Вакансии

Location: United States; Denver; Chicago; Seattle; Austin; Atlanta; New York; Los Angeles; Boston; San Francisco Workplace: Remote We're looking for a Director of Product Management to own our security product strategy end to end -   the vision, the roadmap, build vs buy decisions. You will set the multi-year investment strategy for our security offerings, go deep with engineering on database security, networking, and identity management. You will be the subject matter expert for other PMs navigating security-adjacent decisions.. Responsibilities - Own the product vision, strategy, and multi-year roadmap for our security offerings, and make the case for it - internally with engineering and leadership, and externally with customers and the market. - Go deep on database security, networking, and identity and access management (IAM) - enough to argue the details with engineering, not just approve what they propose. - Partner closely with engineering, design, sales, and marketing to ship products that are actually secure, not just marketed that way. - Translate complex security requirements into specifications and user stories that engineering can understand. - Own backlog prioritization and the trade-offs that come with it, weighing business value, customer risk, and engineering cost. - Drive go-to-market for security launches - positioning, sales enablement, documentation. - Monitor how security features perform in the real world and use that data, not just instinct, to decide what to build next. - Be the security subject-matter expert other teams come to, and provide guidance and coaching to PMs working on security-adjacent problems elsewhere in the org. - Represent our security posture and roadmap externally - with top customers, prospects, and analysts when the conversation needs someone who actually understands the tradeoffs. Qualifications - 10+ years of product management experience in B2B SaaS, with a significant and sustained focus on security products or features, including experience setting security strategy at an organizational level. - Real, hands-on experience with database security principles and best practices. - Strong understanding of networking concepts and their security implications. - In-depth knowledge of identity and access management (IAM). - Security certifications (e.g., CISSP, CISM, CompTIA Security+) preferred. - Solid program management skills: planning, execution, and risk management across multiple concurrent workstreams. - A track record of representing product externally - with customers, analysts, or at industry events, and translating deep technical security topics for non-technical audiences. - Experience guiding or informally mentoring other PMs, even without a formal reporting relationship. - Strong communication and presentation skills, and the judgment to know when to escalate versus when to just make the call. - Comfortable in a fast-paced, collaborative environment where priorities shift and you're expected to bring order to it, not just follow along. PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: The Netherlands; United Kingdom; Spain Workplace: Hybrid We're looking for a Director of Product Management to own our security product strategy end to end -   the vision, the roadmap, build vs buy decisions. You will set the multi-year investment strategy for our security offerings, go deep with engineering on database security, networking, and identity management. You will be the subject matter expert for other PMs navigating security-adjacent decisions.. Responsibilities - Own the product vision, strategy, and multi-year roadmap for our security offerings, and make the case for it - internally with engineering and leadership, and externally with customers and the market. - Go deep on database security, networking, and identity and access management (IAM) - enough to argue the details with engineering, not just approve what they propose. - Partner closely with engineering, design, sales, and marketing to ship products that are actually secure, not just marketed that way. - Translate complex security requirements into specifications and user stories that engineering can understand. - Own backlog prioritization and the trade-offs that come with it, weighing business value, customer risk, and engineering cost. - Drive go-to-market for security launches - positioning, sales enablement, documentation. - Monitor how security features perform in the real world and use that data, not just instinct, to decide what to build next. - Be the security subject-matter expert other teams come to, and provide guidance and coaching to PMs working on security-adjacent problems elsewhere in the org. - Represent our security posture and roadmap externally - with top customers, prospects, and analysts when the conversation needs someone who actually understands the tradeoffs. Qualifications - 10+ years of product management experience in B2B SaaS, with a significant and sustained focus on security products or features, including experience setting security strategy at an organizational level. - Real, hands-on experience with database security principles and best practices. - Strong understanding of networking concepts and their security implications. - In-depth knowledge of identity and access management (IAM). - Security certifications (e.g., CISSP, CISM, CompTIA Security+) preferred. - Solid program management skills: planning, execution, and risk management across multiple concurrent workstreams. - A track record of representing product externally - with customers, analysts, or at industry events, and translating deep technical security topics for non-technical audiences. - Experience guiding or informally mentoring other PMs, even without a formal reporting relationship. - Strong communication and presentation skills, and the judgment to know when to escalate versus when to just make the call. - Comfortable in a fast-paced, collaborative environment where priorities shift and