Вакансии

Location: San Francisco, CA | New York City, NY | Seattle, WA About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Reinforcement learning is how Claude learns to reason, write code, and act autonomously over long horizons. At frontier scale, an RL run is a large distributed system: training, sampling, and environment execution run concurrently across a large fleet of accelerators and hosts. As an engineer in RL Engineering, you'll work on keeping that system secure as it scales. This is a hands-on engineering role. You'll work in the RL codebase and the infrastructure underneath it, alongside the engineers and researchers who build and use it. The system is large and changes as fast as the research does, so security work here has to keep up with that pace without costing performance or velocity. We're hiring from two backgrounds: security engineers who want to work on large-scale ML systems, and ML systems or research engineers who want to work on security. Strong candidates have depth in one and real interest in the other. Key responsibilities Design, build, and operate security controls for RL training systems and the infrastructure they run on Work across the stack (orchestration, environments, training, inference) wherever the work is needed Review designs and code across the RL stack, find security problems, and fix them Build shared libraries and tooling that other RL engineers and researchers build on Build the observability needed to understand what these systems are doing Work with researchers and performance engineers to make sure security changes preserve training correctness and performance Write clear design documents for what you build Minimum qualifications Strong software engineering skills in Python and at least one systems language such as Rust, C++, or Go Experience designing, building, and operating large-scale distributed systems or security systems in production Strong understanding of security fundamentals Working knowledge of Linux, containers, and cloud infrastructure Experience debugging complex problems across many hosts and services Ability to reason about tradeoffs between security, performance, and reliability Strong written communication, including design documents Preferred qualifications Experience running ML training or inference infrastructure at scale Experience with infrastructure security, such as isolation, access control, networking, or identity Experience with container orchestration such as Kubernetes, and with sandboxed or virtualized code execution at scale Experience building observability for large fleets Experience supporting research teams or other fast-moving internal users Familiarity with reinforcement learning or large language model training workloads The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 — $405,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: USA (Remote); Canada (Remote) Workplace: Remote Mysten Labs’ mission is to advance the internet through step-function improvements in what technology makes possible. We build foundational infrastructure and products that give people, businesses, and developers new ways to interact, transact, and create value. Our work spans on-chain finance and the emerging agent economy. Through Sui, Move, and our broader technology stack, we’re building the systems that make these experiences possible - from secure, scalable blockchain infrastructure to new ways for businesses and AI agents to interact. Mysten Labs is looking for a hands-on Security Engineer with strong application security fundamentals and a track record of finding and fixing real vulnerabilities. You’ll own bug bounty programs and external audits, secure our code and software supply chain, and build tooling that protects Mysten’s products and users across the Sui ecosystem. Responsibilities - Run Mysten's bug bounty programs: triage, severity, responses, internal escalations, fix validation, and the budget and payouts. Turn recurring report classes into automated checks. - Own audit engagements: scope and schedule external audits, act as the technical counterpart during the engagement, and track findings through remediation and fix validation. - Conduct code and design reviews of systems built by Mysten, its subsidiaries and partners (Rust, TypeScript, Move). Drive issues to conclusion, including investigation and incident response, and run variant analysis so each bug class is closed everywhere it occurs. - Own software supply chain security: dependency and CI/CD malware defenses, Endor Labs, the code security service (GitHub controls, merge bots), and the ongoing code security self-auditing service. Detect and respond to compromised packages, maintainers and build pipelines, and secure the provenance and signing of what Mysten ships. - Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts and other threats that target Sui users, and work with wallet teams on mitigations. - Build security tooling: LLM-driven triage and review agents, and static and dynamic analysis (taint, call graphs, fuzzing) wired into CI and code review. Build in known-clean checks so people trust the results.   MINIMUM QUALIFICATIONS - Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience. - 3+ years of hands-on experience in security engineering, application security or product security, with a track record of finding real vulnerabilities (bug bounty reports, audit findings, CVEs or published research). - Strong Web2 security fundamentals: XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, cryptographic failures. - Proficiency in one or more of Rust, TypeScript, Python or Move, and experience reviewing and writing security-sensitive code. - Hands-on knowledge of software supply chain attack surface: package ecosystems (npm, crates.io http://crates.io, PyPI), CI/CD (GitHub Actions workflow injection, token exposure, unpinned actions), and build provenance. - Solid understanding of applied cryptography fundamentals and the common ways cryptographic systems are misused in practice. - Experience on either side of a bug bounty program or an audit engagement. - Strong written and verbal communication, including the ability to influence teams you have no formal authority over. - Interest in the web3 space is required.   PREFERRED QUALIFICATIONS - Smart contract or wallet security: Move, Solidity or Rust-based chains; Sui's object and capability model is a plus. - Static or dynamic program analysis: CodeQL, Semgrep, taint analysis, fuzzing, symbolic execution. - Experience building security tooling with LLM agents (Claude Code skills or comparable), and a clear sense of where models help and where deterministic tooling has to do the work. - Anti-phishing, anti-fraud or trust & safety experience: domain and content monitoring, crawling, classifiers, threat intelligence. - Knowledge of recent crypto incidents and the defect classes behind them: drainer kits, DeFi frontend compromises, package-registry compromises. - Notable bug bounty rankings, CVEs, publications or conference talks. Employment is contingent upon the successful completion of a background check, which may include verification of employment history, education credentials, criminal history, and other relevant information. Regarding the recent rash of technology job scams: Be aware that emails from genuine Mysten Labs group recruiters will always come from the @mystenlabs.com http://mystenlabs.com domain or related subdomains (e.g., mystenlabs.com/careers http://mystenlabs.com/careers). Remember: you can always verify positions on our job boards at www.mystenlabs.com/careers http://www.mystenlabs.com/careers. To support an efficient and fair hiring process, we may use technology-assisted tools, including artificial intelligence (AI), to help identify and evaluate candidates. All hiring decisions are ultimately made by human reviewers. Our team is remote first and we are hiring across the world. Here at Mysten Labs, you’ll be joining a world-class team with tremendous growth potential as we bring the next billion users to web3. We raised a $300M Series B round from top Silicon Valley led venture funds like Jump Crypto, Andreessen Horowitz (a16z), Binance Labs, Redpoint, Lightspeed, Coinbase Ventures, Electric Capital, Standard Crypto, NFX, Slow Ventures, Scribble Ventures, Samsung Next, Lux Capital, among other investment firms and strategic partners. Come join us and build the future of web3!

