Вакансии

SpaceXAI is looking for Infrastructure Security Engineers to build and secure bare-metal, private-cloud, network, container, and hybrid-cloud infrastructure.

Location: EMEA - Remote Please note that we are unable to consider applications from candidates based in France, Italy, or Germany for this role. Money is moving onto the internet, and the shift has a name: Open Money. This is money that is open, portable, agentic, and owned by you. MetaMask spent the last ten years building it; with 100M+ downloads, users in ~190 countries, and trillions in cumulative transaction volume, it's the most trusted self-custodial financial platform on the internet. Now we're building the operating system for your money: one place to hold, move, grow, and use anything you own.  Join a remote-first, global team rebuilding how money works: a problem that touches everyone, every day. About the role MetaMask is a self-custody wallet that does not hold users’ private keys. Blockchain transactions are generally irreversible, meaning a vulnerability in the product or its software delivery chain can lead directly to financial losses for users. As a result, MetaMask attracts sustained attention from financially motivated attackers and sophisticated supply chain actors. We are looking for a Senior Manager, Application Security to lead application security across the MetaMask extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins, and supporting smart contracts. The role covers architecture, code, dependencies, build and release controls, security testing, and vulnerability disclosure. This is a hands-on leadership role. You will set the strategy and operating model, lead a small senior team, and remain directly involved in code review and threat modelling. You will report to the Head of Security and work closely with MetaMask Engineering leadership to ensure security risks are understood, owned, and addressed. Responsibilities Leadership and planning Lead and develop the Application Security team, including hiring, performance management and career development, while remaining directly involved in technical work. Set the Application Security strategy, annual goals and quarterly OKRs in line with company objectives and the approved Target Operating Model. Define and track KPIs to measure performance and progress. Report AppSec progress, coverage, remediation performance and material gaps to Security leadership and contribute to Risk Committee reporting. Secure design and delivery Define security review requirements across development and release, assess whether they are met and escalate unresolved risks. Lead threat modelling and security design reviews across clients, APIs and backend services, including authentication, key management, signing and delegated actions. Assess trust boundaries across the full system and participate in architecture and RFC reviews. Define software supply chain security requirements and work with engineering teams to implement and validate controls for dependencies, builds, artefacts and publishing. Lead security code reviews across MetaMask applications and smart contracts, working with engineers and relevant specialists to address findings. Define and evolve the secure development lifecycle to incorporate AI agents, including their access, actions and human review requirements. Set security standards for AI development tools, generated code and AI components in products. Integrate security testing into development and delivery workflows, including static and dynamic analysis, dependency scanning, secrets detection and AI scanning. Evaluate tools and validate their findings. Help engineers prevent recurring vulnerabilities through secure coding guidance, reusable libraries, training and the security champions programme. Vulnerability management and external testing Own application vulnerability assessment, triage, prioritisation and remediation tracking within the organisation’s vulnerability management framework. Correlate findings across clients, services and supporting infrastructure with the relevant owners to assess combined impact. Ensure findings have clear owners and deadlines, verify fixes and escalate overdue risks. Set the scope and proposed investment for bug bounty, penetration testing and AI security scanning based on risk and results. Manage external providers, researcher relationships, rewards and payouts, and coordinate vulnerability disclosure. Assurance and incident support Provide evidence of application security controls for audits and assurance reviews, and support customer and partner due diligence. Provide application security expertise during incidents, including vulnerability analysis and remediation support. Qualifications Required : At least eight years in application security or software engineering with a security focus, including two years leading people. Strong practical code review skills in TypeScript/JavaScript, Go or Solidity across browser extensions, mobile applications and backend services, with the ability to identify vulnerabilities and work with engineers to fix them. Proven experience securing applications across clients and backend services, including distributed authentication, authorisation and key management. Experience building or substantially improving an AppSec programme, including security reviews, automated testing, AI scanning, vulnerability management and developer support, with sound judgement on where AI adds value and how to validate its findings. Practical experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity and CI/CD. Experience running bug bounty and penetration testing programmes, including selecting and managing external providers. Working knowledge of EVM smart contract security, including common vulnerabilities, review methods, upgrade and admin controls, and assessing external audits. A record of delivering security improvements through engineering teams outside your reporting line. Clear written communication, from actionable threat models to concise summaries of risk for executives. Preferred : Offensive security qualifications such as OSCP, OSWE or OSWA, or a proven record in bug bounty programmes or CTF competitions. Experience securing browser extensions or mobile applications. Experience securing development workflows that use AI, or AI components in production applications. Experience in crypto, Web3 or another sector facing sustained attacks, such as fintech, payments or infrastructure. Knowledge of or a strong interest in applied cryptography. Familiarity with attacks by state actors against software companies, particularly DPRK supply chain and social engineering campaigns. Experience providing evidence of secure development controls for SOC 2 or ISO 27001 assessments. Don't meet all the requirements? Don't sweat it. We’re passionate about building a diverse team of humans and as such, if you think you've got what it takes for our chaotic-but-fun, remote-friendly, start-up environment—apply anyway, detailing your relevant transferable skills in your cover letter. While we have a pretty good idea of what we need, we're ready for you to challenge our thinking on who needs to be in this role. In the rapidly evolving Web3 space, we believe that everyone is a builder. This expansive paradigm requires a range of backgrounds, talents, skills, and experiences to influence and shape the future. At MetaMask, this diversity fuels our ability to shift control and redefine the realm of possibility. We are committed to ensuring that our technology empowers people and communities through decentralized technologies. We welcome the range of perspectives and differences and celebrate them. We're excited to see how your unique skills as a builder can contribute to our vision, drive innovation, and help us shape a more inclusive Web3. MetaMask is an equal opportunity employer. All employment decisions are made without regard to race, color, national origin, ancestry, sex, gender, gender identity or expression, sexual orientation, age, genetic information, religion, disability, medical condition, pregnancy, marital status, family status, veteran status, or any other characteristic protected by law. MetaMask is aware of fraudulent recruitment practices and we encourage all applicants to review our best practices to protect yourself, which can be found on our page. MetaMask may use artificial intelligence (AI) tools to support parts of our recruitment process, such as reviewing applications, screening resumes, or conducting initial candidate assessments. These tools are designed to assist our recruiting team and improve efficiency — they do not replace human judgment. A human recruiter or hiring manager reviews every candidate, and all final hiring decisions are made by people, not AI. It is a requirement of employment in this position that applicants may be required to submit to background and identity verification checks, including but not limited to employment, education, criminal record checks, and other such checks as determined necessary by the company.