you're expected to bring order to it, not just follow along. PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: United States; Denver; Chicago; Seattle; Austin; New York; Los Angeles; San Francisco Workplace: Remote We are seeking an experienced Product Manager with a strong background in security to join our dynamic team. This role will be crucial in defining and executing the product strategy for our security offerings, ensuring our products are robust, reliable, and secure, and that they meet the evolving needs of our customers. The ideal candidate will possess a deep understanding of database security, networking, and identity management, and will be adept at navigating the complexities of product development from conception to launch. What you will do: - Define and evangelize the product vision, strategy, and roadmap for security-focused features and products. - Conduct market research, competitive analysis, and customer feedback sessions to identify opportunities and inform product decisions. - Collaborate closely with engineering, design, sales, and marketing teams to deliver high-quality, secure products. - Translate complex security requirements into clear, concise product specifications and user stories. - Prioritize product backlog and manage trade-offs to optimize for business value and customer satisfaction. - Drive product launch activities, including go-to-market strategy, sales enablement, and user documentation. - Monitor product performance, gather insights, and iterate on product features based on data and user feedback. - Act as a subject matter expert for security within the organization, providing guidance and insights to various stakeholders. About You: - Minimum of 8+ years of experience in product management in B2B SaaS, with a significant focus on security products or features. - Proven experience with database security principles and best practices. - Strong understanding of networking concepts and their implications for security. - In-depth knowledge of identity and access management (IAM) topics. - Certifications in security (e.g., CISSP, CISM, CompTIA Security+). - Demonstrated experience in quality assurance processes and methodologies. - Solid background in program management, including planning, execution, and risk management. - Prior experience in security engineering is required. - Excellent communication, interpersonal, and presentation skills. - Ability to thrive in a fast-paced, collaborative environment. Preferred Qualifications: - Prior experience securing a data platform, database product, or real-time analytics service. - Familiarity with ClickHouse or other databases such as Snowflake, BigQuery, or Redshift. - Experience supporting BYOC or private deployment models. - Background working with open source software or developer-focused products. PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: The Netherlands; United Kingdom; Spain Workplace: Remote We are seeking an experienced Product Manager with a strong background in security to join our dynamic team. This role will be crucial in defining and executing the product strategy for our security offerings, ensuring our products are robust, reliable, and secure, and that they meet the evolving needs of our customers. The ideal candidate will possess a deep understanding of database security, networking, and identity management, and will be adept at navigating the complexities of product development from conception to launch. What you will do: - Define and evangelize the product vision, strategy, and roadmap for security-focused features and products. - Conduct market research, competitive analysis, and customer feedback sessions to identify opportunities and inform product decisions. - Collaborate closely with engineering, design, sales, and marketing teams to deliver high-quality, secure products. - Translate complex security requirements into clear, concise product specifications and user stories. - Prioritize product backlog and manage trade-offs to optimize for business value and customer satisfaction. - Drive product launch activities, including go-to-market strategy, sales enablement, and user documentation. - Monitor product performance, gather insights, and iterate on product features based on data and user feedback. - Act as a subject matter expert for security within the organization, providing guidance and insights to various stakeholders. About You: - Minimum of 8+ years of experience in product management in B2B SaaS, with a significant focus on security products or features. - Proven experience with database security principles and best practices. - Strong understanding of networking concepts and their implications for security. - In-depth knowledge of identity and access management (IAM) topics. - Certifications in security (e.g., CISSP, CISM, CompTIA Security+). - Demonstrated experience in quality assurance processes and methodologies. - Solid background in program management, including planning, execution, and risk management. - Prior experience in security engineering is required. - Excellent communication, interpersonal, and presentation skills. - Ability to thrive in a fast-paced, collaborative environment. Preferred Qualifications: - Prior experience securing a data platform, database product, or real-time analytics service. - Familiarity with ClickHouse or other databases such as Snowflake, BigQuery, or Redshift. - Experience supporting BYOC or private deployment models. - Background working with open source software or developer-focused products. PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new team member who joins our company receives stock options. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Lead end-to-end design from problem framing and research through interaction design, prototyping, validation, and implementation. Design workflows for detection creation and management, alert review, investigation, triage, search pivots, threat coverage, normalization, and enrichment.