Location: San Francisco Bay Area, USA Workplace: Hybrid Why work at Higgsfield AI? Higgsfield AI is the fastest-scaling generative AI company in history, hitting $1B in annual revenue run rate, 30M+ users worldwide, 6M+ generations per day, and powering 390 of Fortune 500 brands. We're building at the absolute frontier of AI-powered video creation and next-generation creative tools. Joining Higgsfield means becoming part of a high-impact team shaping the future of AI-native experiences, at a company that isn't just moving fast, but rewriting what fast looks like. About the role: Higgsfield AI is looking for a highly technical, hands-on MTS, ML Security to join Higgsfield Security and own security across our GPU clusters and AI/ML infrastructure, from model training to inference and production deployment. In this role, you will work as part of the Security team and closely with our ML and Infrastructure teams to design, implement, and operate security controls that protect models, data, and underlying infrastructure. Your core responsibilities will include securing GPU compute environments, assessing infrastructure and AI/ML vendors, and enforcing security requirements through technical controls, deployment policies, and verified remediation. We're looking for someone who combines deep security engineering expertise with a practical, solutions-oriented mindset. The ideal candidate is comfortable working across cloud environments, Kubernetes, Linux, and GPU infrastructure, and understands how to balance security, performance, and reliability in a fast-moving AI environment. This role carries direct ownership of GPU infrastructure security and the security requirements that third-party providers must meet to support Higgsfield’s workloads and data. What you'll do: AI/ML & GPU Infrastructure Security - Own the security of GPU clusters supporting distributed training and production inference across cloud and rented datacenter environments. - Harden GPU hosts, operating systems, drivers, container runtimes, Kubernetes clusters, and workload scheduling configurations; reduce privileged access and unnecessary exposure. - Secure distributed training environments and GPU workloads through isolation, access controls, and data movement restrictions. Validate isolation between tenants and workloads across compute, networking, and storage, including shared GPU environments where applicable. - Design and implement controls to protect sensitive datasets, model checkpoints, weights, and customer data. - Strengthen inference security through tenant isolation, service authorization, secure model loading. - Partner with ML and Platform Engineering teams to integrate security into infrastructure design and development workflows. Vendor Security Assessment & Enforcement - Lead technical security assessments of GPU infrastructure providers, datacenter operators, and other AI security vendors that process Higgsfield data and support AI workloads. - Evaluate vendor architecture and evidence covering tenant isolation, privileged access, data handling and retention, use of customer data for model training, encryption, vulnerability management, and incident response. - Translate security requirements into enforceable technical controls, including approved configurations, and continuous checks for configuration drift. - Track internal and vendor security findings to closure with accountable owners and deadlines, validate remediation, and escalate unmet requirements. Document any approved exceptions with compensating controls and expiration dates. Cloud & Platform Security - Design, implement, and maintain security controls across Linux, Kubernetes, cloud infrastructure, networks, and third party datacenter environments. - Secure infrastructure provisioning, configuration management, and access to third-party infrastructure providers. Restrict and audit vendor and administrator access to cluster management interfaces and production systems. - Implement least-privilege access, workload identity, secrets management, encryption, and auditable access controls. - Identify and remediate vulnerabilities and configuration risks across production systems, including GPU hosts, drivers, and container runtimes, coordinating changes with infrastructure owners to maintain service reliability. Security Operations & Risk Management - Develop and maintain detection and response capabilities for infrastructure and AI-specific security threats, including unauthorized GPU workloads, privilege escalation, and suspicious data transfers. - Investigate and respond to potential credential compromise, unauthorized data access, model theft, and compromised workloads. - Partner cross-functionally to implement practical security improvements that account for the performance, scalability, and reliability requirements of GPU workloads. Requirements: - Strong hands-on experience in Security Engineering, Infrastructure Security, Platform Security, or a related technical discipline. - Deep understanding of Linux, Kubernetes, networking, and cloud infrastructure security. - Practical experience securing or operating GPU clusters or distributed AI/ML infrastructure, with an understanding of training and inference workloads, GPU drivers and runtimes, and workload isolation. - Experience designing and implementing security controls across complex, distributed production environments. - Strong knowledge of identity and access management, workload isolation, encryption, secrets management, and least-privilege principles. - Experience conducting technical vendor security assessments, evaluating supporting evidence, and driving remediation with external providers. - Ability to identify, investigate, and remediate security vulnerabilities and infrastructure threats. - Proficiency in scripting or programming languages such as Python, Go, or Bash. - Experience partnering with Infrastructure, Platform, or ML Engineering teams to implement security solutions. - Strong technical ownership, sound judgment, and the ability to prioritize security risks in a fast-paced environment. - A hands-on, collaborative approach with the ability to independently drive security initiatives from design through deployment, verify that controls work in production, and hold internal teams and vendors accountable for agreed security requirements. Compensation & Benefits - We offer a competitive and thoughtfully structured compensation package designed to align with impact, experience, and long-term growth. - Base Salary: The anticipated salary range for this role is $200,000 - $300,000, depending on experience, skills, scope, and location. • Bonus: This role is Bonus eligible and may participate in the Company's discretionary annual bonus program. - Equity: In addition to cash compensation, employees are eligible to participate in the company’s stock option program and share in Higgsfield’s long-term growth. - Benefits: We offer a comprehensive benefits package designed to support employees professionally and personally, including medical, dental, and vision insurance, a competitive 401(k) retirement plan with company matching, and additional benefits and perks. - The opportunity to work on ambitious AI products alongside a highly experienced, fast-moving, and international team. - Significant ownership, direct impact, and opportunities for professional growth as the company scales. This is a hybrid role based in the San Francisco Bay Area. Team members are expected to work from our San Francisco office three full days per week, with the remaining days worked remotely and are expected to be available during agreed working hours and to maintain sufficient overlap with the relevant team’s time zone. We value in-person collaboration, active communication, responsiveness, and close partnership across teams. Higgsfield AI is an equal opportunity employer. We are committed to building a diverse and inclusive team and do not discriminate on the basis of race, color, religion, sex, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic.