Location: Hyderabad, India Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. Join us in our mission to transform the way people shop and eat, where impact, innovation, and growth drive everything we do. Our Information Security team enables innovation at speed—securely. As digital guardians of DoorDash, Deliveroo, and Wolt, we safeguard our systems and the data of our employees, customers, riders, and partners. We defend against emerging cyber threats and embed security into every facet of the business. From building resilient defenses and responding to incidents to empowering teams with security knowledge, we are trusted partners protecting these global brands from the inside out. About the Role The Senior Security Operations Centre Specialist offers a unique opportunity to shape our global Security Operations strategy across a global footprint of DoorDash, Deliveroo, and Wolt. This role provides the platform to optimize our technology and AI investments while pioneering new methods to protect our data, people, and partners. As we expand, your specialist capabilities will be essential to our continued success. What you’ll be doing Work in a 24/7 global security operations centre, including scheduled night and weekend shifts. Lead the triage and investigation of security alerts, including phishing, malware, network attacks, security hygiene and privacy related incidents within specified SLAs. Mentor a team of SOC Specialists, providing the necessary guidance and feedback to deliver a best-in-class security service to the business. Lead the development and continuously improve operational documentation, processes and playbooks Build and manage autonomous AI runbooks to automate and scale our alert triage capabilities. Lead incident response and escalation, ensuring lessons learned are translated into continuous security improvements. Support the design, development and review of threat-detection use-cases to identify suspicious activity across our cloud environment. Feed into the risk framework of emerging and observed threats from intelligence and / or incidents (e.g., post incident activity / repair items). Support wider security incident investigations involving Threat Intelligence and Incident Response & Digital Forensics stakeholders. Keep up to date with current security trends, advisories, publications and security research across the threat landscape Leverage metrics and KPIs to improve security posture and identify opportunities for strategic optimisation Collaborate with the team to develop and help deliver cybersecurity awareness programs for employees, emphasising incident reporting and best practices. Requirements 6–8 years of experience in SOC, demonstrating success in managing security incidents and delivering platform optimisations while acting as a technical mentor and lead for shift operations. Proven experience building threat detection capabilities in a cloud-centric, fast-moving organisation. Hands-on experience with AWS security config, SOAR, GSO, EDR/XDR, Splunk and SQL queries. Practical experience ideating, configuring, managing defensive security solutions and technical project management Committed to continuous improvement, leveraging feedback to elevate both personal and team performance. Exceptional collaborative team player and a knowledge-sharing mindset. Working knowledge of security compliance standards, e.g. ISO27001, GDPR, NIS2 and PCI-DSS. Capable of working well both independently and collaboratively, whilst keeping calm, under the pressure of an incident with potentially high impact to the business. Able to communicate effectively during or after any incident update to both technical and non-technical stakeholders. Coordinate with the US, UK and EU central security teams as required. Preferred, but not required Understanding of IAM cloud security principles Experience in a DevOps environment with familiarity of CI/CD pipelines Hands-on experience with container technologies and orchestration services Knowledge of cloud security data encryption standards and principles Why Deliveroo? At Deliveroo, you’ll do work that matters—solving real-world problems in a three-sided marketplace that’s constantly evolving. We’re food lovers, problem solvers, community organisers, proud parents, and more, brought together by a shared drive to make things better. Working here you can expect to: 🔧 Solve meaningful problems at real scale Work on a complex, always-on marketplace that impacts millions every day. 🌱See your impact, fast Ship, test and improve ideas quickly in a low-hierarchy, high-ownership environment. 🧠Grow through challenge and ownership Take on big, ambiguous problems and accelerate your career with strong support. 🌎A culture built for builders High standards, collaboration, flexible working and continuous learning. Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. Diversity, Equity and Inclusion At Deliveroo, we know that a great workplace reflects the world around us and that true diversity and inclusion make us stronger, more creative, and better at what we do. We’re committed to fostering an environment where everyone can do their best work and feel they belong. We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief. If you have a disability or long-term health condition and need support to apply for one of our roles, or require any reasonable adjustments during the recruitment process, you’ll have the opportunity to let us know once you’ve submitted your application. We’ll share details on how to request support so we can ensure you have a fair and equitable experience. If you’re excited about making a real impact in a fast-moving marketplace and growing your career alongside ambitious, supportive teams, we’d love to hear from you! Beware of recruitment scams: DASH Brands will never ask you to pay money or share sensitive financial information during hiring — learn more about DASH Brands' legitimate recruiting process at careersatdoordash.com/recruitment-scam-awareness .

