Вакансии

Location: Remote Canada At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most. About the InfoSec team The InfoSec team protects Affirm’s systems and data from evolving threats. We manage security risk, monitor vulnerabilities, and enforce protective controls across the company. The team leads incident response, compliance, identity and access management, and employee training. Our goal is to ensure that security is built into every system and decision at Affirm. We maintain a secure, trustworthy environment so the business can operate and grow with confidence. About the role In this role, you'll help mature Affirm's insider threat program. You'll build out the controls, detection use cases, and investigative practices that make it work day to day, support insider risk investigations, and partner with Legal, HR, Privacy, and Compliance to keep the program effective, proportionate, and trusted by Affirmers. What you’ll do Lead the build-out of key insider threat workstreams, from initial design through to day-to-day operation Build out the program's operating mechanics, including investigative standards, playbooks, and the metrics and reporting that show whether the program is working Support insider risk investigations alongside SIRT, bringing insider threat expertise, telemetry and evidence analysis, and written findings and risk recommendations Partner with Legal, HR/Employee Relations, Privacy, and Compliance on case handling and escalation criteria, helping ensure the program respects employee privacy and meets legal and regulatory obligations Threat model Affirm's highest-risk data and systems for insider risk, and partner with detection engineers to turn the results into production detections Own and improve the controls that reduce insider risk, including data loss prevention, endpoint monitoring, secure browser and contractor access controls, SaaS posture management, and access governance, working with system owners to close gap Automate the program's operational load with workflow automation platforms and Python, covering evidence collection, case routing, and reporting Build and expand agentic automations that assist with insider risk triage and investigation, and define which decisions stay with a human What we look for Deep expertise in security engineering, security operations, insider risk, or digital forensics Track record of standing up new security capabilities where little existed before Experience running investigations end to end, including evidence handling, log and endpoint forensics, timeline reconstruction, and written findings suitable for Legal and HR audiences Ability to write and evaluate detection logic against endpoint, identity, cloud, and SaaS telemetry in a SIEM (Splunk, Elastic, Panther, Chronicle, or similar) Hands-on experience with insider risk tooling such as DLP, UEBA, endpoint detection and response, CASB, and access governance, with a practical sense of their strengths and limits Working knowledge of Python for security tooling and automation Experience building and maintaining production workflows in automation platforms such as Tines, Torq, or similar Experience building and running agentic automations in production that assist with alert triage and investigation, such as LLM-driven enrichment, summarization, or first-pass analysis, with a clear view of where human review stays in the loop Discretion and sound judgment handling sensitive investigations, and comfort navigating the privacy, legal, and employee-relations considerations that insider work carries Clear written and verbal communication skills, with the ability to work across Security, Engineering, Legal, HR, Privacy, and Compliance Experience in regulated or financial services environments (SOC 2, PCI DSS, GLBA) is a plus Base Pay Grade - N Equity Grade - Canada 6 Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company). CAN base pay range per year: $153,000 - $213,000 $CAD. This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. #LI-Remote Remote-first with flexibility built in Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience. Benefits designed for you Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights: Health coverage at no cost: We cover 100% of premiums for employees and their dependents. Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you. Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to. Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount. We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help. For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law. By clicking "Submit Application," you acknowledge that you have read Affirm's Global Candidate Privacy Notice and consent to the use of your personal information as described.

Location: San Francisco fal is the generative media ecosystem powering the next generation of AI products. We build the infrastructure, tools, and model access that teams need to move from idea to production, and do it at scale without compromise. For developers and enterprises, fal is the foundation that makes generative media not just possible, but practical: a unified platform where high-performance inference, orchestration, and observability come together to unlock new categories of AI-native products. As generative media reshapes industries across a market projected to grow by hundreds of billions over the next decade, fal is becoming the ecosystem that ambitious teams build on. ABOUT THIS ROLE: We’re hiring a Senior Infrastructure Security Engineer to secure the foundation of fal.ai http://fal.ai’s compute platform. You’ll own security below the application layer: the Linux kernel, the hypervisors and sandboxes that isolate workloads, GPU drivers and firmware, and the hosts that run them. You’ll harden the stack, strengthen isolation against untrusted code, and help make GPU compute safe at scale. Proficiency in building with and using AI is central to this role. WHAT YOU’LL DO - Secure Multi-Tenant Isolation - Build and maintain the threat model for running code on shared GPU hosts, from containers and microVM down to PCIe, IOMMU, and GPU passthrough - Design and verify GPU memory and device-state scrubbing between tenants - Help roll out hardware-backed isolation where it fits, including confidential computing and attestation Harden the Stack - Harden kernel builds and host images: config minimization, LSMs, seccomp, namespace and cgroup policy, secure and measured boot - Reduce attack surface in GPU drivers, CUDA runtimes, NVLink/NVSwitch fabrics, BMC, and firmware Assess and Research Vulnerabilities - Assess and triage security vulnerabilities in the kernel, hypervisors, GPU drivers, and firmware: judge exploitability and real impact on environment, set severity, and drive fixes or mitigations - Track vendor bulletins and upstream disclosures, and run kernel and driver patching that keeps pace without disrupting the fleet - Conduct vulnerability research on the components we depend on Shape the Program - Contribute to the host and isolation security roadmap and evaluate tooling - Partner with Detection & Response on telemetry, and act as the escalation point for host, kernel, and driver incidents - Review designs from Infra, Platform, and ML teams, and help make the secure path the default - Work with GPU vendors, cloud providers, and upstream maintainers on disclosure and fixes QUALIFICATIONS/NICE-TO-HAVES - AI fluency: you use LLMs, agents, and AI coding tools daily to review code, build tooling, and accelerate vulnerability research - 5+ years in systems or security engineering, with deep hands-on work in the Linux kernel, hypervisors, or device drivers - Fluent in kernel C, and comfortable in Rust, Go, or Python for tooling - Strong grasp of virtualization internals: KVM, VFIO, IOMMU/DMA protection, and the tradeoffs between containers, sandboxes, and microVMs - Has shipped hardening that runs in production at fleet scale - Has found, triaged, or fixed real vulnerabilities in low-level code and can explain the exploit path - Communicates risk clearly to different audiences, from kernel engineers to executives - NVIDIA GPU stack experience: open kernel modules, GSP firmware, MIG, vGPU, or GPU confidential computing - Confidential computing more broadly: AMD SEV-SNP, Intel TDX, attestation - Published CVEs, talks, or write-ups on kernel or hypervisor security - Prior work at a GPU cloud, hyperscaler, or chip vendor WHAT WE OFFER AT FAL - Interesting and challenging work - A lot of learning and growth opportunities - We offer visa sponsorship and will help you relocate to San Francisco. - Health, dental, and vision insurance (US) - Regular team events and offsites COMPENSATION - $180,000 - $250,000 + equity + comprehensive benefits package   U.S. EQUAL EMPLOYMENT OPPORTUNITY INFORMATION: fal provides equal employment opportunities to applicants and employees without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, disability, or any other classification protected by applicable law.