Location: Anywhere in France Workplace: Hybrid HEALTH CAN’T WAIT. Not for symptoms to get worse. Not for a six‑month appointment. Not for a system to catch up. But that’s exactly how healthcare works today. You wait, until you can’t. Alan exists to end the wait. Health is a universal right, and we believe this right can only become real when it’s coupled with prevention. We need to stop treating health as something we repair and start treating it as something we build, every day. It’s not solely a question of willpower. It’s the healthcare system itself that needs to work for everyone, in a sustainable way. So we are building the new standard in prevention insurance. Alan is the first company that integrates insurance, prevention, and care into a single, acclaimed user experience. We are on an incredible journey to build a global leading company, with a unique culture https://alan.com/en/careers. We already partner with 40K+ companies of all sizes, serving more than 1M+ members, and have reached €800M+ in ARR. Prevention as the new norm. That's what we're building with our team of 1000+ people. If it speaks to you: we're hiring across France, Spain, Belgium, and Canada. And beyond. 🛡️ THE ROLE Most GRC roles are about keeping auditors happy. This one is about earning our members' trust: every day, they share their diagnoses, their claims and their care with us. You'll own security governance and risk at Alan end to end. That means one clear framework across our certifications and regulations, which the whole company uses to decide what matters most. You set the direction, make the calls on risk, and help every team own its part. We just earned our HDS certification, and there's much more to build as we grow from 1M to many millions of members, across more countries and regulators. That includes how we govern AI, which Alan uses across its products and operations. This is a hands-on senior role. You do the work yourself, mentor the junior GRC engineer we're hiring alongside you, and grow the team over time.   🚀 WHAT YOU'LL DO - Make our security framework a tool for the whole company. You own the full certification cycle (ISO 27001, HDS and those to come), and turn it into something teams use every day to prioritise, not a binder for auditors. - Bring the security view on regulation. Legal and Risk own the regulatory relationships. You bring the security answer: what the rules mean for how we protect data, and which controls make it work in practice. - Run risk as an ongoing programme. You map and prioritise security risks, including AI risks, turn them into clear treatment plans, and feed them into company-wide risk decisions with the Risk team. - Help every team own its risks. You define the controls framework and the standards, while the teams who build and run our systems own the controls. You brief the board and audit committee, and you know which findings need an urgent call and which can wait for the quarterly report. - Own incident governance. You triage and escalate incidents, own business continuity and disaster recovery, and shape the security side of our regulatory incident reports. - Be a credible partner to engineering. You work with engineering teams early on new designs and spot control gaps (access, encryption, logging) before they ship. You don't need to be an architect, but you can hold the conversation.   🏗️ WHAT YOU'LL BUILD - One governance model: clear ownership of risks and controls across teams, so security decisions don't bottleneck on one person. - A living risk map: prioritised risks that actually drive company and engineering decisions. - One compliance backbone: a single control system across our countries and regulators, built to scale. - An automated evidence engine: evidence collected straight from engineering systems, so audits run continuously instead of as a quarterly rush. You'll work closely with Legal, the Data Protection Officer, Internal Audit and Risk, and day to day with engineering and operations teams.   ⭐ WHAT WE'RE LOOKING FOR Your team You'll join Alan's Corporate team, which brings together our control functions: Risk, Corporate Governance & Internal Control, Legal, Compliance and Security. They share one mission: building what lets Alan operate at scale, safely and responsibly. Within that group, you carry the security governance and risk dimension, working hand in hand with the security engineers who run our infrastructure and platform security, and with a junior GRC engineer we're hiring alongside you. You'll be hands-on every day, building and owning the work yourself. Along the way, you'll mentor the junior engineer and help shape how GRC grows at Alan. What you bring - You want to build and own things yourself, and you enjoy helping someone else grow while you do it. - 6+ years in security, with real GRC ownership. - You've run a GRC roadmap in a certified or strongly regulated environment (ISO 27001, HDS, SOC 2, or regulated sectors like health, insurance or finance). You're comfortable working with certification auditors, and you can explain what a framework requires and why it makes sense for business teams. - You take a stand on risks, and you'd rather close one real risk than write ten policies. - You're fluent in French and English.   A big plus - You've driven a certification or audit cycle end to end yourself. - You've automated compliance work, or you're eager to, and you have a view on where AI can help. - You've presented risk to senior leaders or a board. - You've mentored or onboarded someone before. 🌍 HOW WE WORK Location: You must be legally eligible to work from France, Belgium or Spain. Remote work: We offer remote work flexibility. Contract type: Permanent contract only (no freelancing).   🎯 IMPORTANT NOTE: WE HIRE PEOPLE, NOT ROLES. If you're excited about this opportunity but don't check every box, we'd love to hear from you. Everyone, no matter how underrepresented, should feel free to apply, as it can only bring learnings or success. Remember, this is just a guide, not a checklist. We'll be thrilled to receive your application!   🔖 Check out our About Alan https://alan.com/about and Career https://alan.com/careers pages, as well as our Medium https://medium.com/alan, blog https://blog.alan.com/ and Glassdoor page https://www.glassdoor.com/Overview/Working-at-Alan-EI_IE1696043.11,15.htm for more info.   YOU WANT TO KNOW MORE ABOUT ALAN?   🙌 Perks & Benefits https://alan.com/en/careers/a/salary-equity: Alaners are provided with a stimulating environment and perks ensuring they are happy, efficient and spend only high-quality time with co-workers. 🤘A strong culture https://alan.com/en/about/a/leadership-principles: People joining Alan are often surprised and delighted by our innovative working method. We have a set of cultural values that guide our approach to work

Location: Anywhere in France Workplace: Hybrid HEALTH CAN’T WAIT. Not for symptoms to get worse. Not for a six‑month appointment. Not for a system to catch up. But that’s exactly how healthcare works today. You wait, until you can’t. Alan exists to end the wait. Health is a universal right, and we believe this right can only become real when it’s coupled with prevention. We need to stop treating health as something we repair and start treating it as something we build, every day. It’s not solely a question of willpower. It’s the healthcare system itself that needs to work for everyone, in a sustainable way. So we are building the new standard in prevention insurance. Alan is the first company that integrates insurance, prevention, and care into a single, acclaimed user experience. We are on an incredible journey to build a global leading company, with a unique culture https://alan.com/en/careers. We already partner with 40K+ companies of all sizes, serving more than 1M+ members, and have reached €800M+ in ARR. Prevention as the new norm. That's what we're building with our team of 1000+ people. If it speaks to you: we're hiring across France, Spain, Belgium, and Canada. And beyond. 🛡️ THE ROLE Most GRC roles are about keeping auditors happy. This one is about earning our members' trust: every day, they share their diagnoses, their claims and their care with us. You'll join Alan's security team to help run our compliance and risk work across ISO 27001, HDS and DORA, across a growing number of countries and regulators. We just earned our HDS certification, and there's much more to build, including how we govern AI across our products: assessing AI risks, setting the controls, and keeping up with the AI Act. You'll learn alongside experienced security engineers, with a dedicated coach from day one. You'll take on real ownership early, and your scope grows as we scale from 1M to many millions of members. And you'll learn how we work at Alan: teams own their risks and controls, we automate wherever we can, and we focus on real outcomes, not paperwork. 🚀 WHAT YOU'LL DO - Keep our certifications on track. You run the day-to-day of the ISO 27001 and HDS audit cycles: collecting evidence, preparing internal audits, and following up on corrective actions until they're closed. - Turn regulations into practical actions. With Legal and the DPO, you help translate requirements like DORA, HDS, and GDPR into clear tasks for the teams, and track that they get done. - Learn the health sector rules. You build your knowledge of health-specific frameworks (ANS, HDS) and help apply them to how we handle health data. - Contribute to risk management. You help build and update our risk mapping, including AI risks, and follow up on the treatment plans with the teams who own them. - Support the teams who own the controls. You keep the controls framework up to date, answer teams' questions, and help explain security clearly to every stakeholder, from engineers to managers. - Support incident governance. You help classify and document incidents, keep Business continuity and Disaster recovery plans up to date, and prepare inputs for DORA incident reports. - Automate what slows us down. You spot repetitive compliance tasks and automate them with scripts, tools or AI. 🏗️ WHAT YOU'LL HELP BUILD - One compliance backbone: A single control system for several regulators in several countries, so Alan can scale without rebuilding compliance each time. - An automated evidence engine: evidence collected straight from engineering systems with scripts and AI, so audits run continuously instead of as a quarterly rush. You'll work closely with Legal, the DPO, Internal Audit and Risk, and day to day with engineering and operations teams. ⭐ WHAT WE'RE LOOKING FOR - You want to do the work yourself and grow with it: a permanent, hands-on role where you build things for the long run. - 2+ years in security, GRC or compliance (an audit background is fine if you want to move into building). - You've played a key part in a certification or audit cycle (ISO 27001, HDS, SOC 2 or similar). - You're curious about how things work technically, and you've automated at least one manual task (a script, a tool, an AI workflow). - You're fluent in French and English, and comfortable presenting in both. - You learn fast, ask for feedback, and go into the details when it matters. 🌍 HOW WE WORK Location: You must be legally eligible to work from France, Belgium or Spain. Remote work: We offer remote work flexibility. Contract type: Permanent contract only (no freelancing). 🎯 IMPORTANT NOTE: WE HIRE PEOPLE, NOT ROLES. If you're excited about this opportunity but don't check every box, we'd love to hear from you. Everyone, no matter how underrepresented, should feel free to apply, as it can only bring learnings or success. 🔖 Check out our About Alan https://alan.com/about and Career https://alan.com/careers pages, as well as our Medium https://medium.com/alan, blog https://blog.alan.com/ and Glassdoor page https://www.glassdoor.com/Overview/Working-at-Alan-EI_IE1696043.11,15.htm for more info. YOU WANT TO KNOW MORE ABOUT ALAN? 🙌 Perks & Benefits https://alan.com/en/careers/a/salary-equity: Alaners are provided with a stimulating environment and perks ensuring they are happy, efficient and spend only high-quality time with co-workers. 🤘A strong culture https://alan.com/en/about/a/leadership-principles: People joining Alan are often surprised and delighted by our innovative working method. We have a set of cultural values that guide our approach to work