Runpod is looking for a Director of Security to lead security strategy, compliance, secure development, incident response, and security operations.

Anthropic is looking for a Senior Staff Security Engineer to lead incident response and build threat detection and response capabilities.

Location: US - Headquarters - Maryland - Columbia Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey! What makes Tenable such a great place to work? Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together! Your Role: Tenable's InfoSec team is looking for a Security Engineer to join our Security Engineering & Architecture group. This role was built deliberately to span disciplines rather than specialize in one: you'll split your time between securing our cloud environments and supporting general security engineering disciplines across the business — covering cloud and non-cloud systems alike. If you're early-career but curious across the breadth of InfoSec rather than narrowly focused on one domain, this role is built for you. Your Opportunity: Support day-to-day cloud security operations — monitoring, triage, and remediation of findings across AWS, Azure, and/or GCP environments using CNAPP/CSPM tooling. Contribute to Security Architecture Reviews for new systems, integrations, and vendor onboarding — regardless of whether the system in question is cloud-hosted, on-prem, or SaaS. You'll work directly with the architects and engineers who own this process today, learning the methodology and eventually taking reviews from intake to sign-off. Help identify and document misconfigurations, excessive permissions, and insecure IaC patterns (Terraform/CloudFormation), and help track remediation through to closure. Participate in risk assessments and threat modeling exercises for new projects — applying the same core analysis skills whether the subject is a cloud workload, an internal application, or a third-party integration. Assist with IAM/RBAC reviews and least-privilege efforts; flag static credentials, over-broad roles, and gaps in audit logging wherever they appear in the environment. Build foundational familiarity with how AI/agentic systems intersect with our environment — cloud-hosted LLM services (AWS Bedrock, Azure OpenAI, GCP Vertex AI), the Model Context Protocol (MCP), and the basic risk surface of agent/tool-calling architectures and apply that awareness during reviews when these systems show up in scope. Work cross-functionally with engineering, GRC, and TPRM to keep architecture reviews and cloud findings moving — this role is a connective thread between teams, not a silo. What You'll Need: 2–3 years of experience in a security engineering, cloud security, IT security, or related technical role (internships and adjacent IT/ops experience count). Working knowledge of at least one major cloud provider (AWS, Azure, or GCP) — IAM fundamentals, networking basics, and common misconfiguration patterns. Basic understanding of security architecture review or threat modeling concepts (e.g., STRIDE, data flow diagrams) — or clear aptitude and interest in learning them. Familiarity with core security engineering practices: least-privilege access, audit logging, secrets management (no static credentials), and secure configuration baselines. Comfort reading documentation and asking good questions across unfamiliar systems — this role touches a lot of different architectures, so curiosity matters more than deep specialization in any one of them. Strong written communication — you'll be documenting review findings and cloud remediation guidance for technical and non-technical audiences alike. And Ideally: Exposure to IaC security scanning (Terraform/CloudFormation) or CNAPP/CSPM/CIEM platforms. Some hands-on exposure to a formal architecture/design review process, even informally (e.g., reviewing a peer's system design for security gaps). Basic familiarity with AI/LLM concepts — prompts, context windows, tool/function calling, RAG — and awareness of frameworks like the OWASP Top 10 for LLM Applications or the NIST AI RMF. A relevant certification (Security+, AWS/Azure/GCP security certs, or similar) or equivalent self-directed learning. Prior exposure to compliance frameworks (SOC 2, FedRAMP, ISO 27001) relevant to architecture review sign-off #LI-Hybrid #LI-MS1 This is the base pay range for this position. Compensation for the role will depend on a number of factors, including the candidate's qualifications, skills, competencies, location and experience, and may fall outside of the range shown. Employees are also eligible for variable compensation in addition to base pay (commission for sales roles, bonus for non-sales roles), depending on company and individual performance. Tenable also offers a variety of comprehensive and competitive benefits which include: medical, dental, vision, disability and life insurance; 401(k) retirement savings with company match; an employee stock purchase plan; an employee referral program; flexible spending accounts; an Employee Assistance Program (EAP); education assistance; parental leave; paid time off (PTO); company-paid holidays; health and wellness events; and community programs. US Pay Range $102,500 — $136,500 USD We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels.  If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact Recruiting@Tenable.com for further assistance. Tenable Data Consent Statement Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you: General Applicant Privacy Notice California Applicant Privacy Notice EU/EEA/UK Applicant Privacy Notice