Location: San Francisco fal is the generative media ecosystem powering the next generation of AI products. We build the infrastructure, tools, and model access that teams need to move from idea to production, and do it at scale without compromise. For developers and enterprises, fal is the foundation that makes generative media not just possible, but practical: a unified platform where high-performance inference, orchestration, and observability come together to unlock new categories of AI-native products. As generative media reshapes industries across a market projected to grow by hundreds of billions over the next decade, fal is becoming the ecosystem that ambitious teams build on. ABOUT THIS ROLE: We’re hiring a Staff Security Engineer to set the technical direction for security across fal.ai http://fal.ai. You’ll work across our GPU compute fleet, multi-cloud and Kubernetes environments, inference APIs, and the AI systems our teams build and use. You’ll design the security architecture, build the controls yourself, and make secure-by-default the easiest path for every engineer. Proficiency in building with and using AI is central to this role. WHAT YOU’LL DO - Secure the Platform - Design isolation for multi-tenant GPU workloads, customer code, and model execution - Protect model weights, customer data, and inference endpoints with strong identity, encryption, and access controls - Harden cloud, Kubernetes, CI/CD, and the software supply chain Secure AI Systems - Threat model inference, agentic workflows, and internal AI tools, including prompt injection, data leakage, and model supply chain risks - Build guardrails for agents and AI tools, such as scoped permissions, sandboxing, and audit logging - Use LLMs and agents to automate security reviews, vulnerability triage, and remediation Set the Technical Direction - Own the security architecture and the roadmap for our highest-risk areas - Run design reviews and publish secure patterns that teams can adopt without waiting on security - Run vulnerability management from discovery through prioritization and fix - Mentor engineers and raise the security bar across the company QUALIFICATIONS/NICE-TO-HAVES - AI fluency: you use LLMs, agents, and AI coding tools daily to build, review, and automate security work - 8+ years of engineering experience, including 5+ in hands-on security engineering - Deep knowledge of cloud security (AWS/GCP), Kubernetes, Linux, and identity and access systems - Strong in Python or Rust; you write and ship production code - A record of security improvements that engineering teams adopted, led without formal authority - Explains security risk in business terms to engineers and executives alike - Experience with GPU infrastructure, ML platforms, or multi-tenant compute - Securing LLM-based systems or agent frameworks, or AI red teaming - Sandboxing and isolation technologies such as gVisor, Firecracker, or Kata - Experience supporting SOC 2 or ISO 27001 audits WHAT WE OFFER AT FAL - Interesting and challenging work - A lot of learning and growth opportunities - We offer visa sponsorship and will help you relocate to San Francisco. - Health, dental, and vision insurance (US) - Regular team events and offsites COMPENSATION - $180,000 - $250,000 + equity + comprehensive benefits package   U.S. EQUAL EMPLOYMENT OPPORTUNITY INFORMATION: fal provides equal employment opportunities to applicants and employees without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, disability, or any other classification protected by applicable law.