Location: Belgrade, Serbia; Tbilisi, Georgia Workplace: remote AI Digital is looking for an Information Security Specialist to take on a core operational role within our growing security team. Reporting directly to the Head of Security, you will take ownership of day-to-day execution across key operational domains—including endpoint protection, access management, vulnerability management, event monitoring, incident response, email security and employee awareness programs. Responsibilities: Monitor MDM and EDR coverage: device inventory, policy compliance, gap identification, escalation to IT Ops. Triage EDR alerts: initial assessment, isolation where needed, escalation. Monitor inactive and privileged accounts across Google Workspace and key SaaS platforms. Track MFA coverage, maintain metrics, escalate deviations. Vulnerability Management. Assist with endpoint patching; notify IT Ops and DevOps on critical CVEs. Monitor baseline security alerts in Google Workspace and EDR; assist with event triage, escalation by severity, and log maintenance. Review phishing reports (analysis, email isolation, user notification) and manage blocking policies in Google Workspace. Administer KnowBe4: training modules, phishing simulations, department-level metrics. SaaS Vendor Management. Support security incident handling from the security team side: escalation, timeline tracking, incident log. Participate in the SOC 2 certification process. Help prepare responses to security sections of questionnaires from current and prospective clients. 2–4 years in information security or a related field (IT, DevOps with a security focus). Hands-on experience working with SaaS platforms from a security or administration perspective. Understanding of core concepts: access management, vulnerability management, endpoint protection, event monitoring. Experience with MDM solutions. Experience with EDR. Ability to take on a task without a defined process and drive it to completion. Some processes will need to be built from scratch — we'll support you through that. Comfortable coordinating with cross-functional teams: setting requirements, following up on execution. Nice to have: Google Workspace administration. Security awareness platforms (KnowBe4 or equivalent). Involvement in a SOC 2 or ISO 27001 certification process. Familiarity with CIS Controls or NIST CSF. Experience with process automation (scripting, API integrations, no-code/low-code tools). What we offer: USD compensation that values your expertise‍. Work from anywhere: Fully remote to suit your lifestyle‍. 31 days of paid time off: 21 days of annual leave + 10 days of sick leave, because your health and work-life balance matter‍. Growth-focused environment: Access to learning resources and clear pathways for growth‍. Fun team events: Virtual cooking classes, yoga sessions, team quizzes and more. ‍A culture of trust: We cut the red tape - results over rules always. Open talk, ownership and getting things done together.

Location: United States (Remote) Workplace: Remote ABOUT ONEPAY OnePay is the consumer fintech trusted by millions of Americans to make money better. Our financial system is broken. High fees, low rates, and too few ways to actually grow your money. We’re fixing it. And we’re moving fast. We’re an all-in-one financial services platform that brings together banking, high-yield savings, credit cards, point-of-sale lending, investing, and crypto in one place. We also partner with employers, HCM providers, gig platforms, and others to deliver embedded financial services to millions of employees and frontline workers. We’re backed by Walmart, the world’s largest retailer, and Ribbit Capital, one of fintech’s most respected investors, giving us rare scale, distribution, and the opportunity to build something truly category-defining. But what really sets OnePay apart is how we move. Our customers don’t have time to wait… and neither do we. This place moves fast, and we’re looking for people who are: - Ready to run - Hungry and driven by urgency - Exceptional at what they do, with low ego - Comfortable operating in motion THE ROLE As a Corporate Security Automation Engineer at OnePay, you will lead the design, implementation, automation, and optimization of our corporate security infrastructure. You will enhance security controls, align goals with business objectives, and drive automation and self-service capabilities to maintain a strong security posture in a rapidly scaling environment. - Work with IaC tools like Terraform to ensure enterprise configurations are steady, change-managed and machine-readable. - Design and deploy endpoint security measures aligned with industry standards, including vulnerability management. - Ensure a strong security posture for corporate SaaS applications by configuring vendor capabilities or building automations to meet OnePay standards. - Mature and manage data protection controls, including Data Loss Prevention (DLP) tools and secure data handling processes. - Build secure methods for sharing data with internal teams and external partners. - Collaborate with IT, Infrastructure, and Security teams to implement security measures, maintain critical corporate systems (ensuring availability and compliance), and drive process improvement through automation. - Develop and run incident response and disaster recovery plans, including tabletop exercises. YOU BRING - 5+ years of IT experience, including 3+ years in enterprise security within cloud environments. - Expertise in IaC tools like Terraform (preferred), Puppet, Chef or Ansible. - Proven ability to lead projects, drive measurable security improvements through automation, leveraging scripting (Python, Go, and/or TypeScript). - Solid understanding of networking, authentication standards, and security frameworks (MITRE ATT&CK, NIST CSF, CIS benchmarks), with hands-on experience in ZTNA and DLP solutions (e.g., Netskope, Zscaler). - Skilled at simplifying technical concepts for non-technical audiences and influencing decisions. - Experience with workflow automation tools like n8n is a plus. TOOLS WE USE We use Typescript front to back, with node and NestJS frameworks for server code and React Native for our iOS, Android, and Web clients. We run on a highly distributed cloud-native stack with Kubernetes and AWS, and scale and resiliency are at the heart of everything we build. We also embrace agentic development, so engineers have their choice of a variety of models and agent harnesses, including Claude Code, Cursor, Codex, and more to fit their workflow. While you don't need experience with our exact stack, familiarity with modern software engineering practices will help you ramp up quickly. WHAT WE OFFER - Competitive base salary, stock options, and health benefits from Day 1 - 401(k) plan with company match - Remote-friendly (US), flexible time off (FTO), and opportunities for growth - A high-growth, mission-driven, inclusive culture where your work has real impact STANDARD INTERVIEW PROCESS Our process varies by role. Most candidates go through: - AI-assisted initial screen - Interview with Talent Partner - Technical or Hiring Manager Interview - Team Interview - Executive Interview - Offer! EQUAL EMPLOYMENT OPPORTUNITY To build technology and products that are used and loved by people and solve real-world problems, we need to build a team with many different perspectives and experiences. We are an equal opportunity employer. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. We encourage candidates from all backgrounds to apply. Applicants in need of special assistance or accommodation during the interview process or in accessing our website may contact us at talent@onepay.com.