Location: Strava SF Workplace: Hybrid ABOUT STRAVA Strava is the app for active people. With over 200 million athletes in more than 185 countries, it’s more than tracking workouts—it’s where people make progress together, from new habits to new personal bests. No matter your sport or how you track it, Strava’s got you covered. Find your crew, crush your goals, and make every effort count. Start your journey https://www.strava.com/subscription with Strava today. Our mission is simple: to motivate people to live their best active lives. We believe in the power of movement to connect and drive people forward. This role is on the Strava Security Team, which exists to protect Strava’s people, business, and data through integrated, proactive security practices.   We work across all security domains, including, but not limited to, product security, vulnerability management, incident response, infrastructure, network, and enterprise security.   We follow a flexible hybrid model that generally translates to around half your time on-site in our San Francisco office – three days per week. WHAT YOU’LL DO: - Protect a platform that supports millions of athletes by ensuring Strava’s applications and infrastructure are secure, resilient, and compliant across regions. - Work closely with engineering, infrastructure, and security teams to design and implement secure architectures and development practices. - Make a high-leverage impact by shaping how Strava manages application and infrastructure risks in the US and EU, ensuring speed, accuracy, and consistency in remediation. - Build automated workflows that identify vulnerabilities early, enforce secure configurations, and strengthen our CI/CD and cloud security controls. YOU WILL BE SUCCESSFUL HERE BY: - Being highly self-motivated and detail-oriented, with a strong sense of ownership for Strava’s application, infrastructure, and network security posture. - Driving secure-by-design practices across engineering teams, including threat modeling, architecture reviews, and vulnerability management. - Embracing the usefulness of generative AI tools and applying them to your daily work. - Partnering with Engineering and Infrastructure teams to embed automated security checks into CI/CD pipelines and infrastructure-as-code deployments. - Coordinating incident response, vulnerability triage, and remediation validation in partnership with the global security team. WHAT YOU’LL BRING TO THE TEAM: - Bring hands-on experience in application and infrastructure security, including code review, threat modeling, and securing cloud-native environments (AWS preferred). - Have designed or implemented automated security controls in CI/CD pipelines using tools like GHAS, Snyk, Semgrep, Trivy, etc. - Understand how to secure containerized and distributed environments, including Kubernetes, IAM, and network segmentation. - Are comfortable managing vulnerability management programs end-to-end, from detection and prioritization through engineering remediation. - Are collaborative and pragmatic — able to influence engineering teams through partnership, technical credibility, and clear communication. For information on benefits, please click here https://docs.google.com/document/d/e/2PACX-1vTkFMPz3eCjd0FgQ28VWnK4d2BEnzGyaSFGwATR-dQdBb9HxZgay6kboqnT0-V-qaBDzSvYIzI76vT5/pub. WHY JOIN US? Movement brings us together. At Strava, we’re building the world’s largest community of active people, helping them stay motivated and achieve their goals. Our global team is passionate about making movement fun, meaningful, and accessible to everyone. Whether you’re shaping the technology, growing our community, or driving innovation, your work at Strava makes an impact. When you join Strava, you’re not just joining a company—you’re joining a movement. If you’re ready to bring your energy, ideas, and drive, let’s build something incredible together. Strava builds software that makes the best part of our athletes’ days even better. Just as we’re deeply committed to unlocking their potential, we’re dedicated to providing a world-class, inclusive workplace where our employees can grow and thrive, too. We’re backed by Sequoia Capital, TCV, Madrone Partners and Jackson Square Ventures, and we’re expanding in order to exceed the needs of our growing community of global athletes. Our culture reflects our community. We are continuously striving to hire and engage teammates from all backgrounds, experiences and perspectives because we know we are a stronger team together. Strava is an equal opportunity employer. In keeping with the values of Strava, we make all employment decisions including hiring, evaluation, termination, promotional and training opportunities, without regard to race, religion, color, sex, age, national origin, ancestry, sexual orientation, physical handicap, mental disability, medical condition, disability, gender or identity or expression, pregnancy or pregnancy-related condition, marital status, height and/or weight. We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation. California Consumer Protection Act Applicant Notice https://docs.google.com/document/d/e/2PACX-1vSc8y6On4NlP5s12hf4kmWe_pvenVyQ78TbtVaz_clROhj9ADQ6kY4YScglBIuY2joKFKalOReX7vP_/pub

