-functional groups, particularly product, operations, and technical teams, to drive problems to closure.
Industry Knowledge
Understanding of mobile ecosystems, rewarded ads, ad monetization strategies, and performance marketing models.
Mindset
Proactive, entrepreneurial, and results-driven; thrives in fast-moving environments with minimal structure.
Views obstacles as puzzles to be solved rather than blockers to be reported.
Tools
Proficiency in productivity and analytics tools (e.g., Google Sheets, BI dashboards, CRM platforms, and presentation software).
Benefits:
We are passionate about fostering a supportive environment for our team, so we prioritize the physical, mental, and emotional well-being of our employees and their families through a comprehensive Benefits Program. This includes 100% company-paid medical, dental, and vision plans, unlimited Flexible Time Off, and a personalized career roadmap for each employee. By investing in professional development through training and educational opportunities, we ensure that our team thrives both personally and professionally. Together, we’re not just building a business; we’re cultivating a community that values creativity, collaboration, and the transformative power of play.
Equal Employment Opportunity Statement:
Xsolla is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. We do not discriminate based on race, color, religion, sex, national origin, age, disability, sexual orientation, gender identity, or any other characteristic protected by law. We consider qualified applicants with criminal histories in accordance with the Fair Chance Act.
Criminal History Consideration:
For the Demand Account Manager, we will conduct a background check that may include the following:
Criminal history check
Employment verification
Education verification
Relevance to Job Responsibilities:
The background check is relevant to this position because of the following role responsibilities:
Working with vulnerable populations
Handling sensitive financial information/managing budgets/accessing funds
Accessing confidential company data
Ensuring compliance with regulatory requirements
Rights Under the Fair Chance Act:
Applicants are encouraged to inquire about their rights under the Fair Chance Act. If you have questions regarding our hiring practices, please contact careers@xsolla.com.
By submitting the following job application form, you consent to Xsolla processing your data for career-related inquiries and potential employment opportunities. We process your data in accordance with thisXsolla Privacy Notice for Job Applicants. Please direct any inquiries regarding your data privacy to careers@xsolla.com.
Location: United States
Workplace: Remote
ABOUT DOCKER
Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout.
We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default.
_______________________________________________________________________
The Senior Principal Software Engineer is responsible for shaping and evolving the company’s technical landscape. In addition to designing, developing, and maintaining core systems, the Senior Principal Software Engineer provides strategic guidance to align technology initiatives with business goals. This role is vital in ensuring that the platform is secure, scalable, and performant—capable of supporting rapid growth and driving innovation.
RESPONSIBILITIES
Technical Strategy & Architecture
● Define and drive the overarching technical vision, ensuring the platform meets current and future scalability, performance, and security needs
● Evaluate and select tools, frameworks, and architectures to maintain a state-of-the-art technology stack
Leadership & Mentorship
● Provide technical leadership and guidance to the engineering organization, setting best practices and standards.
● Coach and mentor engineers, fostering a culture of continuous learning and collaboration
Innovation & Research
● Investigate emerging technologies, frameworks, and best practices
● Lead prototyping initiatives and proof-of-concepts that can transform the platform’s capabilities
Scalability & Performance
● Ensure the platform is designed for high performance and can seamlessly handle increasing user loads
● Oversee performance optimization, load balancing, and capacity planning strategies
Reliability & Availability
● Design fault-tolerant, highly available systems that minimize downtime and deliver a seamless user experience Infrastructure Automation
● Advocate for and implement Infrastructure as Code (IaC) principles, CI/CD pipelines, and automation best practices
● Continuously refine deployment, testing, and operations processes to improve efficiency
Security & Compliance
● Collaborate with security experts to ensure platform integrity, compliance with industry standards, and protection of sensitive data
● Proactively address security vulnerabilities and champion secure coding practices
Cross-Functional Collaboration
● Work closely with product managers, designers, and other stakeholders to ensure technical initiatives support business objectives
● Drive alignment between engineering roadmaps and product strategies
Technical Problem-Solving
● Tackle complex architectural and technical issues, providing clear direction and innovative solutions
● Serve as an escalation point for critical system challenges
Code Quality & Reviews
● Uphold coding standards through thorough code reviews, ensuring high-quality, maintainable codebases
● Establish and enforce best practices around testing, documentation, and version control
Documentation & Knowledge Sharing
● Produce comprehensive technical documentation, including architectural diagrams, design guidelines, and operational runbooks
● Promote a transparent engineering culture by sharing insights and successes across the organization
QUALIFICATIONS
● 12+ years of software engineering experience with demonstrated expertise across multiple domains (SDLC, AI engineering, corporate systems, etc)
● Extensive software engineering experience, with a track record in designing and implementing large-scale, distributed systems
● Deep technical expertise: Proficiency in multiple programming languages, cloud platforms (e.g., AWS, Azure, GCP), and modern development frameworks
● Leadership acumen: Demonstrated ability to lead diverse engineering teams, inspire innovation, and drive successful outcomes
● Architectural vision: Proven skill in defining and driving architectural roadmaps that align with evolving business needs.
● Problem-solving ability: Expertise in diagnosing complex system issues and designing robust, scalable solutions
● Communication skills: Excellent written and verbal communication skills, capable of influencing both technical and non-technical stakeholders.
● Security conscious: Solid understanding of security best practices, compliance standards, and data protection
● Continuous improvement mindset: Passion for optimizing processes, toolchains, and workflows
● Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent practical experience
As a Senior Principal Software Engineer, you will not only architect innovative solutions but also shape the technical culture. Your leadership and expertise will be pivotal in building a resilient, cutting-edge platform that supports rapid growth and drives long-term success.
Docker considers visa sponsorship on a case-by-case basis based on business needs.
Compensation & Equity
United States: $219K – $352K + equity
______________________________________________________________________
POSTING INFORMATION
- Open vacancy: This posting is for an existing open role.
- AI in hiring: Docker may use AI-assisted tools during our recruiting process.
- Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent.
______________________________________________________________________
PERKS & BENEFITS
- Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration.
- Flexibility that fits your life – We trust you to manage your schedule while delivering great work.
- Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break.
- Home office support – Set up your workspace for comfort and success.
- Technology stipend – Equivalent to US$100 net per month to help support your work.
- Learning & development – Annual stipend for conferences, courses, certifications, and continued learning.
- Parental leave – 16 weeks of paid parental leave after six months of employment.
- Equity for all full-time employees – Share in Docker's long-term success as we continue to grow.
- Comprehensive benefits – Medical, retirement, and paid holidays vary by country.
- Docker swag – Because representing the whale never gets old.
Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community.
#LI-REMOTE
Location: Remote, Canada; Remote, United States
GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster.
The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems.
Co-create the future with us
as we build technology that transforms how the world develops software.
*
Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab.