Location: Ghent, Belgium D-ploy is a dynamic IT and Engineering Solutions company operating across the EMEA region, including Switzerland, Germany, Czech Republic, Austria, the UK, and the USA. We are committed to delivering reliable and efficient services to our clients through strong partnerships and a people-focused culture. We are looking for an experienced Technical Lead – Microsoft Purview & M365 Security to support the implementation of data protection and secure collaboration solutions within an international, highly regulated environment. This role is ideal for someone with strong hands-on expertise in Microsoft Purview, Microsoft 365 security and information protection, who can combine technical implementation with the ability to guide stakeholders through complex security and compliance requirements. You will take ownership of the technical delivery, working closely with project managers, business analysts, cybersecurity specialists and Microsoft 365 platform teams to design, implement and optimize information protection controls. Key Responsibilities Lead the technical design and implementation of Microsoft Purview information protection and data classification solutions. Translate data classification policies into sensitivity labels, encryption settings, external sharing controls and Data Loss Prevention (DLP) policies. Design and implement security controls for confidential and restricted information, considering their impact on external collaboration, mobile devices, partner applications and Microsoft Copilot. Configure and manage sensitivity labels, auto-labelling, DLP policies and related Microsoft 365 security settings. Plan and execute proof-of-concept activities, coordinate testing, troubleshoot technical issues and document findings. Support phased deployments of information protection policies, monitoring their impact and identifying potential risks. Develop reporting and monitoring solutions using PowerShell, Microsoft Graph and Microsoft Purview to identify sensitive content, sharing risks and compliance gaps. Establish operational procedures for monitoring, incident handling, policy exceptions and ongoing configuration changes. Collaborate with cybersecurity and platform teams to ensure a smooth transition into ongoing operations. Requirements What We're Looking For 5+ years of experience in Microsoft 365 security, compliance or information protection engineering. Proven experience implementing Microsoft Purview information protection solutions in at least two production environments with 2,000+ users. Strong hands-on experience with Microsoft Purview, including sensitivity labels, auto-labelling, Data Loss Prevention (DLP) and encryption. In-depth knowledge of Microsoft 365 collaboration and sharing configurations across SharePoint, Teams and OneDrive. Experience with Microsoft Entra ID Conditional Access, PowerShell and Microsoft Graph. Ability to assess and explain the impact of encryption and security controls on external collaboration, mobile access and Microsoft Copilot. Experience working in regulated industries, preferably pharmaceuticals, life sciences or similar environments. Microsoft SC-401 certification (formerly SC-400) or equivalent practical experience. Strong analytical, troubleshooting and communication skills, with the ability to engage both technical and non-technical stakeholders. Fluency in English. Valid criminal record extract, not older than three months, required. Nice to Have Experience developing automation scripts for large-scale data clean-up and remediation. Familiarity with Microsoft Defender for Cloud Apps. Experience identifying and remediating data oversharing risks associated with Microsoft Copilot. Benefits Broad range of tasks and responsibilities Friendly and international working environment Professional development opportunities Referral program (“Fishing for Friends”) Company-sponsored events Is IT in your DNA?

Job description.

Location: Belgrade Workplace: onsite About Unlimit   Unlimit is a global fintech ecosystem built to eliminate financial borders holding businesses back. The company provides the extensive infrastructure needed to scale globally, integrating payment processing, multi-currency business accounts, BaaS and crypto gateways into a single, intelligent platform.   Across 17 offices globally, Unlimit bridges hyper-local expertise with a high-capacity financial network, giving companies the agility to expand across regions with operational confidence and speed. Driving the evolution of payments, Unlimit is transforming its infrastructure from human-operated fintech into AI-native financial infrastructure — where APIs are consumed by machines, integrations are negotiated by agents, and systems evolve continuously through intelligent automation. Our next users are not only humans. They are AI agents acting on behalf of humans and businesses.   Unlimit serves more than the needs of businesses today; we are building the nervous system for a borderless global economy. What You'll Be Doing As a Senior Infrastructure Security & Operations Engineer, you’ll be a hands-on technical expert responsible for strengthening Unlimit’s infrastructure security and operational cyber defence capabilities. You’ll combine security engineering, detection and response, vulnerability management, and cloud security expertise to protect our technology ecosystem against evolving threats. A major part of this role will involve transforming traditional security operations through AI-powered and agentic automation. You’ll design and build intelligent security workflows, automate investigations and response activities, and continuously improve the effectiveness and efficiency of our cyber defence capabilities. This role is ideal for an experienced infrastructure or security engineer who combines strong systems engineering fundamentals with practical security operations experience, advanced automation skills, and a passion for building modern, AI-driven security solutions. What You’ll Do Own and continuously improve infrastructure security controls across Unlimit’s global technology environment. Operate and enhance internal Security Operations, including security monitoring, alert triage, incident investigation, and response. Develop and maintain detection engineering capabilities, including SIEM correlation rules, detection use cases, log analysis, and security monitoring integrations. Conduct proactive threat hunting and leverage cyber threat intelligence to identify emerging threats and improve defensive capabilities. Lead technical incident response activities, including investigation, containment, remediation, and post-incident improvements. Manage infrastructure vulnerability assessment and remediation processes, including vulnerability scanning, prioritisation, tracking, and validation. Implement and continuously improve infrastructure hardening and security configurations across servers, endpoints, networks, and cloud environments. Develop and maintain security controls across AWS, Kubernetes, and containerised environments. Own and optimise endpoint protection and detection capabilities, including EDR/XDR technologies. Contribute to network security, directory security, and infrastructure security architecture reviews. Administer, integrate, and continuously improve security technologies, including SIEM, EDR/XDR, vulnerability management, and infrastructure security platforms. Coordinate external penetration testing activities within the infrastructure security scope, validate findings, and support remediation. Provide technical support for IT and Information Security audits, including evidence collection, technical control validation, and remediation of identified gaps. Collaborate closely with Infrastructure, DevOps, Engineering, and Application Security teams to implement practical and scalable security improvements. AI & Agentic Security Automation Design, develop, and maintain AI-powered and agentic security automation as a core part of Cyber Security operations. Build autonomous and semi-autonomous workflows for security alert triage, investigation, enrichment, and response. Develop AI-assisted detection engineering, threat hunting, and threat intelligence processing capabilities. Automate vulnerability analysis, risk-based prioritisation, and remediation workflows. Build custom security integrations, automation scripts, and internal security tools using Python, APIs, and modern AI development frameworks. Leverage LLMs and agentic development tools, including Claude, to improve security operations efficiency and engineering productivity. Ensure AI-powered security workflows incorporate appropriate validation, access controls, and human oversight for sensitive or high-impact actions. What We’re Looking For 6+ years of hands-on engineering experience, including at least 4 years in Cyber Security, Infrastructure Security, or Security Operations. Strong technical background in IT infrastructure, systems engineering, cloud engineering, or platform engineering. Proven experience implementing and maintaining infrastructure security controls in complex production environments. Hands-on experience with Security Operations, SIEM, detection engineering, incident response, and threat hunting. Strong understanding of modern cyber attack tactics, techniques, and procedures (TTPs), including MITRE ATT&CK. Practical experience with EDR/XDR, vulnerability management, and security monitoring technologies. Solid understanding of Linux, networking, operating system security, and infrastructure hardening. Experience securing AWS environments, Kubernetes clusters, and containerised workloads. Strong Python development skills and experience building security automation, integrations, and internal tools. Practical experience developing AI-powered and agentic solutions, including LLM integrations, tool orchestration, autonomous workflows, and AI-assisted automation. Experience integrating security controls and automation into infrastructure and DevOps workflows. Ability to independently investigate complex security issues, identify root causes, and implement effective technical solutions. Strong analytical and problem-solving skills, with an engineering-first approach to security. Ability to work independently while collaborating effectively with Infrastructure, DevOps, Engineering, and Security teams. Technical Experience Hands-on experience with several of the following technologies is highly desirable: Security Operations: CrowdStrike, Elastic Security / Elasticsearch, Tenable. Cloud & Infrastructure: AWS, Kubernetes, container technologies, Cloudflare. Engineering & Automation: Python, Terraform, GitLab, REST APIs. AI & Agentic Development: Claude, LLM APIs, agentic frameworks, tool integrations, and AI-powered workflow orchestration. Nice to Have Previous experience in fintech, financial services, payments, or large-scale regulated e-commerce environments. Experience building AI-powered SOC capabilities or autonomous security operations workflows. Experience developing custom detection rules, security integrations, or open-source security tools. Knowledge of infrastructure security architecture and secure cloud design. Experience with offensive security techniques, infrastructure penetration testing, or adversary simulation. Relevant security, cloud, or engineering certifications. Join Unlimit Team now!   Unlimit is an equal opportunity employer. We believe passionately that employing a diverse workforce is central to our success. We make recruiting decisions based on your experience and skills. We welcome applications from all members of society irrespective of age, sex, disability, sexual orientation, race, religion or belief.