Location: New York; San Francisco Workplace: Hybrid ABOUT ALCHEMY Alchemy is the Web3 infrastructure and developer platform that powers millions of users and the world’s most innovative blockchain applications. From enabling $1+ trillion in financial transactions worldwide to scaling L2s and enabling DeFi, Alchemy provides the infrastructure and tools developers need to build reliable, scalable, and accessible experiences. Trusted by companies like JPMorgan, Stripe, Visa, Franklin Templeton, Nike, and backed by a16z, Coatue, Silver Lake, Lightspeed, and Stanford University, Alchemy is building the foundational layer for a decentralized and AI-enabled Web3 ecosystem. For more information, visit alchemy.com http://alchemy.com.   THE ROLE We're looking for a Security Operations Engineer to improve how Alchemy detects threats, investigates incidents, and reduces operational security risk. This is a hands-on individual-contributor role with no people-management responsibilities. You'll investigate suspicious activity and build the systems that make the next investigation faster and more reliable. AI-assisted engineering and investigation should be part of your daily work: connecting evidence, developing detections, building response workflows, and checking the results against source data. You'll also help the team get better at this work. Through shared tooling, code review, pairing, and practical documentation, you'll give teammates capabilities they can use independently.   WHAT YOU WILL DO - Detect and investigate threats. Triage alerts, hunt for suspicious activity, and investigate across cloud infrastructure, corporate systems, identity, endpoints, and production environments. Establish what happened from evidence and communicate uncertainty clearly. - Engineer detection coverage. Build and tune detections, onboard useful telemetry, and maintain reliable log pipelines. Test rules against representative attacks and benign activity; address missing coverage and noisy alerts. - Respond to incidents. Participate in the security on-call rotation and incident response, including scoping, containment, recovery, and post-incident improvements. Preserve evidence and coordinate changes with system owners. - Build AI-assisted security workflows. Automate evidence collection, alert enrichment, investigation timelines, and response preparation. Connect agents to approved tools and data sources so they can complete bounded tasks with traceable results. - Verify before trusting. Evaluate AI-assisted workflows against known cases and adversarial inputs. Require evidence for conclusions, test false-positive and missed-threat behavior, and keep human approval for disruptive containment actions. - Reduce operational exposure. Partner with Infrastructure and IT on vulnerability remediation, cloud and host hardening, identity controls, and attack-surface monitoring. Prioritize findings by exposure and impact, then verify remediation. - Help secure agent operations. Work with platform and product-security partners on operational controls for agent identities, credentials, tool access, and audit logging. Investigate misuse and build detections for suspicious agent behavior. - Improve how the team works. Share reusable code, investigation skills, runbooks, and evaluation cases. Pair with teammates, review automation, and teach approaches they can apply to their own investigations. - Measure defensive outcomes. Track detection coverage, alert quality, investigation effort, response time, and remediation progress. Use those measures to decide what to improve next.   WHAT WE ARE LOOKING FOR - Hands-on security operations experience spanning detection engineering, threat hunting, and incident response. - Strong scripting and software-building ability, especially Python; experience with APIs, version control, tests, and operating automation in production. - Experience with a SIEM such as Panther, Splunk, or an equivalent platform, including detection logic and log analysis. - Working knowledge of cloud security, identity, endpoint telemetry, networking, and Linux systems. Ability to investigate across system boundaries. - Evidence of building and using AI-assisted tools in security or adjacent engineering work. You can show how you validate outputs, handle failures, and protect sensitive information. - Sound incident judgment: you can separate a hypothesis from a finding, preserve evidence, and choose when to escalate or contain. - A record of making teammates more effective through tools, mentoring, code review, or documentation, without needing management authority. - Clear written communication and the willingness to own both urgent investigations and the follow-through that prevents repeat incidents.   HELPFUL EXPERIENCE - AWS, Kubernetes, bare-metal infrastructure, detection-as-code, or SOAR workflows. - Digital forensics, threat intelligence, or testing detections through attack simulation. - Securing AI agents and tool integrations, including prompt injection, credential misuse, and data-exfiltration risks. - Blockchain infrastructure or other environments with sensitive keys and high-impact production systems.   WHAT SUCCESS LOOKS LIKE - Investigations reach evidence-backed conclusions faster. Detection coverage improves, repeat noise declines, and remediation is verified. The team adopts tools and workflows you've built, with clear limits on what agents may do and a tested path for handling failures.   BENEFITS & PERKS 🏥 Private Health Insurance 💪 Gym Reimbursement 🚅 Commuter Benefits 🌴 Flexible Time Off 🥙 In-Office Group Meals 🧠 Learning & Development Stipend 🌎 Company Sponsored Conferences & Events 🎧 Books & Audiobook subscription with Bookster https://landing.bookster.ro/