An overview of this role
GitLab's Security Risk function is responsible for reducing risk across the security division: third-party risk (TPRM), annual security risk assessments, quarterly risk reporting, and remediation of security findings. As a Senior Security Risk Engineer, you'll take ownership of risk identification, quantification, and remediation tracking across the business, and you'll be a driving force behind automating and modernizing how the team does this work using AI and scripting. Reporting to the Security Risk Manager, you will bring expertise on risk methodology, risk-based thinking, and AI-enablement.
In this role, you'll partner closely with Security, Legal, IT, Product, and Engineering to translate technical findings and vendor risk into business-relevant risk statements and risk treatments. You’ll help surface emerging risks, and report top risks to leadership.
Some examples of our projects:
Building and maintaining a risk register that translates technical vulnerabilities, control gaps, and third-party risk findings into quantified, business-relevant risk statements.
Driving cross-functional remediation of security findings and risk issues to closure, tracked against SLAs.
Driving automation and AI-enabled improvements for risk and GRC workflows so the team can spend less time on manual work and more time on high-value risk analysis and program maturity.
What you'll do
Own risk identification, analysis, and prioritization across third-party risk (TPRM), security risk assessments, and security findings, using an established risk framework (e.g., NIST RMF, ISO 31000, or NIST 800-39).
Translate technical vulnerabilities, control gaps, and risk findings into clear, quantified risk statements that non-security stakeholders and leadership can act on.
Drive remediation of findings and risk exceptions to closure, partnering with Engineering, IT, Product, and Legal, and escalating stalled or high-severity items.
Mature and maintain a risk register and quarterly reporting cadence that gives leadership clear visibility into open risk, remediation progress, and trends.
Own and mature AI risk management, including AI impact assessments, AI risk assessments, and risk treatments, to support ISO 42001 certification.
Design, develop, and implement key risk indicators and supporting metrics for top risks in the risk register.
Identify manual, repetitive steps in risk and TPRM workflows and personally build the automation, scripting, or AI-enabled tooling to remove them.
Contribute to the roadmap for the risk program, incorporating new frameworks, regulatory changes, and lessons learned from past assessments.
Monitor the internal and external risk landscape (new frameworks, threat trends, business changes) to identify and escalate emerging risks before they become findings.
What you'll bring
5+ years of experience in security risk management, working with security-centric risk management or compliance frameworks (e.g., NIST RMF, NIST 800-39, ISO 31000). Familiarity with AI governance frameworks (e.g., ISO 42001, NIST AI RMF) is a plus.
Experience designing and executing qualitative and quantitative risk analyses that translate technical risks into measurable business impact.
A track record of driving risk assessments, risk registers, and remediation efforts to closure across IT, Procurement, Internal Audit, Legal, Product, and Engineering, in a heavily regulated or multi-entity environment.
Experience interpreting technical control requirements and translating them for both technical and non-technical stakeholders.
Demonstrated bias toward automation: you've personally built scripts, workflows, or AI-enabled tooling that reduced manual risk or GRC work, not just evaluated tools conceptually.
Comfort operating with ambiguity, managing multiple concurrent assessments, and reprioritizing under tight deadlines.
Exceptional written and verbal communication skills with demonstrated ability to translate security risks into business risks.
Strong understanding of cloud security, SaaS security models, and DevSecOps practices.
Relevant certifications (e.g., CISSP, CISM, CISA, CRISC) are preferred but not required.
About the team
The
Security Assurance
organization helps GitLab build and maintain trust by strengthening how we approach security, compliance, and risk across the company. The Security Risk team sits within that group and owns third-party risk (TPRM), security risk assessments, and remediation of security findings. The Security Risk Team performs thorough, collaborative, and efficient risk assessments as well as drive risk reduction so that GitLab can achieve its goals while maintaining a high level of security. Security Risk counterparts are Security Compliance, Security Governance and Security Enablement functions.
The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our
benefits
and
equity
. Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary.
United States Salary Range
$139,200
—
$189,000 USD
How GitLab Supports Full-Time Employees
Benefits to support your health, finances, and well-being
Flexible Paid Time Off
Team Member Resource Groups
Equity Compensation & Employee Stock Purchase Plan
Growth and Development Fund
Parental Leave
Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from
underrepresented groups
are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application.
Country Hiring Guidelines:
GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process.
Privacy Policy:
Please review our
Recruitment Privacy Policy.
Your privacy is important to us.
GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also
GitLab’s EEO Policy
and
EEO is the Law
. If you have a disability or special need that requires
accommodation
, please let us know during the
recruiting process
.
Location: Russia; Perm; Moscow
Workplace: remote
ABOUT US
Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game.
For more information, visit xsolla.com.
THE ROLE
We are hiring a Team Lead, Web3 to lead a cross-functional team of frontend, backend, smart contract and QA engineers in XsollaZK, Xsolla's Web3 ecosystem on a zkSync-based L2. Your team builds:
smart wallets built on account abstraction;
SDKs that game studios and partners use to bring players on-chain;
infrastructure backend services for tokenizing in-game items and currencies;
ecosystem dApps: a DEX, an NFT marketplace and an auction.
This is a management role. Most of your time goes to people and delivery: building the team, growing engineers, and making delivery predictable. The rest goes to technical leadership: architecture, reviews and hands-on code where it matters.