Location: North America Workplace: Remote At Linear, we're building the product development system for teams and agents. AI is fundamentally changing how software gets built, and we’re shaping the tools this new era requires. Founded in 2019, Linear has become the platform of choice for more than 50,000 companies (including OpenAI, Coinbase, and Ramp) to plan, build, and ship their products. Today, our team is distributed across North America, Europe, and Australia, and we’re continuing to grow internationally. What unites us is relentless focus, fast execution, and a deep care for software craftsmanship. At Linear, we are committed to quality. Security is an essential part of that quality — not a layer that we add later, but something we build in from the start. We have a foundational security program we're proud of but, as Linear evolves our product and scales into enterprise, there's meaningful work ahead: staying ahead of vulnerabilities as our attack surface grows, responding fast and cleanly when incidents happen, and hardening our product and infrastructure. As Security Engineer at Linear, you'll be operating in a high-autonomy role with real scope, doing hands-on security work across the product and infrastructure we build. Location & work mode Linear is a remote-first company. This role is open to candidates based in North America. You can work from anywhere within this region. We value deep focus and async collaboration, with intentional moments to connect in person through team off-sites, optional co-working, and occasional travel. What you’ll do Depending on your experience / skillset and our broader priorities, you could: - Operate, automate, and extend vulnerability management end-to-end: triage, prioritize, and drive remediation across product, infrastructure, and dependencies, and keep the program’s SLAs meaningful rather than theoretical - Run our bug bounty program: triage incoming reports, validate severity, work with engineering on fixes, and keep researcher relationships professional and responsive - Lead product security testing: threat model new features (including AI/agent-facing surfaces), review designs and code for security-relevant risk, and do hands-on testing (manual and tool-assisted) rather than relying solely on scanners - Be a primary responder for security incidents: lead investigation and containment, drive postmortems, and turn lessons into concrete hardening work - Own meaningful chunks of our cloud/infra security posture on GCP/k8s/Postgres: harden configurations, close gaps surfaced by audits or scanning, and partner with infra engineering on secure defaults - Build and maintain security tooling and automation, including using AI/LLM tooling to speed up triage, code review, and repetitive investigation work, so the program scales without linear headcount growth - Partner with the GRC/Trust function: feed real findings into the risk register and control evidence, and help make sure compliance requirements reflect actual engineering practice What we’re looking for - A generalist, senior-level security engineer (5+ years across security engineering, with real depth in at least two of: vulnerability management, product/appsec testing, incident response, and cloud security). We need breadth, rather than a narrow specialist in any one of these. - Hands-on and technical: you can read and reason about code (we use a lot of TypeScript), you’re comfortable in cloud environments (GCP a plus), and you can go deep on a finding rather than just filing a ticket for someone else to fix. You’re comfortable using AI coding/security tools as force multipliers (Linear Agent, Claude, Codex, etc). - Calm under pressure: you can lead an incident from first alert through postmortem without needing to be told what to do next - A builder: you’d rather write a script or ship a tool than repeat a manual process a third time - A pragmatic risk-reducer: you optimize for actually reducing risk, not for checking a box or maximizing findings count - Autonomy-oriented: comfortable setting your own priorities, working with significant independence, and knowing when to escalate - A clear communicator: able to explain a technical finding to a non-technical stakeholder and write it up so it’s actually actionable Our tech This is a hands-on security engineering role. You'll be running tools, reading/writing code, building detections, working in our cloud environment, and partnering closely with the engineers who build our product. Our stack is fronted by Cloudflare and runs on Google Cloud with k8s, Postgres, and Node. For day-to-day work, we use: - Linear, GitHub, Slack, and Google Workspace for collaboration - Claude and ChatGPT for general & engineering-specific AI tasks - Vanta for compliance automation and evidence collection Our security-specific tooling includes: - GitHub Advanced Security - RunReveal - SentinelOne What we offer We're a small, focused team that cares deeply about the quality of our work and the people we do it with. Here's what you can expect: - Competitive salary and equity - Employee-friendly equity terms including early exercise in the US and extended exercise windows - Daily meal and coffee stipend on every workday - Paid co-working space or desk - Health coverage (based on country requirements) - 5 weeks paid vacation, plus local statutory holidays - 4 months paid parental leave - Paid month off after 4 years & every 2 years thereafter - Regular team events and off-sites - Remote-first with no required commute Compensation For US-based candidates, the expected cash compensation range for this role is $240,000—$282,000. For sales roles, this range represents on-target earnings (OTE), including base salary and variable compensation; for all other roles, it represents base salary. Final compensation is determined based on job-related knowledge, skills, and experience. For sales roles, actual earnings vary based on sales performance. Equity is a meaningful part of all offers at Linear. Learn how we think and work - Read Me https://linear.app/readme a story about our mission - Our hiring process: How we hire at Linear https://linear.app/now/how-we-hire-at-linear - How we work: Designing remote work at Linear https://linear.app/now/designing-remote-work-at-linear - Why and how we do work trials https://linear.app/blog/why-and-how-we-do-work-trials-at-linear Linear blog post - How we use AI in design https://designerfund.substack.com/p/ai-design-linear feature of Linear's design team - Scaling our real-time sync engine https://linear.app/blog/scaling-the-linear-sync-engine talk by our cofounder, Tuomas Artman, at Linear's 2023 offsite - Our recent tender offer: Sharing Linear’s growth with the people building it https://linear.app/now/sharing-growth-with-the-people-building-linear A note on recruitment fraud: all official Linear hiring communication comes from an @linear.app http://linear.app email address, and all open roles are listed at linear.app/careers http://linear.app/careers. We never ask candidates for payment or financial information. Suspicious messages can be reported to security@linear.app. Linear is an equal opportunity employer. We do not discriminate based on race, color, religion, gender identity or expression, sexual orientation, national origin, age, disability, veteran status, or any other protected characteristic under applicable law.