• Внедрение и развитие системы многофакторной аутентификации; • Организация харденинга ИТ-активов и контроль соответствия политикам безопасности;

- 1+ years of experience in Information Security, Security Engineering, Data Security, DLP, or a related technical role. - Experience creating and tuning security policies.

Location: San Francisco, CA | New York City, NY | Seattle, WA About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the team Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them. We're building toward a fundamentally different kind of GRC: one that directs Claude, with the right humans in the loop, to challenge and evidence the performance of controls continuously rather than through periodic audits. Within Security GRC, Compliance & Audit Programs runs the integrated audit across our frameworks and maintains the Common Control Framework, the single set of controls that the whole program is built on. This role sits in Audit & Assurance and owns the framework and the assurance view across every control domain. About the role As part of the Security Audit & Controls team,  you will own the CCF across every control domain, from access and change management to logging, encryption, and people controls: which controls we have, what each one says, how each maps to the frameworks and commitments we hold, and whether each one is actually working. You'll work with control owners and GRC Partners to draft and validate control descriptions and activities that describe reality rather than policy intent, build the monitoring that shows operating effectiveness continuously instead of once a year, and drive what monitoring finds to closure with control owners. Building with Claude is a normal part of the job: drafting and mapping controls, testing evidence, and monitoring control health, with you deciding where human judgment stays in the loop. This is an individual contributor role for someone who works well independently, writes clearly, and gets satisfaction from a control set that is accurate, tested, and trusted by auditors and engineers alike. Key responsibilities Own the Common Control Framework: the canonical control set, its mappings to SOC 2, ISO 27001/42001, HIPAA, FedRAMP, and customer commitments, and the change process for adding, retiring, or rewording controls Draft and validate control descriptions and control activities with control owners, so each control states who does what, how often, in which system, and what evidence proves it Design and run continuous monitoring of control efficacy: define the metrics and automated tests that show operating effectiveness, tune out false positives, surface failures to owners before an auditor does, and build the controls maturity model that shows where each control domain stands and what it takes to move up a level Verify remediation and carry it into steady state: GRC Partners lead remediation in their domains and control owners implement the fixes. This role advises on control design and implementation, confirms fixes against what the auditor actually asked for, and keeps one source of truth for control and finding status. Once a fix holds, it works with the partner to standardize the evidence pull and, where appropriate, automate it or build continuous Map new frameworks and commitments onto the CCF as we commit to them, and support gap assessments when a new framework, certification, product, or entity comes into scope, using the CCF as the baseline and writing the requirements for each delta Support the integrated audit and customer audits: readiness checks, walkthrough preparation, evidence request lists, and the readout of external findings back to GRC Evaluate evidence reliability, including the completeness and accuracy of system-generated reports and AI-generated evidence, and set the standard for what audit-ready evidence looks like here Build with Claude: automate control mapping, evidence testing, and monitoring, and verify machine-drafted control language before it becomes the record Minimum qualifications Several years in IT audit, security compliance, or controls assurance, including hands-on ownership of a control framework or control library across more than one framework (for example SOC 2, ISO 27001, FedRAMP, HIPAA) Working command of audit mechanics: scoping, walkthroughs, sampling, design versus operating effectiveness, deficiency evaluation, and evidence reliability Experience writing control descriptions, control activities, and test procedures that other teams and external auditors relied on Experience with continuous controls monitoring or automated evidence collection, whether you built it, ran it, or audited it Enough technical fluency to read a runbook, a configuration, or a pipeline definition and judge whether it enforces what the written control claims Clear writing, because your control language and status reports are what auditors, engineers, and leadership work from Ability to get control owners and partner teams to prioritize and close work without having authority over them Preferred qualifications Have designed or rebuilt a common controls framework and led the remapping of existing frameworks onto it Have stood up continuous controls monitoring or automated evidence programs and can speak to coverage, false-positive rates, and what changed as a result Have applied LLMs to assurance work, such as control drafting, framework mapping, evidence testing, or monitoring Have defined or assessed controls for AI systems or agents operating in production, or for home-built internal systems Have provided requirements for a homegrown GRC platform and worked with the engineers who build it You don't need to Have done everything on this list. The scarce combination this role exists for is framework ownership plus the judgment to tell whether a control actually works Write production code. The bar is fluency sufficient to read, query, and challenge Hold every certification. CISA, CISSP, or similar are welcome and not required Have prior AI-industry experience Logistics Education requirements: We require at least a Bachelor's degree in a related field or equivalent experience. Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas. However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed. Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Deadline to apply: None. Applications will be received on a rolling basis. The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $270,000 — $345,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: Remote, Canada; Remote, United States GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role GitLab's Security Risk function is responsible for reducing risk across the security division: third-party risk (TPRM), annual security risk assessments, quarterly risk reporting, and remediation of security findings. As a Senior Security Risk Engineer, you'll take ownership of risk identification, quantification, and remediation tracking across the business, and you'll be a driving force behind automating and modernizing how the team does this work using AI and scripting. Reporting to the Security Risk Manager, you will bring expertise on risk methodology, risk-based thinking, and AI-enablement. In this role, you'll partner closely with Security, Legal, IT, Product, and Engineering to translate technical findings and vendor risk into business-relevant risk statements and risk treatments. You’ll help surface emerging risks, and report top risks to leadership. Some examples of our projects: Building and maintaining a risk register that translates technical vulnerabilities, control gaps, and third-party risk findings into quantified, business-relevant risk statements. Driving cross-functional remediation of security findings and risk issues to closure, tracked against SLAs. Driving automation and AI-enabled improvements for risk and GRC workflows so the team can spend less time on manual work and more time on high-value risk analysis and program maturity. What you'll do Own risk identification, analysis, and prioritization across third-party risk (TPRM), security risk assessments, and security findings, using an established risk framework (e.g., NIST RMF, ISO 31000, or NIST 800-39). Translate technical vulnerabilities, control gaps, and risk findings into clear, quantified risk statements that non-security stakeholders and leadership can act on. Drive remediation of findings and risk exceptions to closure, partnering with Engineering, IT, Product, and Legal, and escalating stalled or high-severity items. Mature and maintain a risk register and quarterly reporting cadence that gives leadership clear visibility into open risk, remediation progress, and trends. Own and mature AI risk management, including AI impact assessments, AI risk assessments, and risk treatments, to support ISO 42001 certification. Design, develop, and implement key risk indicators and supporting metrics for top risks in the risk register. Identify manual, repetitive steps in risk and TPRM workflows and personally build the automation, scripting, or AI-enabled tooling to remove them. Contribute to the roadmap for the risk program, incorporating new frameworks, regulatory changes, and lessons learned from past assessments. Monitor the internal and external risk landscape (new frameworks, threat trends, business changes) to identify and escalate emerging risks before they become findings. What you'll bring 5+ years of experience in security risk management, working with security-centric risk management or compliance frameworks (e.g., NIST RMF, NIST 800-39, ISO 31000). Familiarity with AI governance frameworks (e.g., ISO 42001, NIST AI RMF) is a plus. Experience designing and executing qualitative and quantitative risk analyses that translate technical risks into measurable business impact. A track record of driving risk assessments, risk registers, and remediation efforts to closure across IT, Procurement, Internal Audit, Legal, Product, and Engineering, in a heavily regulated or multi-entity environment. Experience interpreting technical control requirements and translating them for both technical and non-technical stakeholders. Demonstrated bias toward automation: you've personally built scripts, workflows, or AI-enabled tooling that reduced manual risk or GRC work, not just evaluated tools conceptually. Comfort operating with ambiguity, managing multiple concurrent assessments, and reprioritizing under tight deadlines. Exceptional written and verbal communication skills with demonstrated ability to translate security risks into business risks. Strong understanding of cloud security, SaaS security models, and DevSecOps practices. Relevant certifications (e.g., CISSP, CISM, CISA, CRISC) are preferred but not required. About the team The Security Assurance organization helps GitLab build and maintain trust by strengthening how we approach security, compliance, and risk across the company. The Security Risk team sits within that group and owns third-party risk (TPRM), security risk assessments, and remediation of security findings. The Security Risk Team performs thorough, collaborative, and efficient risk assessments as well as drive risk reduction so that GitLab can achieve its goals while maintaining a high level of security. Security Risk counterparts are Security Compliance, Security Governance and Security Enablement functions. The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our benefits and equity . Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary. United States Salary Range $139,200 — $189,000 USD How GitLab Supports Full-Time Employees Benefits to support your health, finances, and well-being Flexible Paid Time Off Team Member Resource Groups Equity Compensation & Employee Stock Purchase Plan Growth and Development Fund Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law . If you have a disability or special need that requires accommodation , please let us know during the recruiting process .