Responsibilities
WHAT YOU WILL OWN
The team: hiring, onboarding, growth and performance of frontend, backend, smart contract and QA engineers
Delivery: predictable commitments, a sustainable pace and the quality of what the team ships
How the team works: processes, engineering standards and an AI-assisted workflow
Relationships with Product, DevOps and other
Xsolla
product teams: priorities, dependencies and expectations
The technical direction of the team's product area: on-chain / off-chain architecture and key technical decisions, justified in writing
Security and reliability of what the team ships: signing flows, contracts that hold user assets, production operation and the team's on-call rotation
WHAT YOU WILL DO
People
Set clear goals and expectations for each engineer
Run regular 1:1s, performance reviews and career development conversations; give direct feedback and address underperformance
Hire engineers across disciplines: define roles, run interviews and onboard new people
Grow engineers through mentoring and build the team's next leaders
Build a culture of technical excellence, collaboration and continuous learning
Delivery
Work with Product to shape requirements, estimate and plan work
Manage scope, workload, risks and dependencies so the team delivers on its commitments
Report progress, risks and blockers to stakeholders
Lead the team through production incidents and post-mortems
Continuously improve development processes and team efficiency
Technical leadership
Review architecture and critical code across backend, frontend and smart contracts, with a focus on edge cases specific to
Xsolla
products: smart wallets, tokenization of in-game items and currencies, marketplace and auction flows
Lead key decisions on smart wallet integration (UserOperations, paymaster and gas sponsorship), session keys and the signing flow
Identify systemic risks (key management, signature phishing, bundler and
RPC
dependencies) and make sure they are addressed before they become incidents
Contribute hands-on to critical features when needed
Set up AI tooling in the repositories (Claude Code, Codex, Cursor: rules, context, harness) and drive its adoption across the team
REQUIRED
Management experience
5+ years of engineering management experience
Managing cross-functional teams that combine several disciplines (for example frontend, backend, smart contracts and QA)
Teams you led shipped dApps to production and maintained them
People leadership
Hiring and building teams: defining roles, running interviews, onboarding
Performance management: setting goals, giving feedback, running performance reviews, handling underperformance
Growing engineers: career plans, mentoring
Delivery and stakeholders
Delivery planning: estimation, sprint planning, managing scope, risks and dependencies
Working with Product and other teams on priorities and trade-offs; explaining technical trade-offs to non-technical stakeholders
Leading a team through production incidents and post-mortems
Balancing management with hands-on technical work
Technical depth
A strong technical background: hands-on engineering experience across the Web3 stack, deep enough to lead technical decisions and review work on each layer:
Web3 libraries and wallets: viem and wagmi in production; how wallet signers work (EOAs, browser and embedded wallets, smart accounts, EIP-191, EIP-712, EIP-1193); smart wallets (UserOperations, paymasters, ERC-1271)
Backend: Go and TypeScript (Node.js); processing on-chain events (idempotency, reorgs, retries); asynchronous messaging (Kafka, RabbitMQ or
NATS
); PostgreSQL and Redis; REST and gRPC API design
Frontend: React and TypeScript; web security fundamentals (
XSS
,
CSRF
,
CSP
, safe handling of signatures and keys in the browser)
Smart contracts: reading Solidity and the
EVM
(storage, gas, proxy upgrade patterns, access control); common vulnerability classes (reentrancy, front-running /
MEV
, oracle manipulation, signature replay)
Operations: Docker, Kubernetes, CI/CD; observability (we use Datadog; experience with Prometheus, Grafana, ELK / Graylog or OpenTelemetry also counts)
AI-assisted engineering
Daily hands-on use of AI coding tools (Claude Code, Codex, Cursor) for development and review, including configuring them for a repository
English
Spoken English at B2 level or higher
Nice to Have
ZK
Stack and
zk
-rollups: EraVM vs
EVM
, system contracts (ContractDeployer, NonceHolder), L1↔L2 messaging, bridging and finality
Smart contract development in Solidity with Foundry
Deeper account abstraction: ERC-4337 EntryPoint versions and validation rules (ERC-7562, ERC-6492), modular accounts (ERC-7579 / ERC-6900), session keys and delegated permissions (ERC-7710 / ERC-7715), EIP-7702
Hands-on experience with wallet and
AA
infrastructure technologies (Sequence, thirdweb, Privy, Dynamic, Turnkey, Pimlico, Alchemy, ZeroDev, Safe{Core}), with clear views on build versus buy
Key management:
HSM
,
MPC
/ threshold signing, social or guardian-based recovery
DeFi (
DEX
,
AMM
) and
NFT
marketplaces (ERC-721, ERC-1155, auctions)
go-ethereum and abigen
Managing distributed or remote teams
Gaming or fintech experience with high-load systems
HOW WE WORK
Decisions in writing.
Significant technical decisions are written up as an
RFC
or
ADR
that lays out the options and trade-offs. We discuss the document, not a blank whiteboard.
AI is part of everyday engineering.
We use AI coding tools for development and review, and we treat configuring them for a codebase as real engineering work.
HOW WE HIRE
Intro call.
Your background, your motivation and the role.
Technical interview.
Built on the
Technical depth
part of the
Required
section and the technical items in
What you will own
.
People and delivery.
Built on the
Management experience
,
People leadership
and
Delivery and stakeholders
parts of
Required
: real situations from your experience with hiring, performance, delivery and incidents.
Bar raiser.
An engineer from outside the hiring team checks that you raise the overall engineering bar.
BENEFITS
We are passionate about fostering a supportive environment for our team, so we prioritize the physical, mental, and emotional well-being of our employees and their families through a comprehensive Benefits Program. This includes medical, dental, and vision, PTO, and a personalized career roadmap for each employee. By investing in professional development through training and educational opportunities, we ensure that our team thrives both personally and professionally. Together, we're not just building a business; we're cultivating a community that values creativity, collaboration, and the transformative power of play.
EMPLOYMENT DETAILS
Location: Remote
Employment Type: Full-time
Schedule: 10:00–19:00 (flexible)
Contract: Employment agreement (entity or EOR arranged per candidate location)
EQUAL EMPLOYMENT STATEMENT
Xsolla is dedicated to creating a diverse environment and is proud to be an equal-opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, language, sexual orientation, national origin, genetics, political beliefs, disability, age, marital status, social background or other characteristics.
We are committed to compliance with all fair employment practices regarding citizenship and immigration status.
CONTACT
If you have questions regarding our hiring practices, please contact careers@xsolla.com. For more vacancies, visit xsolla.com/careers.
Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus
Workplace: hybrid
Capital.com's Product Security team protects our web and mobile applications, infrastructure, and external perimeter in a highly regulated environment. As Senior/Staff Application Security Engineer, you will raise the bar for application security across the organisation. This role is measured by leverage: how well you design, automate, and scale security processes so that many engineering teams can build securely by default.
You will lead security architecture reviews and threat modelling, increasingly with the help of AI tooling, and turn one-off security work into repeatable, self-service capabilities. The role combines deep hands-on offensive and defensive security expertise with the engineering mindset needed to automate at scale. You will work closely with development, QA, DevOps, and platform teams.
Responsibilities:
Security Architecture & Threat Modelling:
Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams
Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure
Security Automation & Tooling:
Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows
Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction
Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration
Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely
Security Testing & Vulnerability Management:
Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development
Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure
Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible
Participate in and help lead red teaming and offensive security exercises
Enablement:
Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams
Requirements:
Experience:
5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact
Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products
Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort
Technical:
Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions
Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts
Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices
Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD
Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers
Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so
Collaboration:
Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority
A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture
Nice to have:
Experience securing the AI harness: hardening LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints against prompt injection, data leakage, and insecure agent actions
Experience securing Kubernetes, including cluster hardening, RBAC, network policies, admission control, workload isolation, and image and supply-chain security
Experience securing AWS infrastructure, including IAM, network and account architecture, key and secret management, and CSPM
Experience building AI-assisted security tooling or internal self-service security platforms
Experience mentoring or technically leading a security team
Offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE
What you'll get in return:
You will join the company, that cares about work and life balance
Annual Bonus based on the performance review cycle
Generous Annual Leave Policy
Medical Insurance and Pension fund, with additional benefit packages based on the location
Hybrid working model (3 days from our modern office and 2 days fully remotely)
Comprehensive Workation Policy with 30 more remote days available.
Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.
Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus
Workplace: hybrid
Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and the backend services behind them, all in a highly regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products. You will set the direction for how we secure software at scale: you will own secure-by-design patterns and standards, lead threat modelling and architecture reviews, and define the application security baseline that engineering teams build against.
Working closely with the Product Security team and the Director of Product Security, you will guide AppSec processes and set the vision for your area without direct line management. You will treat security as a shared outcome rather than a gate, balancing strong protection with developer experience and delivery speed, and you will earn adoption through enablement rather than mandates.