— Управление доступами и Data Governance; — Оценка рисков, моделирование угроз и реагирование на инциденты (SIEM/SOAR);

Location: United Kingdom, London Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. Sony Interactive Entertainment Security Architecture | Cloud | AI Security | Enterprise Platforms We are seeking a Staff Security Architect to help shape and secure the next generation of enterprise, cloud, platform, and AI-enabled technology. This role combines deep security architecture expertise with strong engineering judgment and the ability to influence technical direction across complex, global environments. The successful candidate will partner with engineering, infrastructure, product, and security teams to identify systemic risk, develop scalable security patterns, and guide secure adoption of emerging technologies, including generative AI and agentic systems. Key Responsibilities Design, review, and approve security architecture for enterprise, cloud, SaaS, platform, and application environments, balancing business objectives, engineering constraints, and risk. Lead cloud security architecture across AWS, Google Cloud, and hybrid environments, including identity, network security, data protection, logging and monitoring, key management, workload isolation, security posture management, and the effective use of native and third-party cloud security controls. Define and review security architecture for SaaS and PaaS platforms, including identity federation, privileged access, tenant configuration, data protection, API and integration security, logging, third-party risk, and secure adoption of enterprise SaaS services. Drive security throughout the software delivery lifecycle, including source control, CI/CD pipelines, build systems, artifact repositories, infrastructure as code, secrets management, code and artifact signing, software provenance, deployment automation, and security controls for developer platforms. Lead security architecture for AI-enabled systems, including generative AI, large language models, retrieval-augmented generation, AI agents, model-serving platforms, and AI-assisted developer workflows. Design mitigations for risks such as prompt injection, insecure tool use, excessive agency, sensitive-data disclosure, model or supply-chain compromise, unsafe output handling, and abuse of AI services. Define security requirements for AI data, models, prompts, embeddings, vector stores, APIs, tools, and agent identities, including least-privilege access, secrets management, encryption, isolation, provenance, logging, monitoring, and lifecycle controls. Architect and improve identity, authentication, authorization, network security, key management, cryptography, application security, and production security controls across complex environments. Identify security design gaps in existing and proposed systems; translate findings into practical architecture improvements, reference patterns, hardening standards, preventative controls, and responsible automation that improves repeatability and operational effectiveness. Provide technical leadership across multi-disciplinary teams, clearly articulating risks, tradeoffs, and recommended solutions to engineering leaders, business stakeholders, and audiences without a security background. Required Qualifications 15+ years of relevant experience in security architecture, security engineering, product security, cloud security, infrastructure security, or related disciplines, with demonstrated leadership at senior or staff level. Deep knowledge of security architecture principles across cloud, application, network, identity, platform, infrastructure, and enterprise environments. Hands-on experience designing or securing cloud-based and containerized environments, including major cloud platforms such as AWS or Google Cloud. Strong understanding of modern identity and access management, PKI, OAuth/OIDC, SAML, TLS, VPNs, secrets management, key management systems, cloud KMS, and HSMs. Expertise in network and application security controls such as WAFs, NGFWs, segmentation, DMZ design, DDoS mitigation, load balancing, proxies, intrusion detection/prevention, and host-based controls. Experience with secure software development, threat modeling, CI/CD and developer platforms, application security, and engineering mitigations across the software lifecycle. Working knowledge of AI/ML security concepts and the ability to evaluate security risks in generative AI, LLM, and agentic system architectures, including data flows, trust boundaries, model access, and tool integrations. Strong critical thinking, risk prioritization, communication, and influence skills, with the ability to lead through ambiguity and work effectively across global, cross-functional teams. Bachelor's degree in Computer Science, Mathematics, Engineering, Information Security, or equivalent practical experience. Preferred Qualifications Experience securing AI/ML platforms, generative AI applications, model gateways, RAG architectures, vector databases, or agentic workflows in production environments. Experience with AI security evaluation, red teaming, adversarial testing, model abuse testing, or control validation for AI-enabled systems. Experience securing large-scale Linux, distributed, multi-tenant, or high-availability production environments. Development or automation experience in Python, C++, Java, or similar languages. Recognized technical leadership through patents, publications, open-source contributions, conference participation, teaching, or security community involvement. Penetration testing, adversarial security, or attacker-minded design experience. Master's degree or Ph.D. in Computer Science, Mathematics, Engineering, Information Security, or a related field. Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks. Please refer to our Candidate Privacy Notice (where applicable) for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights. Equal Opportunity Statement: Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category. We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond. Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.