Location: US - Headquarters - Maryland - Columbia Who is Tenable? Tenable® is the Exposure Management company. Over 40,000 organizations around the globe rely on Tenable to understand and reduce cyber risk. Our global employees support 65 percent of the Fortune 500, 50 percent of the Global 2000, and large government agencies. Come be part of our journey! What makes Tenable such a great place to work? Ask a member of our team and they’ll answer, “Our people!” We work together to build and innovate best-in-class cybersecurity solutions for our customers; all while creating a culture of belonging, respect, and excellence where we can be our best selves. When you’re part of our #OneTenable team, you can expect to partner with some of the most talented and passionate people in the industry, and have the support and resources you need to do work that truly matters. We deliver results that exceed expectations and we win together! Applicants must be authorized to work for any employer in the U.S. without sponsorship. We are unable to provide sponsorship for work visas of any kind at the time of hire, or at any point during employment. This includes, but is not limited to: F1-OPT, F1-CPT, H-1B, TN, J-1, etc Your Role: In this role, you’ll help evaluate, implement and maintain Tenable’s cybersecurity systems. You’ll work alongside Security Engineers, Analysts and the Digital Solutions Department to protect the confidentiality, integrity and availability of Tenable’s assets. Your Opportunity: Help evaluate, deploy and improve security solutions across on-premise, cloud and SaaS environments Identify opportunities to improve the resiliency and quality of security systems and applications Support maintenance of security tooling and appliances Assist in identifying and remediating threats and risks reported by Security Analysts, assessments or third parties Participate in security reviews of SaaS, on-premise, and AI-enabled products (including LLM integrations, MCP servers and agentic tools), with guidance from senior engineers Help apply baseline AI security controls: least-privilege access, no static credentials, scoped tokens, logging/auditing of agent activity, and data handling guardrails Support detection and monitoring use cases for AI and agentic workloads Document projects and write Standard Operating Procedures Build strong working relationships across the team and with partner groups Manage your time and responsibilities, set accurate expectations and meet deadlines Provide infrequent, as-needed off-hours support Other duties as assigned What You’ll Need: Working knowledge of securing Windows, Linux, mobile devices and cloud (IaaS) environments Familiarity with security architecture and review methodologies (e.g., threat modeling, STRIDE) Foundational understanding of network security (IDS/IPS, web proxies, traffic analysis) and the TCP/IP stack and common protocols (DNS, SMTP, DHCP) Familiarity with authentication and access concepts: SSH, LDAP, SSO/OAuth/OIDC, RBAC, MFA Understanding of Zero Trust and cloud security principles Hands-on experience with 2 or more of: EDR/antivirus, SIEM/log correlation, CASB, web proxies, PAM, MDM, DLP, email security/DMARC Basic understanding of AI/LLM security risks (prompt injection, data leakage, excessive agent permissions, supply chain risk) and curiosity about MCP and agentic architectures Scripting or automation ability (Python, Bash or PowerShell) is a plus BA/BS in Computer Science, IT or a related field, SANS training, or equivalent experience 3-5 years of Information Security experience; some cloud experience preferred Security+, GIAC, AWS security or similar certifications are a plus Self-motivated, with a passion for cybersecurity and a willingness to innovate Able to work effectively in an agile environment, with growing independence Hybrid/on-site at our Columbia, MD headquarters #LI-Hybrid #LI-MS1 This is the base pay range for this position. Compensation for the role will depend on a number of factors, including the candidate's qualifications, skills, competencies, location and experience, and may fall outside of the range shown. Employees are also eligible for variable compensation in addition to base pay (commission for sales roles, bonus for non-sales roles), depending on company and individual performance. Tenable also offers a variety of comprehensive and competitive benefits which include: medical, dental, vision, disability and life insurance; 401(k) retirement savings with company match; an employee stock purchase plan; an employee referral program; flexible spending accounts; an Employee Assistance Program (EAP); education assistance; parental leave; paid time off (PTO); company-paid holidays; health and wellness events; and community programs. US Pay Range $102,500 — $136,500 USD We’re committed to promoting Equal Employment Opportunity (EEO) at Tenable - through all equal employment opportunity laws and regulations at the international, federal, state and local levels.  If you need a reasonable accommodation due to a disability during the application or recruiting process, please contact Recruiting@Tenable.com for further assistance. Tenable Data Consent Statement Tenable is committed to protecting the privacy and security of your personal data. Depending on your location, one or more of the following notices may apply to you: General Applicant Privacy Notice California Applicant Privacy Notice EU/EEA/UK Applicant Privacy Notice

- Manage the end-to-end transaction dispute lifecycle, including chargebacks. - Handle disputes through card network platforms, including Mastercom and Visa Resolve Online (VROL).

Задачи: — Анализ безопасности программного обеспечения, создаваемого не техническими специалистами. — Организация процессов безопасной разработки, внедрение инструментов безопасной разработки. — Анализ безопасности стороннего ПО и автоматизация проверок. Требования: — Понимание принципов устройства прикладных/серверных web приложений, микросервисной архитектуры. — Умение читать и анализировать различную кодовую базу (Java, JS/TS, Python, C, C++, C#) на предмет уязвимостей и НДВ. — Умение обращаться с базовыми инструментами Application Security (SAST, SCA) и имплементировать в пайплайны. — Умение писать скрипты автоматизации на Bash, PowerShell, Python. — Умение пользоваться отечественными и зарубежными базами данных уязвимостей и угроз ИБ, знание наиболее распространенных уязвимостей ПО. Условия: — Удалённая работа в компании из России.