Responsibilities:
Security Architecture & Standards:
Define and maintain secure-by-default reference architectures for common patterns: web apps, mobile backends, microservices, public and partner APIs, and event-driven services
Own core application security architecture decisions: authentication and authorisation, session management, API security, secrets management, multi-tenant isolation, and security logging and auditing
Lead the redesign of user authentication and the delivery of security features into the product
Develop and roll out application security standards, secure-coding guidelines, configuration standards, reusable design patterns, and architecture decision records (ADRs) that engineers can apply without a security expert in the room
Define internal policies for the safe use of AI-assisted and vibe-coding tools
Define security requirements for acquired technology and guide its secure integration
Threat Modelling & Design Review:
Establish and run a threat-modelling operating model, covering scope, cadence, templates, and facilitation, proportionate to each product's risk tier
Own the security review stage of the new product approval process, covering architecture design and configuration
Lead design reviews for high-impact initiatives: new products, new auth flows, payment and sensitive-data flows, platform migrations, and major refactors
Identify design-level risks and agree practical, prioritised mitigations with engineering teams
Secure SDLC, DevSecOps & Supply Chain:
Assess the current state of application security, propose improvements, and drive the secure SDLC strategy with Engineering and Security leadership
Oversee AppSec processes and own the tooling strategy (SAST, DAST, IAST, SCA, and secrets scanning), including how findings flow back to engineering
Embed security controls as guardrails in CI/CD through policy-as-code, with agreed enforcement and escalation paths
Partner with DevOps to organise repository management and prevent supply-chain attacks, covering safe component usage, dependency management, SBOMs, and build integrity
Improve the security of our internal tools
Requirements:
Experience:
8+ years in technology, including 5+ years in a dedicated application or product security role, with a strong engineering background and hands-on architecture or design ownership
Proven track record creating, documenting, and rolling out security standards, patterns, and best practices across a complex engineering organisation
Deep, demonstrable threat-modelling experience across product portfolios
Technical:
Experience designing and implementing a secure SDLC in a cloud-native environment. Strong AWS knowledge is required, and exposure to GCP or other clouds is welcome
Strong command of OWASP standards (Top 10, ASVS) and DevSecOps practice, including AppSec tooling (SAST, DAST, IAST, SCA, secrets scanning) and vulnerability management
Deep understanding of modern distributed architectures: microservices, REST and GraphQL APIs, event-driven systems, OAuth2/OIDC, and containerised workloads (Docker, Kubernetes). You should be able to reason about their trust boundaries, attack surface, and data flows across web and mobile clients
Collaboration:
Exceptional ability to influence and align engineering teams without direct authority, and to brief both engineers and executives
Pragmatism and strategic thinking: you balance the ideal with the achievable, protect delivery throughput, and turn long-term direction into an actionable plan
Clear written communication through diagrams, ADRs, and patterns, plus a track record of mentoring and cross-functional collaboration
Nice to have:
Experience in fintech, trading, brokerage, or another regulated environment
Awareness of relevant regulatory and compliance drivers: FCA and CySEC operational resilience, GDPR, and PCI DSS
Software supply-chain security, including SBOMs and artifact and build integrity
Experience securing AI-integrated product features, or using AI to scale an AppSec programme
Experience building or running a Security Champions programme
CSSLP, GIAC GDSA, or a hands-on offensive security certification. Certifications are valued but secondary to demonstrated experience
What you'll get in return:
You will join the company, that cares about work and life balance
Annual Bonus based on the performance review cycle
Generous Annual Leave Policy
Medical Insurance and Pension fund, with additional benefit packages based on the location
Hybrid working model (3 days from our modern office and 2 days fully remotely)
Comprehensive Workation Policy with 30 more remote days available.
Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.
Location: United States
Action1 is an autonomous patch management platform trusted by many Fortune 500 companies. Cloud-native, infinitely scalable, highly secure, and configurable in 5 minutes, it just works and is always free for the first 200 endpoints, with no functional limits. By pioneering autonomous OS and third-party application patching, Action1 helps organizations eliminate routine work, reduce ransomware and security risks, and protect the digital employee experience. It provides real-time vulnerability assessment and remediation across remote and on-site endpoints without requiring a VPN, while peer-to-peer patch distribution reduces bandwidth use on local networks.
In 2026, Action1 was recognized as the fastest-growing founder-led cybersecurity company in America on the Inc. 5000. Action1 is led by industry veterans Alex Vovk and Mike Walters, American entrepreneurs who founded Netwrix, which has grown into an industry-leading, multibillion-dollar cybersecurity company.
We are looking for a Dev Manager to lead the engineering team responsible for integrations between our product and external systems, including the Integrations Store. You will combine engineering leadership with hands-on technical expertise to deliver secure, reliable integrations that fit our customers' workflows.
What you'll do:
Lead and develop a team of engineers, providing technical direction, mentoring, and regular feedback.
Own delivery outcomes within the agreed scope, provide practical estimates, and make capacity and priority tradeoffs visible.
Delegate ownership to engineers and, as the team grows, team leads; distinguish near-term delivery from long-term capability development. Keep the role to no more than three clearly defined focus areas, with team leads taking ownership as capacity grows.
Work with Product Management to define priorities, plan delivery, and translate customer needs into integration capabilities.
Oversee the design, development, and maintenance of integrations, including:
- Connectors to third-party applications and services.
- An Integrations Store for discovering and managing available integrations.
- Data mapping, validation, and synchronization between systems.
- Authentication, authorization, and secure credential handling.
- Monitoring, troubleshooting, and recovery from integration failures.
Guide technical decisions within the assigned domain from solution design through development and production rollout, coordinating cross-cutting architecture and security decisions with their designated owners.
Establish reusable integration patterns that handle retries, rate limits, duplicate events, and API version changes reliably.
Own automated pipelines for building, testing, validating, and deploying integrations.
Improve integration reliability, performance, and observability, and guide the team in resolving production issues.
Coordinate with other engineering teams and external partners to manage dependencies and compatibility.
Apply AI technologies where they improve integration development, testing, or support, with appropriate validation of outputs.
Requirements
What we're looking for:
Experience leading software engineers and owning the delivery and operation of production systems.
Strong software engineering fundamentals and the ability to contribute to technical problem-solving.
Excellent knowledge of Node.js, JavaScript, and TypeScript.
Experience building and operating AWS services in production.
Hands-on experience designing and maintaining APIs and integrations with external systems.
Understanding of distributed systems, asynchronous processing, data consistency, and failure recovery.
Proficiency in SQL and experience with data modeling, aggregation, and query performance.
Experience with secure authentication and authorization for integrations.
Strong communication skills and the ability to align engineering work with product priorities.
Professional working proficiency in English for leading an English-speaking team and collaborating across functions.
Nice to have:
Experience writing automated integration and contract tests.
Proficiency in SQL.
Experience with runtime isolation and sandboxing for sensitive execution.
Experience in B2B SaaS, security, compliance, or data governance.