Location: Bulgaria Company Background Our client is a travel technology company developing cloud-native, AI-powered software for airlines and hospitality brands. Its products help customers improve commercial performance, reduce costs, and evolve their digital commerce capabilities. The company’s technology is designed to work alongside existing airline systems, allowing customers to introduce new capabilities without replacing their current technology landscape. Project Description You will contribute to a large-scale greenfield travel-technology initiative supporting the launch of a new airline operation. The project uses a modern commercial platform to enable flexible retailing, pricing, and digital shopping experiences across travel products and ancillary services. Technologies GCP, AWS Wiz Cloudflare WAF, Bot Management, DNS, TLS, DDoS Protection and Rate Limiting Terraform SonarCloud and Dependabot Jira, PagerDuty and Slack Python and Bash What You'll Do Own and continuously improve cloud security posture across GCP organizations and AWS accounts, including connector coverage, runtime sensor deployment on production clusters, custom policy development, finding-triage baselines, and integrations with Jira, PagerDuty, and Slack; Operate and evolve the edge security layer, centralizing internet-facing protection through Cloudflare WAF, bot management, rate limiting, DNS/TLS, and origin routing for customer-facing production zones; Tune security rules using real production traffic, manage allow-list requests, and enable other teams to use edge-security tooling effectively; Support and automate vulnerability management and secure configuration, maintaining the intake of Wiz, SAST, penetration-test, and customer-reported findings, defining remediation baselines, and driving owners to closure; Participate in security incident response for cloud events, including DDoS and bot attacks, supply-chain alerts, credential exposure, and data-handling incidents, while creating and maintaining detection, triage, and mitigation runbooks; Help secure the software supply chain by owning SAST reporting in SonarCloud, dependency scanning with Dependabot, container base-image hardening, and the selection of SBOM and SCA tooling, and publish release-level security reports for engineering teams; Produce technical evidence for SOC 2, PCI DSS, ISO 27001, and NIS2, including evidence of log-sink configuration and retention, access reviews, authenticated scanning, and IAM remediation, and map Wiz controls to relevant frameworks to make evidence collection repeatable; Enable security self-service by training Platform, CloudOps, and Product Engineering teams on the tools they use, including Wiz and Cloudflare administration, mapping service catalogues to owners, and automating recurring customer-security and issue-triage reporting through scripting and AI-assisted workflows; Advise and partner with engineering teams on the security of new platform integrations and AI/RAG services, contributing to the annual cloud-security roadmap and target-state architecture; Job Requirements 5+ years of experience in cloud security or platform engineering with a security focus, including hands-on experience with GCP or AWS across IAM, audit logging, log routing, network security, and workload protection; Production experience with a CNAPP/CSPM platform, such as Wiz (preferably) / Prisma Cloud / Orca / Google Security Command Center, including policy authoring, integrations, and runtime protection; Hands-on administration of a WAF, CDN, and bot-management stack at scale; Strong Terraform experience, including building modules for security tooling and WAF configuration, reviewing changes, and managing configuration drift and legacy infrastructure; Experience with vulnerability management across cloud infrastructure, containers, and code, including SAST, SCA/dependency scanning, container image hardening, and penetration-test remediation tracking; Experience routing cloud security signals to a SIEM or security-monitoring platform, such as Wazuh, Microsoft Sentinel, Google Security Operations, or Datadog Security Monitoring, and integrating actionable alerts with PagerDuty and Slack; Scripting skills in Python or Bash for automation and security reporting; Security incident-response experience in a production environment, including developing runbooks and managing vendor escalations; Clear written and verbal communication skills, with the ability to train engineering teams and document security decisions; Nice To Have Experience automating security workflows, such as report generation and issue triage, with AI-assisted or LLM-based tooling; Experience working across both GCP and AWS, experience with Azure; Familiarity with Rego, OPA, or other policy-as-code languages; Experience with identity and access-management tooling, including Okta SSO/SCIM, PAM solutions, and least-privilege reviews for cloud IAM; Experience facilitating OWASP SAMM assessments, threat-modelling sessions, or security-champions programs; Airline or travel-industry experience, including PCI-scoped payment flows, partner integrations, and customer-facing security reporting; Experience supporting compliance with PCI DSS, SOC 2, ISO 27001, or NIS2; Certifications such as Google Professional Cloud Security Engineer, CCSP, or AWS Certified Security – Specialty; What Do We Offer The global benefits package includes: Technical and non-technical training for professional and personal growth; Internal conferences and meetups to learn from industry experts; Support and mentorship from an experienced employee to help you professional grow and development; Health insurance; Sports activities to promote a healthy lifestyle; Flexible work options, including remote and hybrid opportunities; Referral program for bringing in new talent; Work anniversary program and additional vacation days.

Dave is looking for a Lead GRC and Security Governance to build and operate technology risk, control, assurance, audit, incident, and business-continuity governance systems.

Самостоятельное выявление угроз, анализ рисков, расследование инцидентов и внедрение технических мер защиты. • Опыт в Cybersecurity / Information Security от 3 лет.