Location: Remote, United States GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of the role GitLab is seeking an experienced Principal Security GRC Manager, Legal Assurance to tackle complex customer security challenges at the intersection of technical architecture and business requirements. In this role, you'll apply deep security expertise to answer technical questions, assess contract requirements, and enable GitLab’s Sales and field organizations to address security problems for enterprise customers. You'll work directly with customers and internal teams to provide technical guidance, create security content, and help customers understand how GitLab's security controls meet their compliance and risk management needs. What you'll do: Contract & Legal Review Perform comprehensive contract reviews for both customer agreements and vendor relationships Analyze security and compliance clauses in legal documents Provide risk-based recommendations and remediation guidance for contractual security requirements Partner with Legal, Sales, Product, and Procurement teams to negotiate security-related contract terms. Manage escalations, collaborate across other teams, and develop solutions to enable team and business partners to close deals Document and track contract-related security obligations Customer Engagement & Assurance Join customer and prospect meetings to provide expert guidance on GitLab’s security practices and controls in order to address security, privacy, and compliance requirements Build and maintain templates, playbooks, fallback positions, and training that simplify and accelerate negotiations Facilitate customer assurance activities through our Customer Assurance Activities Service Desk Provide escalation support for complex security questionnaires, RFPs, and risk assessments Serve as security point of contact for enterprise customer questions, requests, and concerns Security Evangelism & Thought Leadership Act as a trusted technical thought leader, developing internal and external security content such as blog posts, whitepapers, technical standards, and field sales enablement training materials Keep abreast of the rapidly evolving regulatory landscape affecting our agreements. Identify, track, and facilitate solutions for security related customer trends and improvement areas Build and strengthen GitLab's security brand within the industry Strategic Initiatives Maintain and enhance GitLab's Trust Center and self-service security resources Provide strategic recommendations based on customer security concerns in support of revenue growth Participate in Quarterly Business Reviews to inform product and security roadmap decisions Mentor and provide guidance to Security Assurance team members Drive continuous improvement of Field Security processes and documentation Design and implement solutions to enable Sales facing teams to successfully discuss security problems and topics with customers What you'll bring: Expertise in law and regulation such as (GDPR, CCPA, DORA, EU AI Act) Deep experience in information security, with at least 5 years in customer-facing security roles Deep experience in security frameworks and standards such as (SOC 2, ISO 27001/27017/27018/42001, FedRAMP, NIST CSF, etc.) Proven track record of contract negotiation and security/privacy agreement reviews Exceptional written and verbal communication skills with ability to translate complex technical concepts for diverse audiences Experience creating security content (blogs, whitepapers, presentations) Strong understanding of cloud security, SaaS security models, and DevSecOps practices Experience working cross-functionally with Sales, Legal, Product, and Engineering teams Ability to balance security risk with business objectives Experience speaking at conferences is a plus Preferred: One or more relevant certifications such as CISSP, CISA, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, or CIPP/CIPM. Equivalent demonstrated experience is equally valued. Due to government requirements, you must be a United States Citizen (defined as any individual who is a citizen of the United States by law, birth, or naturalization) to fill this position. About the team The Security Assurance organization helps GitLab build and maintain trust by strengthening how we approach security, compliance, and risk. Security Governance sits within it and owns customer trust, security awareness, policies and standards, and other governance functions. Our counterparts are Security Compliance, Security Risk, and GRC Engineering. You will join a small team of four direct reports under the Director, where each person has broad scope and visible impact. We work remote-first and asynchronously, and we write things down and share them openly. The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our benefits and equity . Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary. United States Salary Range $203,200 — $285,000 USD How GitLab Supports Full-Time Employees Benefits to support your health, finances, and well-being Flexible Paid Time Off Team Member Resource Groups Equity Compensation & Employee Stock Purchase Plan Growth and Development Fund Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law . If you have a disability or special need that requires accommodation , please let us know during the recruiting process .

Задачи: — Анализ платежного трафика и fraud-паттернов; — Разработка antifraud-правил; — Работа с refunds и chargebacks; — Оценка эффективности правил и формирование требований для разработки. Требования: — Опыт в antifraud/risk management карточных платежей от 3 лет; — Знание online payments и жизненного цикла платежа; — Навыки SQL и анализа данных; — Опыт постановки задач разработчикам; — Английский язык — B2+. Условия: — Работа из офиса в Лимасоле, гибкое начало дня; — Компенсация обучения; — Возможна релокация.

Location: Riyadh, KSA Workplace: onsite Tabby creates financial freedom in the way people shop, earn and save by reshaping their relationship with money. Over 25 million users choose Tabby to stay in control of their spending and make the most out of their money. The company’s flagship offering allows shoppers to split their payments online and in-store with no interest or fees. Over 70,000 global brands and small businesses, including Amazon, Noon, IKEA, and SHEIN use Tabby to accelerate growth and gain loyal customers by offering easy and flexible payments online and in stores. Tabby generates over $18 billion in annual transaction volume for its partner brands and is the highest-rated, most-reviewed, largest, and fastest-growing FinTech in the GCC region. Tabby launched in 2019 and has since raised +$1 billion in equity and debt funding from global and regional investors, and is now valued at $6,5 billion. As Information Security Engineer , you’ll play a key part in monitoring and defending our infrastructure, applications, and cloud environments from cyber threats. You’ll lead incident response efforts, develop and tune detection rules, investigate security events, and collaborate with cross-functional teams to strengthen our security posture. Key Responsibilities Security Monitoring & Detection Monitor and analyze logs and alerts from a wide range of sources including firewalls, intrusion detection/prevention systems (IDS/IPS), endpoints, servers, and cloud platforms. Perform correlation of events from multiple sources to identify advanced threats and unusual patterns of behavior. Fine-tune alert thresholds and detection logic to reduce false positives and improve signal-to-noise ratio. Maintain dashboards and reporting to provide real-time visibility into security posture. Incident Response & Investigation Serve as a frontline responder for security incidents, managing incidents through their lifecycle – detection, containment, eradication, recovery, and lessons learned. Coordinate with internal stakeholders and external vendors during high-severity incidents or data breaches. Perform root cause analysis and forensic investigations using endpoint and network-based artifacts. Maintain detailed incident documentation and contribute to post-mortem analysis and reports. Threat Intelligence & Detection Rule Development Research emerging threats and trends. Contribute to the creation and tuning of detection rules, threat-hunting queries, and use cases across multiple platforms including cloud environments. Maintaining CTI Platform along with the integration of the CTI feeds with the security controls to have active CTI driven detections. Collaboration and Communication Communicate effectively with cross-functional teams including IT, DevOps, Risk, and Compliance during incidents and investigations. Provide concise and clear updates during incident handling to stakeholders and management. Mentor junior analysts and assist in training efforts within the SOC team. Skills, Knowledge and Expertise 3–4 years of experience in a SOC or cybersecurity operations role, ideally in a fast-paced fintech or enterprise environment. Strong knowledge of security best practices, including incident handling, alert triage, log analysis, and threat modeling. Understanding of online technologies, REST APIs, microservices, and modern application architectures. Experience working in a culturally diverse and collaborative environment. Familiarity with DLP, AV, and anti-malware systems from an operational monitoring perspective. Experience with phishing detection, user behavior analytics, and security awareness campaigns. Security certifications such as Security+, CySA+, eCIR, eCTHPv2, GCIA, or GMON (preferred but not required). Strong communication skills, especially for coordinating incident response and writing clear incident reports. Experience with SIEM platforms , SOAR tools , EDR/XDR , and Threat Intelligence platforms . Familiarity with cloud environments and cloud-native logging and monitoring tools. Scripting experience (e.g., Python ) to automate tasks and improve SOC efficiency.