Experience building high-load products with numerous endpoints.
Experience maintaining integrations across multiple third-party API versions.
Benefits
Fully remote work with flexibility to support your work-life balance.
A collaborative environment that empowers you to own your domain and implement best practices.
Stable income, benefits, flexible working hours, and opportunities for career advancement.
Friendly, professional colleagues who are eager to support you and help you grow.
Engaging challenges and opportunities to make a meaningful impact.
Location: Limassol, Cyprus
The System & Infrastructure Administrator is responsible for the day-to-day administration, support, security, and reliable operation of the company’s corporate IT environment. The role ensures that user access, infrastructure, internal services, networks, endpoints, and core business systems remain available, secure, and properly maintained to support daily business operations.
Responsibilities
Manage the full employee access lifecycle (Joiner–Mover–Leaver) across Microsoft 365, Active Directory, GitLab, 1C-related systems, Slack, ClickUp, Vaultwarden, VPN, file storage, and other corporate services.
Provision and revoke accounts, access, licences, MFA, SSO, VPN access, equipment, and company assets; update access promptly when employees change roles or leave.
Administer Microsoft 365/Entra ID, Windows Server, Active Directory, Group Policy, DNS, DHCP, file services, Linux systems, and SMB-based shared storage.
Maintain server and virtualisation infrastructure, storage, backups, internal services, and remote-access solutions.
Administer office networks, Wi-Fi, VLANs, VPNs, firewalls, switches, routers, DNS records, domains, and TLS certificates.
Monitor infrastructure and backup jobs, perform regular recovery tests, apply patches and updates, and troubleshoot incidents.
Operate endpoint protection, EDR, vulnerability-management, logging, and SIEM tools; triage alerts and escalate security incidents when required.
Provide infrastructure-level support for SWIFT, 1C-related systems, corporate websites, and internal web services.
Provide L2–L3 support for employee endpoints and workplace technology, including advanced troubleshooting, hardware replacement, OS and application issues, access-related problems, encryption, VPN connectivity, and escalated technical incidents.
Manage the lifecycle of laptops, peripherals, IT assets, software licences, subscriptions, repairs, and approved purchases.
Maintain technical documentation, asset and access records, recovery procedures, and operational runbooks; automate repetitive tasks where appropriate.
Requirements
3+ years of hands-on experience in system administration, infrastructure support, or corporate IT operations.
Strong practical knowledge of Windows Server, Active Directory, Group Policy, Microsoft 365/Entra ID, DNS, DHCP, and access management.
Working knowledge of Linux administration and troubleshooting.
Strong understanding of TCP/IP, VLANs, routing, NAT, VPNs, Wi-Fi, firewalls, NAS, and SMB.
Experience with virtualisation, Proxmox, ZFS, LVM, storage systems, backup systems, and recovery procedures.
Experience with Docker, GitLab CI, and container registries.
Understanding of RBAC, least privilege, MFA, SSO, privileged and service accounts, access reviews, patching, endpoint security, and incident escalation.
General knowledge of cloud providers and cloud concepts, including compute, storage, networking, IAM, monitoring, backups, shared responsibility, and basic cost awareness.
Experience supporting employee devices at L2–L3 level and working with an ITSM/helpdesk system.
Basic automation skills in PowerShell, Bash, Python, Ansible, or APIs.
Good written English and the ability to maintain clear technical documentation.
Nice to Have
Hands-on experience with AWS, including IAM, EC2, VPC, S3, Route 53, CloudWatch, or AWS Backup.
Experience operating or troubleshooting Kubernetes clusters.
Experience with SIEM, EDR, vulnerability scanners, PKI, certificate automation, or secrets-management systems.
Experience supporting 1C, SWIFT, financial systems, Microsoft Intune, or ITAM/CMDB platforms.
Benefits
Competitive salary;
Annual performance bonus;
Access to our Limassol offices, including daily drinks and snacks, as well as parking facilities;
Working hours are from 9:00 to 18:00, with a shorter day on Fridays until 16:30;
24 working days of paid annual leave, in addition to statutory public and bank holidays in Cyprus;
14 working days of paid sick leave per calendar year;
Work permit sponsorship and full support with all related arrangements;
The opportunity to participate in corporate sports activities and events, and receive corporate gifts.
Location: Remote; San Francisco; New York
Workplace: Remote
Patreon is a media and community platform where over 300,000 creators give their biggest fans access to exclusive work and experiences. We offer creators a variety of ways to engage with their fans and build a lasting business including: paid memberships, free memberships, community chats, live video, and selling to fans directly with one-time purchases.
Ultimately our goal is simple: fund the creative class. And we're leaders in that space, with:
- $10 billion+ generated by creators since Patreon's inception
- 100 million+ free memberships for fans who may not be ready to pay just yet, and
- 25 million+ paid memberships on Patreon today.
We're continuing to invest heavily in building the best creator platform with the best team in the creator economy and are looking for a Security Engineer to support our mission.
This role is Fully Remote (US only), or can be based in New York or San Francisco (where it is open to those who are able to be in-office 3 days per week on a hybrid work model.)
About the Team
Patreon’s security team works to protect Patreon creators and their fans. The team deals with all facets of Patreon’s security, including application security, infrastructure security, and internal/corporate security. We’re a small but effective team. We write code to solve security problems and work closely with our partners across the engineering organization. We also understand the importance of balancing security risks against business needs. We strive for honest and effective communication and focus on pragmatically reducing risk over checking boxes. The security team is part of Patreon’s Risk Engineering org, which also includes our Safety Engineering and Identity and Access teams. Collectively, the risk org tackles a range of problems including content moderation, internal tooling, identity verification, access control, and account security.
About the Role
In this role, you’ll be a member of our Security team. You’ll split your time between contributing to security projects and responding to security investigations, vulnerabilities, or questions. The work spans application security, infrastructure security, and internal/corporate security. It includes both proactive and reactive security work. You’ll be part of an on-call rotation and help respond to security incidents and investigations. You’ll write code – both to support security work and to improve the security of the Patreon platform. You’ll work closely with other members of the security team, the wider Risk engineering org, and cross functional partners in engineering, legal, and IT. Your work will help reduce known risks and will protect the security, privacy, and trust of Patreon creators and their fans.
What you’ll need:
- You have two or more years of experience reducing security risks in the application, infrastructure, or corporate security spaces. You can create a threat model and to explain why a given risk matters and what we might do to reduce it.
- You have deeper knowledge (three or more years) in at least one security or security-adjacent domain (infrastructure security, application security, cloud security, corporate/IT security, cryptography, privacy, etc.)
- You can develop software (Python, Rust, Golang, or a similar language). You have experience working in a modern software development environment (git, CI/CD, LLM coding tools, etc.)
- You have experience using AI tools (LLMs, ML models, etc) to identify and address security issues (software vulnerabilities, detection and response, etc.)
- You’re energized by fast iteration: shipping MVPs, testing hypotheses, and evolving products based on what creators and fans respond to.