Location: Remote-Friendly (Travel Required) | San Francisco, CA About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Data Center Security Engineering (DCSE) secures Anthropic's data center footprint; this role covers how the sites are designed and built to be secure. Much of that footprint is designed and built with partners, so a site's security is decided early: in what Anthropic hands the people who build it, and in how rigorously the delivered systems are tested against it. You'll design and specify the physical security systems for a site: perimeter and vehicle barriers, intrusion detection, video, security lighting, and the site penetrations and utility entry points that bypass them. Design firms and integrators produce the site drawings and install; you specify, review, and verify. You'll write the performance requirement and verification method behind each control, review every site design against them at each stage with redlines a design team can act on, test in the field that what was built performs as specified, and re-verify post-acceptance changes. This is a foundational role. You'll own Anthropic's physical security reference design package (typical details, reference drawings, schedules, and test procedures) in the form partners build from, and keep it current against each site's threat basis and the sites actually being built. You'll set the technical position for a site and decide what applies where; where a requirement can't be met as written, you'll engineer the compensating control and document the deviation. You'll work with the rest of DCSE, with Anthropic's design, construction, and real estate counterparts, and directly with the vendors who build to the package. We use Claude throughout our engineering workflow and expect you to as well. The same seat covers the team's security operations control rooms. You'll set their design and operational requirements and accept delivered systems against them, working day to day alongside the team's platform engineers, who own the software and compute that run in them. This role involves regular travel to data center sites. These are critical services, and this role participates in an on-call rotation for them. Key responsibilities Produce a vendor-ready design package for perimeter barriers and hostile vehicle mitigation, intrusion detection and its zoning, video coverage, security lighting matched to camera performance, and penetration protection: performance specifications, typical details and reference drawings, and device and zone schedules, written so a design firm can build to them and a test can prove them Define the per-site engineering basis: which requirements apply to a site based on its risk profile and the threats it faces, with compensating controls and documented deviations Write the acceptance criteria and test methods: the verification method behind each requirement and the evidence a site must produce to pass acceptance Set standoff, structural hardening, and site layout criteria for new designs, tied to the threat basis they derive from Run field verification: commissioning and acceptance testing of perimeter, detection, video, and lighting against performance criteria (detection coverage tests, photometric measurements, video quality checks) Write the operational and design requirements for security operations control rooms: console layout, wall versus workstation content, supervisor placement; room network, power, backup, and resilient communications to the team's segmentation and hardening baseline Own control room acceptance: factory and site acceptance criteria written before the build, then accept or reject delivered systems (video wall, consoles, cabling, fit-out) against them Minimum qualifications Have designed or specified physical security systems (perimeter barriers, intrusion detection, video, security lighting) for campus-scale sites: multiple buildings, a secured perimeter, many detection zones Read and produce construction documents (site plans, civil and electrical drawings, device schedules, submittals) using standard design and markup tools such as AutoCAD, Revit, or Bluebeam, and find what is missing as readily as what is wrong Write performance requirements that are testable: each states what must be true, how it will be verified, and what evidence shows it Have run commissioning and acceptance tests against performance criteria and rejected work that did not meet them Derive requirements from a threat basis rather than a product catalog: you can say which adversary a control stops and where the next weakest point is Have owned an engineering domain where you set the approach, chose what applied to each site, worked directly with vendors, and answered for the result Preferred qualifications Experience carrying a physical security design from construction documents through construction to acceptance testing Experience engineering the security scope of colocation or partner-delivered facilities Working knowledge of published standards for standoff, hostile vehicle mitigation, and intrusion detection zoning Photometric and video quality measurement experience Control room, AV, or network design experience: console layouts, video wall systems, resilient communications Experience using AI-assisted tooling for drafting and review as a core part of your workflow The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 — $405,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: San Francisco, CA | New York City, NY | Seattle, WA About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Data Center Security Engineering (DCSE) owns physical security across Anthropic's data center footprint: the sites, the hardware inside them, and the supply chain that delivers it. The Security Fusion Platform is where physical security signals from across that footprint are correlated and put in front of the analysts who act on them. It carries continuous monitoring, audit evidence, metrics, and analyst response, along with the classification and analytics pipelines that turn sensor data into events. You'll build and own the platform analysts work from. This is a foundational role. You'll build the software platform that carries a signal from source to analyst decision, ship its first versions, and keep them running in production. The sensors and systems at each site belong to other DCSE engineers; you define the event contract their owners deliver to, and you build the classification and analytics pipelines that run over what those sources produce. Physical