Detection & Response engineers own their detections end to end: you write them, you tune them, and your team is paged when they fire. The security team is spread across the globe with a follow-the-sun pager rotation so nobody is paged at 3am local.

Location: Ebene Workplace: OnSite Company Description We’re http://checkout.comCheckout.com http://Checkout.com. You might not know our name, but companies like eBay, Spotify, Klarna, Uber, and Sony do, because we’re behind many of the digital experiences you use every day. We are where the world checks out, enabling over 10 billion transactions yearly for more than one billion global shoppers. Whether you want to book a holiday, order food, renew a subscription, or check out online, there’s a good chance our tech powers the payments behind the scenes. Our platform helps the most ambitious businesses deliver effortless digital experiences, at scale. If you want to do career-defining work, you’ve come to the right place. We move fast, think globally, and believe great teams are built by hiring exceptional people with conviction, curiosity, and the desire to make an impact. With 20 offices across six continents and London as our HQ, we’re shaping the future of fintech – and we’re just getting started. As a Security Analyst at Checkout.com http://Checkout.com, you are a frontline defender of our global financial ecosystem. Joining our high-velocity 24/7 Security Operations Center (SOC), you won’t just watch dashboards—you will actively hunt, triage, and neutralize threats in real-time. This is a high-impact role where you’ll leverage a world-class security stack to protect millions of transactions and ensure the integrity of our global fintech platform. Key Responsibilities - Proactive monitoring using Azure Sentinel (SIEM) - End to end support for Security incident - Utilise Wiz and Qualtys to identify misconfiguration and vulnerabilities - Stay ahead of the curve by analyzing threat feeds and adapting our defenses against emerging fintech-specific attack vectors - Manage and optimize SentinelOne to ensure total visibility and protection across our organisation - Audit and secure access patterns within Okta and Active Directory, enforcing a Zero Trust philosophy - Support PCI DSS and SOC2 audits by maintaining rigorous evidence collection and control validation. - Analyze traffic patterns in Netskope to detect data exfiltration or anomalous user behavior. - Provide 24/7 security coverage on a rotational shift basis, including weekends and holidays, to ensure continuous monitoring of the environment. - Act as the first point of contact during assigned shifts, escalating high-priority incidents promptly. Skills & Experience Required - Experience: 2+ years in a Security Analyst or similar role, preferably within a tech or fintech environment. - Technical Skills: Hands-on experience with SIEM tools (e.g., Azure Sentinel), endpoint protection platforms, and vulnerability scanners. - Cloud Knowledge: Familiarity with cloud platforms like AWS, including basic understanding of cloud security best practices. - Networking: Basic understanding of network security concepts, including firewall configurations and IDS/IPS monitoring. - Compliance Knowledge: Awareness of PCI DSS and its relevance to security operations. - Incident Response: Understanding of incident response processes, including containment, eradication, and recovery. - Certifications: Relevant certifications such as CompTIA Security+, CEH, or GIAC are a plus. Additional Information Bring all of you to work We create the conditions for high performers to thrive, through real ownership, fewer blockers, and work that makes a difference from day one. Here, you’ll move fast, take on meaningful challenges, and be recognized for the impact you deliver. It’s a place where ambition gets met with opportunity, and where your growth is in your hands. We work as one team, and we back each other to succeed. So whatever your background or identity, if you’re ready to grow and make a difference, you’ll be right at home here. It’s important we set you up for success and make our process as accessible as possible. So let us know in your application, or tell your recruiter directly, if you need anything to make your experience or working environment more comfortable. Life at Checkout.com http://Checkout.com We understand that work is just one part of your life. Our hybrid working model offers flexibility, with three days per week in the office to support collaboration and connection. Curious about what it’s like to be part of our team? Visit our Careers Page https://www.checkout.com/careers to learn more about our culture, open roles, and what drives us. For a closer look at daily life at Checkout.com http://Checkout.com, follow us on LinkedIn https://www.linkedin.com/company/checkout/life/ and Instagram https://www.instagram.com/checkout_com/

Location: Remote - Colombia ; Remote - Costa Rica ; Remote - Mexico About Backblaze Backblaze is the object storage leader in the open cloud movement, fueling customer success with cloud storage built purposefully to unlock budgets, unburden administrators, and unleash innovators. Together with our partners, we’re helping customers break free from the restrictive, overpriced legacy solutions that hold them back, and blaze forward with the full power of the open cloud in their hands. Founded in 2007, we scaled the business with less than $3 million in outside funding until 2021, when we did a traditional IPO on the Nasdaq stock exchange. Today, Backblaze generates over $136M ARR and is the leading specialized storage cloud, managing over three billion gigabytes of data storage for 500K+ customers in 175+ countries, including businesses, developers, IT professionals, and individuals. But while there is a lot to celebrate in our past, there is almost as much opportunity ahead of us. We’re seeking a Red Team Security Engineer to join our team! About the Role The Red Team Security Engineer continuously validates whether vulnerabilities, configurations, identities, applications, infrastructure, and AI-enabled systems can be exploited by realistic adversaries. The role combines traditional offensive security with AI-assisted and agentic adversary emulation to validate exposure and continuously improve defensive controls. Key Responsibilities Emulate external attackers, malicious insiders, compromised identities, and autonomous adversarial agents. Validate whether vulnerabilities and configuration weaknesses identified are reachable and practically exploitable. Develop and execute realistic attack paths across web applications, APIs, cloud infrastructure, identity systems, endpoints, and other enterprise services. Use AI-assisted and agentic techniques for reconnaissance, vulnerability analysis, attack-path discovery, and controlled offensive testing. Test AI applications and agents for prompt injection, tool abuse, excessive privilege, identity compromise, and other emerging attack classes. Validate compensating controls and mitigations before or after deployment. Conduct purple-team exercises with Security Analytics and Security Operations to validate telemetry, detection, and response effectiveness. Translate offensive findings into actionable improvements to architecture, configuration, detections, and response capabilities. Qualifications Experience in red teaming, penetration testing, adversary emulation, or offensive security engineering. Strong web, API, cloud, identity, operating-system, and network security fundamentals. Experience validating practical exploitability and developing realistic attack paths. Strong understanding of MITRE ATT&CK and modern adversary techniques. Familiarity with OWASP Top 10 for LLM, OWASP Top 10 for Agentic Applications, and MITRE ATLAS. Scripting or software-development experience. Experience safely using automation or AI-assisted techniques in offensive-security workflows. Experience assessing cloud-native or AI-enabled systems, conducting purple-team exercises, or simulating autonomous adversaries is preferred. At this point, we hope you're feeling excited about the job description you're reading. Even if you don't meet every requirement, we still encourage you to apply. Learning, developing, and growing are key parts of our culture. We're eager to meet people who believe in our mission and can contribute to our team in various ways. We want people to feel comfortable expressing their true selves and to come, stay, and do their best work here. At Backblaze, we value being fair and good to our customers, partners, and employees. That’s why diversity, equity, and inclusion are at the core of our values. We are committed to fostering a workforce where all employees feel a sense of belonging regardless of race, ethnicity, nationality, gender, sexual orientation, age, religion, socio-economic status, ability, veteran status, and education. We believe that our dedication to cultivating a diverse workspace not only allows us to better serve our customers in over 175 countries, but further reinforces our commitment to doing the right thing. We are proud to be an Equal Opportunity Employer. To understand more about the data we collect and process as part of your application, please view our Backblaze Employee Privacy Notice.