- You take pride in creating elegant solutions to messy, real-world problems and balancing pragmatic trade-offs between security risks and business needs.
- You believe in Patreon’s mission: giving creators control over their work and building communities that feel good to be in.
- Bachelor’s or Master’s degree in Computer Science, Computer Engineering, or a related field, or the equivalent
Bonus if you have:
- Experience working on large scale Internet platforms that allow users to upload content.
- Past contributions to large scale, production code bases.
- Experience responding to security incidents, investigating incident impact, and building out incident mitigations.
We hire talented and passionate people from different backgrounds because workplace diversity and inclusion is critical to our ability to serve creators worldwide. If you’re excited about a role but your past experience doesn’t match with every bullet point outlined above, we strongly encourage you to apply anyway. If you’re a creator at heart, are energized by our mission, and share our company values, we’d love to hear from you.
About Patreon
Patreon powers creators to do what they love and get paid by the people who love what they do. Our team is passionate about making this mission and our core values come to life every day in our work. Through this work, our Patronauts:
- Put Creators First | They’re the reason we’re here. When creators win, we win.
- Build with Craft | We sign our name to every deliverable, just like the creators we serve.
- Make it Happen | We don’t quit. We learn and deliver.
- Win Together | We grow as individuals. We win as a team.
Patreon is proud to be an equal opportunity employer. We provide employment opportunities without regard to age, race, color, ancestry, national origin, religion, disability, sex, gender identity or expression, sexual orientation, veteran status, or any other protected class. If you need a reasonable accommodation during the interview process, please let us know via email at accommodations@patreon.
Patreon offers a competitive benefits package including and not limited to salary, equity plans, healthcare, flexible time off, company holidays and recharge days, commuter benefits, lifestyle stipends, learning and development stipends, patronage, parental leave, and 401k plan with matching.
Patreon operates under a hybrid work model, where employees based in office locations are expected to come into the office three days per week, excluding sick time and paid leave. The goal of this policy is to be intentional about the in-person time we spend together to strengthen the feeling of community at Patreon. Candidates hired into remote-eligible roles are not expected to meet the same requirements.
At Patreon, we believe in fair and transparent pay. In compliance with New York and California pay transparency laws, we are sharing the expected salary range for this role.
The posted salary range is dependent on the location and the level. This range may encompass multiple levels within the role’s job family. The final offer will be based on candidate’s experience, skills, competencies, and geographic location, aligning with the appropriate job level within Patreon’s leveling framework. For remote employees located outside CA and NY, salary may vary based on location and local market conditions.
Patreon reserves the right to modify or update compensation and benefits at any time.
Location: Paris
Workplace: Hybrid
ABOUT VOODOO
Founded in 2013, Voodoo is a tech company that creates mobile games and apps with a mission to entertain the world. Gathering 800 employees, 7 billion downloads, and over 200 million active users, Voodoo is the #3 mobile publisher worldwide in terms of downloads after Google and Meta. Our portfolio includes chart-topping games like Mob Control and Block Jam, alongside popular apps such as BeReal and Wizz.
TEAM
The Engineering & Data team builds innovative tech products and platforms to support the impressive growth of their gaming and consumer apps which allow Voodoo to stay at the forefront of the mobile industry. The Engineering & Data team plays a key role in Voodoo's long-term strategy. It enables Voodoo to both accelerate product diversification and provide a state of the art growth-engine to distribute and scale our games. They create innovative solutions that drive growth with a pragmatic approach, ranging from simple searching to complex machine learning systems.
ROLE
We’re looking for a Senior Security Engineer to join our Engineering & Data team. In this role, you’ll be responsible for a wide variety of topics:
- Security Engineering & Guardrails: Architect, construct, and maintain automated security guardrails and paved paths to foster secure-by-default development environments.
- Shift-Left Architecture Guidance: Collaborate with development teams during the early ideation and design phases to embed secure coding practices and architecture from inception.
- Continuous & Automated Assessment: Develop automated, continuous assessment capabilities that replace manual reviews and scale seamlessly across the business unit.
- Hands-on Code Contribution: Work directly alongside engineers to contribute code for security fixes and paved-path solutions, ensuring security remains the simplest route.
- Self-Service Tooling: Partner with developers to build scalable, self-service security tools that empower teams to detect and remediate risks independently.
- Preventive & Detective Controls: Implement robust preventive and detective controls to deliver ongoing assurance rather than point-in-time security checks.
- Strategic Collaboration & Incident Response: Drive long-term security strategy with key stakeholders while actively participating in periodic on-call rotations for incident support.
- AI-Driven Security Innovation: Utilize AI technologies and methodologies to streamline threat detection, accelerate security evaluations, and advance scalable system protection.
PROFILE (MUST HAVE)
- 5+ years of experience troubleshooting systems, analyzing logs, and automating complex tasks via command-line tools
- 5+ years of experience identifying security vulnerabilities, assessing risks, and constructing mitigation strategies
- 5+ years of hands-on experience with scripting, software development, and security-focused code reviews across standard programming languages
- Demonstrated expertise in recognizing industry-standard security vulnerabilities, understanding threat vector patterns, and applying effective remediation techniques
- Proven track record in a leadership or guidance role, such as a technical lead, mentor, or engineering team lead
- Proficiency in applying threat modeling and comprehensive risk identification methodologies
- Proven track record securing microservices, service-oriented architectures, and web services
- Experience with identity provider servers and authentication protocols (such as OAuth2, OIDC, SAML)
- Experience with penetration testing (pentest) and vulnerability assessments
- Self-starter with strong ownership, accountability, and ability to work autonomously and collaboratively across teams and organizations in a fast-paced environment.
PROFILE (NICE TO HAVE)
- Advocate for security standards with clarity and empathy.
- Familiarity with AI/ML workflows and agents.
OUR STACK
Terraform, Kubernetes, Prometheus, ArgoCD, CircleCI, GitHub Actions, Atlantis, Grafana, Claude Code, Trivy, Conftest / OPA, AWS IAM Identity Center (SSO), Okta, AWS Secrets Manager, AWS KMS, AWS WAFv2, AWS Shield, AWS ACM, AWS GuardDuty, Sealed Secrets, Kyverno, cert-manager
BENEFITS
- Competitive salary based on experience
- Swile Lunch voucher
- Gymlib (100% covered by Voodoo)
- Premium healthcare coverage with SideCare, 100% covered for you and your family
- Wellness activities in our Paris office
- Remote Fridays
Location: Madrid, Spain
Workplace: hybrid
Are you ready to join our digital revolution journey?
At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.
Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.
With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career.
We are looking for an experienced and operationally sharp Security Operations & Incident Response Analyst (L3) to join Aleph's global IT Security team.
Reporting to the Global CISO, you will be the first line of defence when incidents occur and the engine behind the team's threat detection and response capabilities. You will own the end-to-end incident response process, lead threat hunting and intelligence activities, and manage the vulnerability and identity governance programmes — ensuring Aleph is both able to detect threats quickly and respond to them effectively across a complex, globally distributed environment.