Анализ безопасности программного обеспечения, создаваемого не техническими специалистами. - Гражданство и локация РФ.

Location: Самара Workplace: В офисе О компании RED Security – открытая экосистема ИБ-решений и экспертизы для комплексной защиты бизнеса. RED Security SOC – центр мониторинга и реагирования на кибератаки. Обязанности расследовать нетиповые инциденты ИБ с различных источников; взаимодействовать с заказчиками по техническим вопросам; анализировать полноту и качество анализа инцидентов; проводить обучение и делиться опытом с другими аналитиками. Требования понимание векторов атак на корпоративные сети и способы противодействия; знание современных методов классификации тактик и техник атакующих (Mitre Attack, Kill Chain); опыт в расследовании инцидентов ИБ; умение анализировать журналы регистрации событий в различных системах (ОС, СЗИ, сетевое оборудование, прикладное ПО, access логи и др). Условия сменный режим работы в офисе г. Самара; собственную платформу MTS Ocean для получения ИТ-ресурсов, а это значит, что деплой, мониторинг, observability — не будут для тебя проблемой, ты сможешь сосредоточиться на фичах; профессиональные гильдии инженеров, где мы поддерживаем друг друга и помогаем стать лучше; внутреннюю площадку TechTalks для обмена опытом, дискуссий, развития навыков самопрезентации; участие во внешних IT конференциях. Наши эксперты выступают на ведущих профильных конференциях, таких как HighLoad++, DevOps Conf, Joker, AHA!, Матемаркетинг и другие. А еще мы организуем собственную масштабную конференцию True Tech Day и регулярно проводим митапы для разработчиков и инженеров. полезные курсы и вебинары в корпоративном университете и электронную библиотеку; ДМС с первого месяца работы, включая стоматологию; страхование от несчастных случаев с 1 месяца работы. Материальную помощь в сложных жизненных ситуациях; отпуск 28 календарных дней (+3 дополнительных дня за ненормированный рабочий день); прием врачей общей практики и массаж в офисе; мобильная связь за счет компании и льготные тарифы для близких; подписка на онлайн-кинотеатр KION, сервис МТС Музыка, книжный сервис Строки от МТС, безлимитные мессенджеры и соцсети.

Ищем специалиста на стык платежей, AppSec и антифрода для аудита PSP, закрытия внутренних утечек (доступы, Confluence) и расследования фрод-инцидентов.

Задачи: — Ручное тестирование веб-приложений на наличие уязвимостей (Black box, Grey box) — Поиск и эксплуатация SQLi, LFI/RFI, SSRF, SSTI, Command Injection и других классических веб-уязвимостей — Работа с Burp Suite: перехват и модификация запросов, Intruder, Repeater, расширения — Обход WAF: ручной тамперинг, подбор и написание tamper-скриптов — Работа с автоматизированными инструментами: sqlmap, ghauri — с пониманием того, что происходит под капотом — Написание понятных отчётов с PoC, оценкой критичности и рекомендациями по устранению Требования: — Уверенное понимание веб-уязвимостей: SQL Injection (включая blind boolean/time-based), LFI/RFI, SSRF, SSTI, CMDi — как возникают и как ищутся на практике — Знание специфики основных СУБД: MySQL, PostgreSQL, MSSQL — Опыт работы с Burp Suite (Intercept, Repeater, Intruder, расширения) — Базовые навыки Linux: навигация, права, процессы, сеть — Понимание принципов работы sqlmap и ghauri — Базовый опыт с шеллами и реверс-шеллами Будет плюсом: — Прохождение PortSwigger Web Security Academy — Активность на HackTheBox / TryHackMe — Опыт написания tamper-скриптов или расширений для Burp — Понимание работы WAF и механизмов их обхода Условия: — Офис рядом с м. Новочеркасская — Обеды за счёт компании — Зарплата без потолка — обсуждаем под ваш реальный уровень — Молодой и дружный коллектив — Работа с реальными коммерческими проектами Как откликнуться: — Напишите в Telegram: @danilov_danil03 — Расскажите коротко о себе: над чем работали, что проходили — Приложите GitHub, writeup'ы, статьи или разборы ВПО — всё это будет плюсом.