Location: Lisbon, Portugal; Madrid, Spain; Prague, Czechia CloudLinux is a global remote-first company. We are driven by our principles: do the right thing, employees first, we are remote first, and we deliver high-volume, low-cost Linux infrastructure and security products that help companies to increase the efficiency of their operations. Every person on our team supports each other and does what we can to ensure we all are successful. Check out our website for more information: cloudlinux.com We are currently hiring a Staff Security Engineer within the Imunify360 product. Imunify360 is CloudLinux's security suite for Linux web servers. It protects hundreds of thousands of hosting servers and the websites running on them, so it sees most large-scale web attacks early — often in the first hours. Check out our website for more information: https://imunify360.com/ Role Mission & Scope At Imunify360, protecting customers from evolving cyber threats requires close collaboration between security research, engineering, and other teams. Responding to complex attack campaigns involves more than identifying threats — it requires understanding attack techniques, developing effective detection and mitigation strategies, and ensuring customers are protected. As a Staff Security Engineer , you'll take end-to-end technical ownership of complex security challenges, from initial threat discovery and analysis to detection, mitigation, and post-incident review. This is a hands-on technical leadership role focused on practical security engineering rather than SOC monitoring, compliance, or purely theoretical research. You'll analyze malware and exploit code, develop detection and mitigation tools, anticipate emerging attack techniques, and ensure security findings translate into production-ready detections, mitigations, and fixes. You'll work closely with engineering, security research, support, external partners, and the broader security community to coordinate responses and drive continuous improvements in our security capabilities. As an individual contributor , you won't have direct reports or people management responsibilities. All security research and testing are conducted within authorized boundaries, with clearly defined scope and responsible disclosure practices. Your mission is to strengthen Imunify360's ability to detect, prevent, and respond to emerging threats, delivering measurable security improvements that protect customers at scale. What you will own Malware and campaign mitigation Lead response to large-scale exploitation and malware campaigns: triage, root cause, and mitigation across every protection layer of the product. Reverse-engineer malware and exploits targeting Linux servers and web applications. Track campaigns over time, not just individual samples: cluster indicators, connect activity to known actors and toolkits, anticipate the next variant. Define and run measurable outcomes per campaign: time to detect, time to protect, cleanup effectiveness, reinfection rate. Security response coordination Own the security incident and response process, both for threats against our customers and for vulnerabilities in our own product: severity model, runbooks, communication, escalation. Coordinate with external parties — software vendors, partners, CERTs/CSIRTs, abuse desks, other security vendors. Drive responsible disclosure where we find vulnerabilities. Be the technical voice in security advisories and partner briefings, together with Product and Support. Triage external vulnerability reports. Offensive security on our own product Red-team our product and infrastructure. Assume a capable attacker who already has a foothold. Threat-model new features before they ship; own the security review gate for high-risk changes. Turn findings into fixes with the owning teams, not just reports. Detection engineering and tooling Raise the quality bar of detections: false-positive budgets, test corpora, staged rollout with measurement gates and fast rollback. Build and automate the analysis pipeline: dynamic analysis, honeypots, telemetry-driven hunting, ML-assisted triage where it measurably helps. Write production code for these tools; expect 30–50% of your time to be hands-on building. Turn telemetry into intelligence: emerging exploits, attacker infrastructure, trends — shared as internal briefs and selected public research. People multiplier (no direct reports) Mentor analysts and engineers; raise the security skill level across teams. Bar-raiser in security hiring loops. Key Milestones 30 days: Analyzed real threats end-to-end. Mapped the current response flow and where it breaks. Shipped at least one detection or mitigation to production. 90 days: Security response process and severity model published and agreed. Led at least one real campaign response with a written post-mortem. Baseline response metrics in place. 6 months: Time from first sighting to protection measurably reduced vs. baseline. First red-team review completed, top findings fixed. Working relationships with key external partners. 12 months: Recognized internally and externally as the owner of security response. Public research or disclosures published. Teams can run a standard campaign response without you. Requirements Must have 10+ years in security engineering, malware research, incident response, or offensive security, with several years leading cross-team work at Staff/Principal/Lead scope. Deep hands-on malware analysis and reverse engineering skills. Strong web application security and practical exploitation experience. Deep Linux knowledge from both the attacker's and the defender's side. Proven incident response leadership on large-scale events: you have run the response, written the advisory, and closed the post-mortem. Production coding in Python plus a systems language (Go, Rust or C). Experience with coordinated vulnerability disclosure and working with the security community. Clear, short writing for both engineers and non-technical stakeholders; works well async across time zones. Daily user of AI tools for analysis and coding, with critical judgment about their output. Nice to have Background in hosting or large web ecosystems. Detection authoring at scale (signatures, WAF/IDS rules). Kernel-level monitoring and rootkit detection. Threat intelligence practice and actor tracking. ML for malware classification. Public track record: CVEs, published research, talks, CTFs, open-source security tools. Relevant certifications are a plus, not a requirement. Benefits What's in it for you? Stay hands-on technically while owning complex, high-impact engineering work. Work on challenging Linux, automation, and cybersecurity problems across mature and newer products. Influence technical direction and make meaningful architectural decisions. Work independently with a high level of ownership and autonomy. Fully remote work with flexible working hours. 24 paid vacation days, 10 national holidays, and unlimited sick leave. Private medical insurance compensation. Co-working and gym/sports reimbursement. Education budget. Opportunity to receive a reward for innovative ideas that the company can patent. By applying for this position, you consent to the processing of your personal data as described in our Privacy Policy ( https://cloudlinux.com/candidate-privacy-notice ), which provides detailed information on how we maintain and handle your data.