What you'll do:
Incident Response
Own and coordinate the
end-to-end incident response process
: identification, triage, containment, eradication, recovery, and post-incident review (lessons learned).
Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources.
Maintain and continuously improve
incident response playbooks
for the most relevant threat scenarios (ransomware, phishing, account compromise, data breach, insider threat, etc.).
Manage the
security incident log and register
: track all incidents, document timelines and actions, and produce trend analysis and reporting for the CISO.
Coordinate with external
SOC or MDR providers
where applicable: review daily reports, validate alert quality, and manage escalation workflows.
Data Breach Management
Lead
data breach investigations
: scope the breach, gather and preserve evidence, assess PII exposure, and coordinate response with Legal, Privacy, and HR.
Produce breach investigation reports with findings, root cause, and recommendations.
Threat Hunting & Intelligence
Conduct
proactive threat hunting
across the environment: develop hypotheses based on threat intelligence, search for indicators of compromise (IoCs), and investigate anomalous behaviour.
Manage the
Threat Intelligence function
: track relevant threat actors, TTPs (MITRE ATT&CK), and sector-specific threat campaigns; integrate intelligence into SIEM/XDR detection rules and hunting queries.
Produce threat intelligence summaries and briefings for the CISO and relevant stakeholders.
Vulnerability Management
Own the
vulnerability management programme
: schedule and execute periodic vulnerability scans across infrastructure, endpoints, and cloud environments.
Analyse scan results, prioritise findings by risk and exploitability, and coordinate remediation with IT Operations within agreed SLAs.
Track remediation progress, produce vulnerability metrics, and report status to the CISO.
Validate remediation effectiveness through re-scanning and spot-checks.
Identity & Access Management (IAM)
Manage
periodic access reviews
: coordinate with system owners and HR to review and certify user permissions across critical systems, ensuring least privilege is maintained.
Oversee the
Privileged Access Management (PAM)
programme: define PAM policies, monitor privileged account usage, and review access rights for administrator-level accounts.
Investigate and respond to identity-related anomalies and access policy violations.
What we are looking for:
3–5 years in a SOC analyst, incident response, or security operations role, with at least 1–2 years at L3 level is a plus.
Experience implementing or managing IAM and PAM solutions
Experience working within international or multinational environments.
Hands-on experience with incident response engagements (internal or consulting) is strongly valued.
Relevant certifications:
GCIH, GCFE, GCFA, CEH, CompTIA CySA+
, or equivalent. OSCP is a plus.
Strong hands-on experience with
SIEM platforms
(alert triage, rule writing, query development) and
EDR/XDR tools
.
Solid knowledge of the
MITRE ATT&CK framework
and its application to threat hunting and incident response.
Experience conducting
vulnerability scans
using tools such as Tenable Nessus, Qualys, Rapid7, or similar.
Familiarity with
IAM and PAM
concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM, or equivalent).
Experience with
digital forensics and incident response (DFIR)
methodologies: evidence collection, log analysis, and timeline reconstruction.
Knowledge of
threat intelligence platforms
and feeds (e.g. MISP, VirusTotal, threat intel feeds).
Understanding of
ISO 27001 incident management controls, NIS2 incident reporting obligations, and PCI DSS requirement 12.10
.
Calm and decisive under pressure.
Strong investigative mindset with structured problem-solving approach, excellent documentation skills.
Ability to communicate incident status and findings clearly to both technical teams and executive stakeholders.
Collaborative and proactive, comfortable working asynchronously across time zones.
English
: full professional proficiency (C1/C2) — primary working language.
Spanish
: professional proficiency is a plus.
In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is EUR 48,000 EUR.
In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.
#Aleph
Why Join Us?
Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.
We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.
#ALEPH
Location: US, Boston, MA
Workplace: OnSite
Here at Humanoid, we believe in a future where robots amplify human potential. That’s why we’ve set out on a mission to build the world’s most capable, commercially-scalable, and safe humanoid robots. We’re bringing that mission to life with HMND‑01 - our rapidly developed humanoid platform being deployed in real industrial environments - and we’re growing the team to take it even further.
ABOUT THE ROLE
We are seeking a Principal Product Cybersecurity Assurance Engineer with deep expertise in product security, threat modelling, and risk assurance for highly regulated electromechanical systems. In this role, you will lead the delivery of product cybersecurity across Humanoid's HMND 01 platform family — the Alpha Wheeled industrial robot and the Alpha Bipedal home robot — both powered by our KinetIQ VLM/VLA-based AI framework. Working alongside product, firmware, autonomy, and hardware teams as part of the Systems Engineering and Architecture Team, you will define and maintain the cybersecurity assurance strategy for all product security activities from first concept through post-market deployment. Security at Humanoid is an engineering discipline inseparable from functional safety and central to our mission of creating the world's most reliable, commercially scalable, and safe humanoid robots. To excel in this position, you must demonstrate the authority to influence security architecture decisions across complex, cross-functional programmes, the rigour to build defensible security cases for novel cyber-physical systems, and the leadership to grow and guide a cross team of security engineers operating at the frontier of robotics.
WHAT YOU'LL DO
- Team Leadership & Product Security Delivery
- Lead and develop a cross-functional team of security engineers, maintaining accountability for the delivery of product security services within product teams throughout the HMND 01 development lifecycle.
- Define product security requirements and advise development teams on suitable implementation standards, techniques, and toolchains for embedded and AI-enabled robotic systems.
- Partner with cross-functional teams to develop security protocols, tools, and processes that keep HMND 01 technologies ahead of emerging threats — including attack surfaces specific to the KinetIQ AI inference pipeline and cloud-to-robot communication architecture.
- Own and maintain key security artefacts for audit-ready cybersecurity documentation including Security Management Plans, Threat Analysis and Risk Assessment (TARA) reports, Risk Assessments, and Remediation Action Plans across both platforms.
Security Assurance & Certification
- Drive security assurance through the full product lifecycle, ensuring every HMND 01 design is robust, compliant, and resilient. Contribute to the continual improvement of security engineering capability across the organisation.
- Ensure compliance with cybersecurity obligations under the EU Machinery Regulation 2023/1230 where cyber controls intersect with safety-critical functions and compliance to IEC 62443 (for industrial/OT product security), and the EU Cyber Resilience Act.
- Provide independent Information Assurance (IA) reviews and risk assessments on complex, high-impact projects — with particular focus on cyber-physical systems where a digital compromise could result in physical harm to operators or end users.
- Review and provide guidance on security risk assessments, risk mitigation plans, mitigation gap analysis, and security management documentation in support of system cybersecurity certification.
Incident Response & Lifecycle Security
- Establish and maintain a Product Security Incident Response (PSIR) process, encompassing coordinated vulnerability disclosure, patch deployment pipelines, and post-field incident analysis.
- Define and oversee security monitoring requirements for deployed fleets, ensuring field data feeds back into risk files and security artefacts in line with post-market surveillance obligations.