Location: Москва В Центре Робототехники Сбера мы занимаемся созданием универсального воплощенного ИИ для роботов, который способен управлять разнообразными физическими воплощениями. Кроме этого, одним из ключевых направлений нашей работы является разработка антропоморфного робота общего назначения, не безызвестного Грина. Обязанности 1. разработка, внедрение и сопровождение автоматизированных механизмов обеспечения безопасности программного обеспечения на этапах разработки, сборки и поставки. 2. интеграция и сопровождение инструментов анализа безопасности исходного кода, программных зависимостей, контейнерных образов и секретов в процессах CI/CD 3. разработка и реализация мер защиты цепочки поставки программного обеспечения (Software Supply Chain Security), включая контроль зависимостей, SBOM, происхождения и целостности программных артефактов 4. анализ безопасности конфигураций, контейнеризированных приложений и процессов развёртывания, формирование технических требований безопасности к инфраструктуре разработки и поставки ПО 5. разработка и сопровождение технических механизмов Security Quality Gates, автоматизация сбора и обработки результатов проверок безопасности 6. участие в анализе результатов автоматизированных проверок, техническом триаже уязвимостей и других смежных задачах Application Security 7. Разработка вспомогательных инструментов и интеграций, консультирование команд разработки по вопросам безопасности CI/CD и подготовка технической документации. Требования 1. практический опыт работы в DevSecOps, DevOps, Security Engineering или автоматизации процессов обеспечения безопасности программного обеспечения 2. опыт разработки и сопровождения CI/CD-процессов, предпочтительно с использованием GitLab CI/CD, понимание принципов безопасной организации процессов сборки и поставки ПО 3. знание Linux, Docker, Kubernetes, понимание архитектуры контейнерных приложений, механизмов разграничения доступа, сетевого взаимодействия и управления секретами 4. понимание принципов Infrastructure as Code, GitOps и облачных технологий, опыт работы или анализа конфигураций Terraform, Argo CD и облачных платформ 5. опыт интеграции и сопровождения инструментов анализа безопасности в CI/CD, понимание принципов SAST, SCA, Secret Scanning, Container Scanning и IaC Scanning 6. знание основных принципов Software Supply Chain Security, управления зависимостями, формирования SBOM и обеспечения целостности программных артефактов 7. Навыки программирования и автоматизации (Python, Bash или аналогичные), понимание основных классов уязвимостей приложений и способность участвовать в анализе результатов проверок безопасности. Условия * офисный/гибридный формат в Москве (Автозаводская 23а к2) * ежегодный пересмотр зарплаты и годовая премия * расширенный ДМС и льготное страхование для семьи * уникальная система обучения Сбера для профессионального и карьерного развития * выгодная ипотека для сотрудников * подписка Прайм с возможностью совместного использования на трёх близких * вознаграждение за рекомендацию друзей в команду Сбера * корпоративная пенсионная программа.

Location: Москва В Центре Робототехники Сбера мы занимаемся созданием универсального воплощенного ИИ для роботов, который способен управлять разнообразными физическими воплощениями. Кроме этого, одним из ключевых направлений нашей работы является разработка антропоморфного робота общего назначения, не безызвестного Грина. Обязанности 1. проведение анализа защищённости программных продуктов, включая анализ исходного кода (Security Code Review), результатов SAST, SCA и других автоматизированных проверок безопасности 2. проведение технического триажа уязвимостей, подтверждение возможности эксплуатации, оценка критичности и подготовка рекомендаций по устранению 3. сопровождение процесса управления уязвимостями приложений (Vulnerability Management), включая регистрацию, приоритизацию, контроль устранения и повторные проверки 4. проведение практических проверок безопасности веб-приложений, API, механизмов аутентификации, авторизации и бизнес-логики приложений 5. взаимодействие с командами разработки, консультирование по вопросам безопасной реализации программного обеспечения и устранения выявленных уязвимостей 6. разработка вспомогательных скриптов, автоматизация типовых проверок безопасности и участие в совершенствовании процессов безопасной разработки 7. участие в смежных задачах Application Security, подготовке технической документации, рекомендаций и материалов для разработчиков. Требования 1. практический опыт работы в Application Security, анализе защищённости приложений или тестировании на проникновение 2. хорошее понимание распространённых классов уязвимостей программного обеспечения, способов их выявления и эксплуатации (OWASP Top 10, OWASP API Security Top 10, CWE) 3. навыки чтения и анализа исходного кода на JavaScript/TypeScript (в том числе Node.js), Python и Go для выявления потенциальных уязвимостей 4. опыт работы с инструментами SAST, SCA и динамического тестирования приложений, понимание принципов их работы и методов анализа результатов 5. практические навыки проверки безопасности веб-приложений и API, включая механизмы аутентификации, авторизации и обработки пользовательского ввода 6. понимание процессов разработки ПО, принципов SSDLC, опыт работы с Git, продвинутые знания Linux, контейнеризации и CI/CD 7. базовые навыки программирования и написания скриптов для автоматизации задач, умение анализировать технические проблемы и взаимодействовать с командами разработки. Условия * офисный/гибридный формат в Москве (Автозаводская 23а к2) * ежегодный пересмотр зарплаты и годовая премия * расширенный ДМС и льготное страхование для семьи * уникальная система обучения Сбера для профессионального и карьерного развития * выгодная ипотека для сотрудников * подписка Прайм с возможностью совместного использования на трёх близких * вознаграждение за рекомендацию друзей в команду Сбера * корпоративная пенсионная программа.