security systems engineers own the operations spaces; you own the software that runs in them. You'll work alongside engineers focused on the sites themselves. What you lead, you own end to end: the design, the technical approach, and the result in production. You'll work with external vendors and integrators, setting requirements and acceptance criteria for what you own and deciding what the team builds itself. We use Claude throughout our engineering workflow and expect you to as well. This role involves regular travel to data center sites. No security clearance is required. These are critical services, and you'll take part in on-call for them. Key responsibilities Design and build the event bus and normalized event schema: source identity, sequencing, health state, and the adapter contract that owners of each sensor and system feed build to, plus adapters where needed Build correlation and alerting: the rules and services that turn events from independent sources into alerts an analyst can act on Build the classification and analytics pipelines: computer vision and multi-sensor fusion, with results landing on the event bus Build analyst surfaces: the queue, escalation tooling, dashboards, camera viewers, and video wall content a 24/7 watch works from, plus video analytics integration so camera streams arrive on the bus as events Deliver audit evidence: durable, tamper-evident event history, evidence exports, and the retention and access controls around them Instrument metrics and self-monitoring: detection rates, nuisance ratios, alert aging, time to resolve; heartbeats and loss-of-telemetry alarms on every feed, tested fail-secure behavior, and change audit on every rule Deploy across sites: site-local components, central services, and the sync that keeps configuration, rules, and state consistent, then commission each site and hand over to the analysts Specify the compute the platform runs on (servers, storage, and the platform's network segment) to the team's segmentation and hardening baseline Write requirements and acceptance criteria for what vendors and integrators deliver, review deliverables against them, and make the call on accepting or rejecting the work Minimum qualifications Have built and run event-driven backend systems in production Are proficient in at least one backend language such as Python, Go, or Rust, and have worked with a message bus or event streaming system such as Kafka Have owned a system end to end: set the design, made the tradeoffs, shipped it, and answered for it in production Have integrated with external systems you did not control (vendor APIs, on-prem appliances, video platforms, building systems) and designed for a life beyond any one vendor Have directed vendor or integrator work: written requirements and acceptance criteria, reviewed deliverables against them, and decided what gets accepted Design for the failure you won't see coming (a silent feed, a lost network path, a replayed event, a de-tuned rule), know how your system behaves when a source lies or goes quiet, and test for it Build tools for people who use them under pressure and iterate with those operators Preferred qualifications Experience building or operating a security operations platform (SOC, physical security operations, or the detection engineering behind one) Experience building ML or computer vision inference pipelines over video and sensor streams PSIM (physical security information management) or VMS (video management system) integration experience, or familiarity with physical access control and building systems data Experience producing evidence for auditors or assessors: log integrity, retention, chain of custody Experience using AI-assisted development tooling as a core part of your workflow The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 — $405,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus Workplace: hybrid Capital.com's Product Security team protects our web and mobile applications, infrastructure, and external perimeter in a highly regulated environment. As Senior/Staff Application Security Engineer, you will raise the bar for application security across the organisation. This role is measured by leverage: how well you design, automate, and scale security processes so that many engineering teams can build securely by default. You will lead security architecture reviews and threat modelling, increasingly with the help of AI tooling, and turn one-off security work into repeatable, self-service capabilities. The role combines deep hands-on offensive and defensive security expertise with the engineering mindset needed to automate at scale. You will work closely with development, QA, DevOps, and platform teams. Responsibilities: Security Architecture & Threat Modelling: Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure Security Automation & Tooling: Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely Security Testing & Vulnerability Management: Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible Participate in and help lead red teaming and offensive security exercises Enablement: Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams Requirements: Experience: 5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort Technical: Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so Collaboration: Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture Nice to have: Experience securing the AI harness: hardening LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints against prompt injection, data leakage, and insecure agent actions Experience securing Kubernetes, including cluster hardening, RBAC, network policies, admission control, workload isolation, and image and supply-chain security Experience securing AWS infrastructure, including IAM, network and account architecture, key and secret management, and CSPM Experience building AI-assisted security tooling or internal self-service security platforms Experience mentoring or technically leading a security team Offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE What you'll get in return: You will join the company, that cares about work and life balance Annual Bonus based on the performance review cycle Generous Annual Leave Policy Medical Insurance and Pension fund, with additional benefit packages based on the location Hybrid working model (3 days from our modern office and 2 days fully remotely) Comprehensive Workation Policy with 30 more remote days available. Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.

Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus Workplace: hybrid Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and the backend services behind them, all in a highly regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products. You will set the direction for how we secure software at scale: you will own secure-by-design patterns and standards, lead threat modelling and architecture reviews, and define the application security baseline that engineering teams build against. Working closely with the Product Security team and the Director of Product Security, you will guide AppSec processes and set the vision for your area without direct line management. You will treat security as a shared outcome rather than a gate, balancing strong protection with developer experience and delivery speed, and you will earn adoption through enablement rather than mandates. Responsibilities: Security Architecture & Standards: Define and maintain secure-by-default reference architectures for common patterns: web apps, mobile backends, microservices, public and partner APIs, and event-driven services Own core application security architecture decisions: authentication and authorisation, session management, API security, secrets management, multi-tenant isolation, and security logging and auditing Lead the redesign of user authentication and the delivery of security features into the product Develop and roll out application security standards, secure-coding guidelines, configuration standards, reusable design patterns, and architecture decision records (ADRs) that engineers can apply without a security expert in the room Define internal policies for the safe use of AI-assisted and vibe-coding tools Define security requirements for acquired technology and guide its secure integration Threat Modelling & Design Review: Establish and run a threat-modelling operating model, covering scope, cadence, templates, and facilitation, proportionate to each product's risk tier Own the security review stage of the new product approval process, covering architecture design and configuration Lead design reviews for high-impact initiatives: new products, new auth flows, payment and sensitive-data flows, platform migrations, and major refactors Identify design-level risks and agree practical, prioritised mitigations with engineering teams Secure SDLC, DevSecOps & Supply Chain: Assess the current state of application security, propose improvements, and drive the secure SDLC strategy with Engineering and Security leadership Oversee AppSec processes and own the tooling strategy (SAST, DAST, IAST, SCA, and secrets scanning), including how findings flow back to engineering Embed security controls as guardrails in CI/CD through policy-as-code, with agreed enforcement and escalation paths Partner with DevOps to organise repository management and prevent supply-chain attacks, covering safe component usage, dependency management, SBOMs, and build integrity Improve the security of our internal tools Requirements: Experience: 8+ years in technology, including 5+ years in a dedicated application or product security role, with a strong engineering background and hands-on architecture or design ownership Proven track record creating, documenting, and rolling out security standards, patterns, and best practices across a complex engineering organisation Deep, demonstrable threat-modelling experience across product portfolios Technical: Experience designing and implementing a secure SDLC in a cloud-native environment. Strong AWS knowledge is required, and exposure to GCP or other clouds is welcome Strong command of OWASP standards (Top 10, ASVS) and DevSecOps practice, including AppSec tooling (SAST, DAST, IAST, SCA, secrets scanning) and vulnerability management Deep understanding of modern distributed architectures: microservices, REST and GraphQL APIs, event-driven systems, OAuth2/OIDC, and containerised workloads (Docker, Kubernetes). You should be able to reason about their trust boundaries, attack surface, and data flows across web and mobile clients Collaboration: Exceptional ability to influence and align engineering teams without direct authority, and to brief both engineers and executives Pragmatism and strategic thinking: you balance the ideal with the achievable, protect delivery throughput, and turn long-term direction into an actionable plan Clear written communication through diagrams, ADRs, and patterns, plus a track record of mentoring and cross-functional collaboration Nice to have: Experience in fintech, trading, brokerage, or another regulated environment Awareness of relevant regulatory and compliance drivers: FCA and CySEC operational resilience, GDPR, and PCI DSS Software supply-chain security, including SBOMs and artifact and build integrity Experience securing AI-integrated product features, or using AI to scale an AppSec programme Experience building or running a Security Champions programme CSSLP, GIAC GDSA, or a hands-on offensive security certification. Certifications are valued but secondary to demonstrated experience What you'll get in return: You will join the company, that cares about work and life balance Annual Bonus based on the performance review cycle Generous Annual Leave Policy Medical Insurance and Pension fund, with additional benefit packages based on the location Hybrid working model (3 days from our modern office and 2 days fully remotely) Comprehensive Workation Policy with 30 more remote days available. Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.