Location: Global Remote Workplace: remote Metabase is the easiest way for people to get insights from their data, from tiny startups who get up and running quickly to major corporations with tens of thousands of users. That's why people love us.   We bring data tools with the elegance and simplicity of consumer products to the crufty world of enterprise business intelligence. We provide an opinionated open source starting point for how companies should measure, analyze and share their data, which is used by tens of thousands of companies. About the Role We’re looking for a Security Engineer with deep expertise in source code analysis and offensive product security research. You’ll dig into complex software architectures, trace how code behaves at runtime, uncover subtle vulnerabilities, and address the systemic flaws behind them. Embedded in our core engineering team, you’ll help shape security decisions from early design through release and adoption. This is a hands-on engineering and research role: you’ll combine your security expertise with frontier AI tools to find vulnerabilities, develop fixes, and make Metabase secure by default across its product, dependencies, and runtime. Things you’ll do Partner with engineers throughout feature development, bringing security expertise to design, implementation, release, and adoption. Build security-focused features, lead security improvements across the codebase, and implement fixes that address root causes. Use and evaluate advanced AI tools to scale code analysis, vulnerability research, and secure engineering practices. Conduct offensive research into Metabase, develop proofs of concept, and validate vulnerabilities. Assess findings based on exploitability and real-world impact, define clear remediation criteria, and verify that fixes are effective. Turn individual findings into broader improvements that prevent entire classes of vulnerabilities. What you bring A demonstrated track record of finding and exploiting application vulnerabilities through source code analysis and hands-on research. The ability to independently navigate unfamiliar codebases, understand complex architectures, and reason about runtime behavior and trust boundaries. Experience with application security challenges, including authentication, authorization, injection, and unsafe handling of untrusted data. Sound judgment about exploitability and real-world impact, and the ability to communicate findings and remediation options clearly. Strong software engineering skills, including the ability to implement durable security fixes. Experience in Clojure, or a strong desire to learn. A thoughtful approach to AI-assisted security work, using these tools to extend your expertise while independently validating their output. Ownership and curiosity: you pursue difficult questions, collaborate closely with engineers, and follow findings through to resolution. Compensation The US base salary range for this role is $160K–$225K annually, plus equity and benefits. Compensation is determined by role, level, location, and individual qualifications, including skills, experience, and scope of responsibility. Pay may vary by geographic location and other job-related factors. Benefits We offer meaningful equity and a comprehensive US benefits package, including fully employer-covered medical, dental, and vision insurance (with 75% coverage for dependents), a 401(k) with employer match available to enroll after the first 30 days, flexible and unlimited paid time off including sick time, and an asynchronous, remote-first environment. We're a global team (50% outside the US), fully distributed (from Thailand to California), who get things done asynchronously, with plenty of uninterrupted time, supporting each other to do the best work of our careers. We offer flexibility (define your own schedule and work from wherever you want), autonomy, and an environment that fosters growth, learning, and development. We're relentlessly user-focused and believe in building long-term value, not short-term hacks. And we raised a $30M Series B to take our approach to the next level for years to come.   For U.S. applicants: Metabase participates in the federal E-Verify program, which confirms employment authorization of newly hired U.S. based employees. E-Verify is not used as a tool to pre-screen candidates and is only initiated upon hire.   E-Verify Participation Notice (English/Spanish) Right to Work Notice (English/Spanish)

Ищем сильного Security Engineer с практическим опытом защиты инфраструктуры, расследования инцидентов и проектирования архитектуры безопасности. • Опыт в Cybersecurity / Information Security от 3 лет.

Location: Vienna, Austria About Us Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance. Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution. Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services. We are looking for a hands-on Senior Security Specialist to lead and oversee key security initiatives across the organization. You will play a central role in strengthening our security posture, driving compliance certifications, and ensuring robust access governance — working closely with the CISO to protect our infrastructure and data assets. Key Responsibilities Identity & Access Management (IAM) Design, implement, and maintain IAM frameworks, policies, and processes across the organization Oversee access rights management, including provisioning, de-provisioning, and periodic access reviews Lead the rollout and enforcement of Multi-Factor Authentication (MFA) across all systems and user groups Ensure least-privilege principles are consistently applied and audited Network Security Oversee the implementation and continuous improvement of network security controls Monitor, detect, and respond to security threats and vulnerabilities across the network infrastructure Security Reporting & Audit Generate regular security reports and dashboards for the CISO and senior management Support internal and external audit processes, ensuring timely and accurate documentation Coordinate and oversee penetration testing engagements, track findings, and drive remediation Compliance & Certification Lead and coordinate security certification processes (e.g. PCI DSS, ISO 27001) in close collaboration with the CISO Conduct gap analyses, maintain compliance documentation, and liaise with auditors and certification bodies Requirements Bachelor's degree or above in Computer Science, Information Technology, Cybersecurity, or a related field 3–5 years of hands-on experience in information security Proven track record in security project implementation and management Demonstrated experience in IAM, network security, or compliance programs Certifications would be a strong plus CISSP, CISM, CISA, or equivalent ISO 27001 Lead Implementer / Lead Auditor PCI DSS QSA or ISA certification IAM-related certifications (e.g. Microsoft Identity, SailPoint, Okta) Skills Solid understanding of IAM principles, network security, and regulatory frameworks Strong analytical and independent problem-solving abilities Excellent communication and stakeholder management skills Ability to manage multiple priorities in a fast-paced environment Can use German and English as working language Why Join Us At Bybit, we are committed to fostering a supportive and enriching work environment. Our benefits include: - Study Growth Fund: We support your professional development and continuous learning. - Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation. - Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world. - Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company. - Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.

-Выстроить централизованную систему IT-безопасности и управления инфраструктурой для всех юридических лиц группы компаний. -Управление доступами — разделение данных, дисков и папок по юридическим лицам, централизованная выдача и отключение доступов, контроль onboarding/offboarding.

Squads is looking for a Senior Security Engineer Product and Infrastructure to lead product and infrastructure security, conduct reviews, manage vulnerabilities, and strengthen secure development practices.