Location: Remote What you’ll be part of Garner is on a mission to transform the U.S. healthcare system — and we’re the only proven player doing exactly that. We partner with employers to redesign how healthcare works: applying 550+ proprietary clinical metrics across 80+ specialties to a dataset of 320M+ patients to identify the best-performing doctors, then using compelling incentives to steer members to the care that helps them get healthier, faster. The result is a rare “win win” — better care and lower costs for both members and employers. In just five years, our work has helped over 2.5 million people access higher-quality care and saved $1B in healthcare costs. We recently raised our Series E and have doubled five years running. If you've ever wanted your work to solve a problem that touches every person in this country, this is the opportunity to do exactly that. You'd be joining a team fundamentally reimagining healthcare in the U.S. — and using AI to scale that impact further and faster than anyone else can. About the role: We are looking for a Senior GRC Analyst to join our Technical Compliance team and own the recurring risk, vendor, findings, and governance work that keeps Garner’s security program operating well between audits. You will run our risk risk register, manage third party risk, drive security findings to resolution, deliver security training and run the operating cadence of our security governance program. You will partner with all departments across the company so that risks are identified early, decisions are made deliberately, and remediation actually gets done. Our Technology Compliance team safeguards Garner’s sensitive healthcare data and protects the trust of our members, clients, and partners by maintaining a strong control environment and regulatory compliance. The work you do here has a direct impact on our ability to win and retain enterprise customers, expand into new lines of business, and scale securely as we grow. Where you will work: This role is open to remote candidates across the U.S. For candidates based in New York City, the position follows a hybrid schedule with in-office work required Tuesday, Wednesday, and Thursday each week. What you will do: Own Garner’s annual information security risk assessment and risk register, driving risk identification, scoring, treatment, and reporting Manage risk exceptions and prepare risk acceptances for leadership decision Run third party and vendor risk reviews from intake through approval and periodic reassessment Own security findings from vulnerability scanning, penetration tests, audits, client assessments, and incidents, tracking remediation with Engineering, enforcing SLAs, and escalating findings that warrant a risk decision Run our security and compliance training program, including annual security awareness and HIPAA training, onboarding, content refreshes, and completion tracking Manage the maintenance of our compliance policies, standards, and procedures Report on our compliance posture to senior leadership Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest What you will bring to the team: 5+ years of experience in GRC, IT risk management, third party risk management, or information security compliance Experience running information security risk assessments and maintaining a risk register using established methodologies such as NIST CSF or ISO 27005 Hands on experience with vendor risk management and with vulnerability or findings remediation programs in a cloud native engineering environment Working knowledge of HIPAA and of SOC 2, ISO 27001, and HITRUST requirements A track record of driving accountability across teams you don’t manage, and the ability to adapt your communication style across engineers, operators, and executives A GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks A desire to be a part of a high-performing, mission-driven team that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred Technologies we use: AWS, Okta, Wiz, Retool, Gitlab, Vanta, Claude Please note: we are unable to sponsor or take over sponsorship of an employment visa at this time. Compensation Transparency: The target salary range for this position is $155,000-185,000. Individual compensation for this role will depend on various factors, including qualifications, skills, and applicable laws. In addition to base compensation, this role is eligible to participate in our equity incentive and competitive benefits plans, including but not limited to: flexible PTO, Medical/Dental/Vision plan options, 401(k) with company match, flexible spending accounts, Teladoc Health and more. Fraud and Security Notice: Please be aware of recent job scam attempts. Our recruiters use getgarner.com and garnerhealth.com email domains exclusively. If you have been contacted by someone claiming to be a Garner recruiter or a hiring manager from a different domain about a potential job, please report it to law enforcement here and to candidateprotection@garnerhealth.com . Equal Employment Opportunity: Garner Health is proud to be an Equal Employment Opportunity employer and values diversity in the workplace. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. Garner Health is committed to providing accommodations for qualified individuals with disabilities in our recruiting process. If you need assistance or an accommodation due to a disability, you may contact us at talent@garnerhealth.com .

Location: Warsaw, PL We bring startups and disruptive tech companies to the local market, offering engineers the opportunity to work on innovative, high-impact products. Join us and become a member of their R&D team while we take care of employment, HR support, a benefits package, and an enjoyable work environment. We are building a local Polish team for a customer who is a US-based B2B technology company. ‍ They develop an AI-powered skills assessment and workforce development platform. It helps enterprises assess employees’ and candidates’ capabilities, identify skill gaps, and guide development across areas such as AI, data, and technology. Companies use these insights to support hiring, upskilling, and workforce planning. We are looking for a Security Operations Specialist to take ownership of information security operations and collaborate closely with the engineering team to ensure robust security practices are in place. ‍ Please note: ‍ 📌 This is a 6-month project role, with a potential possibility of extention. 📌 The role requires working closely with the US team, with working hours overlapping until 10:00 PM Warsaw time. ‍ Own vulnerability management across cloud infrastructure, applications, APIs, dependencies, containers, secrets, and infrastructure-as-code where applicable; Coordinate penetration testing engagements and drive the remediation of identified findings; Maintain security documentation, metrics, remediation records, and technical response playbooks; Review and improve security processes and controls across the entire engineering organization; Support cross-functional security initiatives, technical readiness efforts, and transitions involving systems, tooling, and controls; Maintain cloud security standards and align processes with security frameworks such as SOC 2 and NIST; Partner with technical teams on security monitoring, logging, identity and access, secure configuration, incident response, and technical risk reduction. Proven experience in security monitoring and vulnerability management; Experience coordinating penetration testing and following up on findings; Practical experience with Cloud Security and industry frameworks such as SOC 2 and NIST; Proactive approach with the ability to work independently, prioritize tasks, and deliver results in a lean team environment. Hands-on experience using AI tools to enhance security operations and streamline workflows. ‍ ‍ ‍ 📌 This is a 6-month project role, with a potential possibility of extention. 📌 The role requires working closely with the US team, with working hours overlapping until 10:00 PM Warsaw time. At On The Spot, we’re creating a workplace people would want to stay in: supportive, well-organized, and fair in terms of conditions and benefits. ‍ We’ll share more about our benefit package during the interviews. In the meantime, you can always check our Glassdoor reviews .