Location: Poland; Brazil; Peru; Sweden; Argentina; Romania; Cyprus; Czech Republic; Hungary; Mexico; Chile; Bulgaria Workplace: Remote BUILDING THE FUTURE OF OPEN FINANCE Payward - the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services and CF Benchmarks - has spent the last 15 years building one of the most modern and globally accessible financial infrastructure platforms in the industry, built to advance an open, global financial system. THE TEAM xStocks brings real-world assets on-chain as tokenized securities that are regulated, fully-backed, and tradable across multiple blockchains. Built within Payward, the xStocks team runs the infrastructure that issues, custodies, and settles these instruments across EVM, Solana, TON, Tron, and more. The platform moves real value, so security is not a feature bolted on at the end. It is a property of everything the team ships. This is a hybrid engineering and security seat built for someone who is genuinely both: you ship products alongside the engineering team when the security queue is quiet, and you own security work end to end when it lands. You report into engineering and partner closely with the Payward security, CISO, and compliance functions. THE OPPORTUNITY - Own security deliverables end to end. Coordinate and review smart-contract audits, respond to security questionnaires and due-diligence requests, support CISO and compliance initiatives, and turn findings into tracked, closed-out fixes. - Run offensive assessments against our own platforms. Pentest the web apps, APIs, backend services, and on-chain components, and build the tooling to do it repeatedly rather than once. - Continuously assess posture. Threat-model new and existing systems, review architecture and key-management flows, and maintain a living view of the risks and their mitigations. - Review code for security. Be a default reviewer on changes touching auth, cryptography, custody, signing, and fund movement across our chains. - Harden the platform. Improve secrets handling, IAM and least-privilege, dependency and supply-chain hygiene, and detection and logging for security-relevant events. - Secure custody and signing workflows. Review and harden transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures. - Contribute to product engineering. Pick up regular backlog work in TypeScript so you stay close to the codebase you are defending. - Support incidents. Help with detection, triage, response, and post-mortems, and feed the lessons back into the program. WHAT YOU BRING - An engineer first. You write and review production code comfortably, TypeScript and Node.js in our stack, and you understand systems deeply enough to break them. - Strong application and infrastructure security fundamentals. The OWASP-class vulnerability landscape, authn and authz, injection, SSRF, supply-chain risk, and secure design. You have done real offensive work in pentesting, vuln research, or red-team. - Applied cryptography and blockchain security. Symmetric and asymmetric primitives, hashing, signatures, and key management, plus the security model of EVM, Solana, and ideally TON or Tron. You can read a smart contract and reason about how it fails. - Ownership. You can take an ambiguous security item, an audit, a questionnaire, or an incident, and drive it to closure without being managed through it. - Clear communication. You can explain a risk to engineers, to a CISO, and to an auditor, and tailor the message to each. - An automation instinct. You do not want to catch the same issue manually twice, so you turn findings into tests, alerts, controls, documentation, or platform improvements. - Risk judgment. You can tell a theoretical issue from a material one, and communicate severity, likelihood, impact, and remediation tradeoffs clearly. NICE TO HAVE - Experience commissioning or remediating third-party smart-contract audits. - Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security. - Cloud security depth in GCP or AWS, IAM, and container and runtime hardening. - Detection engineering and security observability, including SIEM and log-based detections. - Relevant certifications such as OSCP, OSWE, or GWAPT. - Prior work in a regulated fintech or tokenization/DeFi environment. Unless a specific application deadline is stated in the job posting, applications are accepted on an ongoing basis. Please note, applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance at or graduation from an educational institution. We consider qualified applicants with criminal histories for employment on our team, assessing candidates in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance. OUR COMMITMENT Payward is powered by people from around the world and we celebrate the diverse talents, backgrounds, contributions, and unique perspectives that everyone brings to the table. We hire based on merit, seeking out people with the right abilities, knowledge, and skills for the job. We encourage you to apply for roles where you don't fully meet the listed requirements, especially if you're passionate or knowledgeable about crypto. We may ask candidates to complete job-related skills or work-style assessments as part of our hiring process. These assessments evaluate competencies relevant to the role and are applied consistently across candidates for similar positions. Results are considered alongside experience and interviews, and are not the sole basis for any employment decision. As an equal opportunity employer, we don't tolerate discrimination or harassment of any kind, whether based on race, ethnicity, age, gender identity, citizenship, religion, sexual orientation, disability, pregnancy, veteran status, or any other protected characteristic as outlined by federal, state, or local laws. Stay connected Follow us on X https://twitter.com/krakenfx Learn on the Kraken Blog https://blog.kraken.com/#:~:text=Enter%20your%20email%20address Connect on LinkedIn https://www.linkedin.com/company/kraken-exchange/ Candidate Privacy Notice https://www.kraken.com/legal/candidate-privacy-notice

Location: Chicago DRW is a diversified trading firm with over 3 decades of experience bringing sophisticated technology and exceptional people together to operate in markets around the world. We value autonomy and the ability to quickly pivot to capture opportunities, so we operate using our own capital and trading at our own risk. Headquartered in Chicago with offices throughout the U.S., Canada, Europe, and Asia, we trade a variety of asset classes including Fixed Income, ETFs, Equities, FX, Commodities and Energy across all major global markets. We have also leveraged our expertise and technology to expand into three non-traditional strategies: real estate, venture capital and cryptoassets. We operate with respect, curiosity and open minds. The people who thrive here share our belief that it’s not just what we do that matters–it's how we do it. DRW is a place of high expectations, integrity, innovation and a willingness to challenge consensus. We are seeking a Cloud Security Engineer to work with various business units across the firm to empower our technologists to deliver secure cloud infrastructure and cloud integrated solutions. The position will work with the technology teams to ensure the cloud environments we use and configure are done so in a secure manner. You will also be responsible for defining global standards and guidelines to direct secure cloud development. A successful candidate will be able to establish base guidelines, implement security controls, review architecture and validate this is done in a repeatable and automatable fashion. While ensuring that the overall cloud presence of DRW is as secure as it can be. What you’ll be doing: Review and audit AWS/GCP/Azure environments spanning across multiple business units and recommend changes to reduce risk and improve security. Support development and work with technologists across the firm to unify cloud security efforts. Integrate services and access routes in a data intensive hybrid cloud environment. Provide architectural recommendations and support to ensure cloud and Kubernetes environments are securely deployed, including controls for role-based access, workload identity, network policies, secrets, container images, admission policies, runtime protection, logging, and monitoring. Provide recommendations and create working examples of secure hybrid cloud implementations. Helping business units across the firm to securely migrate on-premise designed software to the appropriate cloud technologies. Stay abreast of new developments in the areas of cloud technology, security, services, and networking. Work with vendors and vendor solutions to evaluate products, produce recommendations for the firm, and educate internal clients. Have a strong grasp of technologies that can be leveraged across both cloud and on-premise deployments (user supported authorization, etc). Identify and analyze vulnerabilities and work with the various business units on remediation. Continuously assess and enhance cloud privilege models to ensure least privilege access to data and services. Respond to any security related incidents. What we’re looking for: Bachelor’s degree or relevant work experience required. Relevant cloud certifications are a plus. Strong knowledge of cloud encryption technologies including key management such as (KMS, HSM, etc). 5+ years of experience working with Amazon Web Services, with exposure to other cloud vendors such as Google Cloud Platform and Microsoft Azure. A strong command of infrastructure-as-code tools such as Terraform, CloudFormation, and related technologies. Proficient with containerization and Kubernetes in Linux environments, including Kubernetes architecture, workloads, networking, managed services, security configuration assessment, vulnerability remediation, and automated guardrails using infrastructure-as-code and policy-as-code. Proficient with at least one applicable programming language (Python, Go, Javascript, etc). Experience with automation in the cloud, in addition to services used in loosely coupled serverless architectures, such as Lambda, SQS, API Gateway, and DynamoDB. Knowledge of cloud security best practices and cloud based controls. Familiarity with security considerations, capabilities, and regulatory adherence for services across cloud providers. Working knowledge of networking in hybrid cloud environments. Must work well in a fast-paced, dynamic work environment and have strong work ethic and initiative. Proven ability to troubleshoot and resolve production problems while making sensible decisions in times of stress. Excellent verbal/written communication skills and documentation/knowledge management skills. The annual base salary range for this position is $150,000 USD to $200,000 USD depending on the candidate’s experience, qualifications, and relevant skill set. The position is also eligible for an annual discretionary bonus. In addition, DRW offers a comprehensive suite of employee benefits including group medical, pharmacy, dental and vision insurance, 401k (with discretionary employer match), short and long-term disability, life and AD&D insurance, health savings accounts, and flexible spending accounts. For more information about DRW's processing activities and our use of job applicants' data, please view our Privacy Notice at https://drw.com/privacy-notice . California residents, please review the California Privacy Notice for information about certain legal rights at https://drw.com/california-privacy-notice . [#LI-LD1]

is looking for IT security engineers to lead identity, endpoint, access, automation, and operational security programs.

is looking for privacy and trust operations leads to build privacy, compliance, risk, and trust governance programs.