Commercial & Bid Support
- Support the production of work package descriptions and cost estimates for product bids, services, and proposals that include product security scope.
- Represent Humanoid's security posture in customer and partner engagements, including regulatory consultations and certification body interactions.
WHAT WE'RE LOOKING FOR
- Proven, hands-on experience with ISO 27001/27004/27005 and the NIST Risk Management Framework (RMF), applied to regulated hardware or embedded product programmes.
- Experience owning a security risk management system for highly regulated, safety-critical products — with background drawn from automotive, commercial vehicle, or industrial automation environments.
- Working knowledge of IEC 62443, with the ability to adapt ISO/SAE 21434 lifecycle methodologies to robotic or electromechanical product context.
- Solid understanding of engineering development lifecycles and how the product cybersecurity specialism aligns with systems engineering, functional safety, and hardware/software co-development.
- Ability to interpret Penetration Test reports and author Remediation Action Plans that address identified vulnerabilities in a structured, risk-prioritised manner.
- Clear, structured communication skills — able to articulate complex security risk arguments to both technical engineers and executive stakeholders with equal confidence.
Preferred:
- Familiarity with Threat Analysis and Risk Assessment (TARA) or equivalent threat modelling methodologies (STRIDE, PASTA) applied to embedded or OT/IT convergent systems.
- Understanding of secure-by-design principles for AI/ML-enabled systems, including securing inference pipelines, model integrity, and cloud-to-edge communication paths.
- Exposure to CAN bus, Ethernet backbone, or wireless interface security in mobile, vehicular, or robotic systems.
- Experience contributing to or establishing a Product Security Incident Response (PSIRT) process or coordinated vulnerability disclosure programme.
- Knowledge of UL 4600, UL 3300, or ISO 13482 and an appreciation of how cybersecurity evidence integrates into safety case arguments.
- Prior engagement with certification bodies (TUV, UL, BSI) or standards development organisations (ISO TC 184, IEC TC 65, SAE, IEEE RAS).
WHAT WE OFFER
- Comprehensive health coverage for US‑based employees, including fully paid medical, dental, and vision insurance, with virtual care and employee assistance resources.
- Meaningful time off to rest and recharge: 23 days of PTO (accrued), separate sick leave, and paid company holidays.
- 401(k) retirement plan with 4% employer match.
- Competitive equity: stock options with meaningful upside as we scale.
- Free daily catered lunch, snacks, and drinks in‑office.
- Collaboration with top‑tier engineers, researchers, and product experts in AI and robotics.
- Freedom to influence the product and own key initiatives.
Location: Paris
Workplace: Hybrid
ABOUT MISTRAL
Mistral provides full-stack AI solutions: from frontier models to developer tools, applications, and compute. We partner with enterprises tackling the hardest problems across high-stakes industries like finance, manufacturing, defense, healthcare, and the public sector, co-creating customized AI systems that they can run on their terms.
We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between Europe, North America, Asia and the Middle East. We are creative, low-ego and team-spirited.
THE ROLE
Cybersecurity is one of the areas where AI could do the most good — and one where the capability must be built with particular care. As a Research Engineer on this track, you'll push our models' capabilities in vulnerability discovery and remediation, security analysis, incident response, and across the offensive-to-defensive spectrum of cybersecurity, and it will be your job to develop that ability deliberately and safely.
The work sits at the meeting point of research and engineering: you'll devise new approaches and be the one to implement them. Concretely, that means designing and building RL environments that reproduce realistic security scenarios, pipelines that generate synthetic training instances at scale, and experiments and evaluations that show what our models can actually do. Your results feed directly into the production training runs that shape our frontier models, in close collaboration with Mistral's researchers, engineers, and security specialists.
Security specialists and ML engineers are both welcome here — what matters is that you can hold your own in both worlds, and are eager to go deeper on the one you know less.
WHAT YOU WILL DO
- Design and implement RL environments simulating cybersecurity scenarios.
- Build the pipelines and infrastructure that generate synthetic cybersecurity training instances at scale — thousands of scenarios, not one hand-crafted exercise.
- Conduct experiments and evaluations of model capabilities on these environments, from quick prototypes to controlled benchmark runs.
- Own the infrastructure behind the environments: containers, sandboxes, VMs, cloud deployments, and orchestration (Kubernetes), all managed as code.
- Partner with researchers and security specialists across Mistral, distilling their domain expertise into reproducible environments and datasets.
- Write clear, efficient code in Python and enforce strong software-design practices: testing, code review, CI/CD.
WHAT WE'RE LOOKING FOR
- Hands-on expertise in offensive and/or defensive cybersecurity: vulnerability analysis, web/network/cloud security, secure coding practices, and SOC.
- Strong software engineering skills: clean, reliable, well-tested code — not just exploit scripts.
- Fluency in Python plus comfort reading lower-level languages (C/C++) for vulnerability analysis.
- DevOps experience: Docker, Kubernetes, cloud deployments, sandboxed or simulated environments.
- A pragmatic research-to-engineering mindset: ship a working first version, then refine and scale it.
- Working knowledge of RL techniques and LLM training methodologies, or strong motivation to develop it.
- Self-starter, low-ego, collaborative — comfortable working across research and engineering.
NICE-TO-HAVES
- CTF, cyber-range, or bug-bounty experience — as a player, challenge author, or platform builder.
- A research background in cybersecurity, academic or industrial, or in another experimental discipline.
- Prior experience building RL environments or large-scale ML training infrastructure.
- Relevant open-source contributions and projects.
WHAT WE OFFER
We offer a comprehensive benefits package designed to support your well-being, growth, and work-life balance. Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks.
For the most up-to-date details on benefits available in your location, please refer to our Benefits page https://app.notion.com/p/mistralai/Benefits-at-Mistral-36e6ba59a7fe836b93dd01737fcc27ef?source=copy_link.
PRIVACY POLICY
Your privacy matters to us. You can learn more about how we handle your personal data in our Applicant Privacy Policy https://legal.mistral.ai/terms/applicant-privacy-policy.
seniorГеография найма не уточнена
ОфисBelgrade; Lisbon
ОфисseniorParis
УдалённоRemote USA
УдалённоseniorUnited States
УдалённоseniorRemote, Canada; Remote, United States; The base salary range for this role’s listed level is currently for residents of the United States only
УдалённоleadRussia; Perm; Moscow
ГибридseniorWarsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus
ГибридWarsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus
УдалённоUnited States
Limassol, Cyprus
УдалённоRemote; San Francisco; New York; This role is Fully Remote (US only), or can be based in New York or San Francisco (where it is open to those who are able to be in-office 3 days per week on a hybrid work model.); For remote employees located outside CA and NY, salary may vary based on location and local market conditions
ГибридseniorParis
ГибридMadrid, Spain; Collaborative and proactive, comfortable working asynchronously across time zones
ОфисГеография найма не уточнена
ГибридParis; Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks
Все вакансии в одном месте - страница 10 · Job Hunters