• Проектировать и разрабатывать AI-агентов; • Разрабатывать и оптимизировать промпты, учить агентов взаимодействовать с продуктами компании;

Join an engineering team designing and implementing full-stack, user-facing security solutions that protect hundreds of millions of Discord users. Lead full-stack work to strengthen session security and authentication for Discord’s users.

Бэкенд на Go — микросервисы, аутентификация, API-ключи, сборщики данных — и исследования: почему резолвер ответил так, где протекает прокси, что видно по DNS-запросам. Про многое из этого в интернете не написано — придётся ставить стенд и смотреть.

Location: Remote; San Francisco; New York Workplace: Remote Patreon is a media and community platform where over 300,000 creators give their biggest fans access to exclusive work and experiences. We offer creators a variety of ways to engage with their fans and build a lasting business including: paid memberships, free memberships, community chats, live video, and selling to fans directly with one-time purchases. Ultimately our goal is simple: fund the creative class. And we're leaders in that space, with: - $10 billion+ generated by creators since Patreon's inception - 100 million+ free memberships for fans who may not be ready to pay just yet, and - 25 million+ paid memberships on Patreon today. We're continuing to invest heavily in building the best creator platform with the best team in the creator economy and are looking for a Security Engineer to support our mission. This role is Fully Remote (US only), or can be based in New York or San Francisco (where it is open to those who are able to be in-office 3 days per week on a hybrid work model.) About the Team Patreon’s security team works to protect Patreon creators and their fans. The team deals with all facets of Patreon’s security, including application security, infrastructure security, and internal/corporate security. We’re a small but effective team. We write code to solve security problems and work closely with our partners across the engineering organization. We also understand the importance of balancing security risks against business needs. We strive for honest and effective communication and focus on pragmatically reducing risk over checking boxes. The security team is part of Patreon’s Risk Engineering org, which also includes our Safety Engineering and Identity and Access teams. Collectively, the risk org tackles a range of problems including content moderation, internal tooling, identity verification, access control, and account security. About the Role In this role, you’ll be a member of our Security team. You’ll split your time between contributing to security projects and responding to security investigations, vulnerabilities, or questions. The work spans application security, infrastructure security, and internal/corporate security. It includes both proactive and reactive security work. You’ll be part of an on-call rotation and help respond to security incidents and investigations. You’ll write code – both to support security work and to improve the security of the Patreon platform. You’ll work closely with other members of the security team, the wider Risk engineering org, and cross functional partners in engineering, legal, and IT. Your work will help reduce known risks and will protect the security, privacy, and trust of Patreon creators and their fans. What you’ll need: - You have two or more years of experience reducing security risks in the application, infrastructure, or corporate security spaces. You can create a threat model and to explain why a given risk matters and what we might do to reduce it. - You have deeper knowledge (three or more years) in at least one security or security-adjacent domain (infrastructure security, application security, cloud security, corporate/IT security, cryptography, privacy, etc.) - You can develop software (Python, Rust, Golang, or a similar language). You have experience working in a modern software development environment (git, CI/CD, LLM coding tools, etc.) - You have experience using AI tools (LLMs, ML models, etc) to identify and address security issues (software vulnerabilities, detection and response, etc.) - You’re energized by fast iteration: shipping MVPs, testing hypotheses, and evolving products based on what creators and fans respond to. - You take pride in creating elegant solutions to messy, real-world problems and balancing pragmatic trade-offs between security risks and business needs. - You believe in Patreon’s mission: giving creators control over their work and building communities that feel good to be in. - Bachelor’s or Master’s degree in Computer Science, Computer Engineering, or a related field, or the equivalent Bonus if you have: - Experience working on large scale Internet platforms that allow users to upload content. - Past contributions to large scale, production code bases. - Experience responding to security incidents, investigating incident impact, and building out incident mitigations. We hire talented and passionate people from different backgrounds because workplace diversity and inclusion is critical to our ability to serve creators worldwide. If you’re excited about a role but your past experience doesn’t match with every bullet point outlined above, we strongly encourage you to apply anyway. If you’re a creator at heart, are energized by our mission, and share our company values, we’d love to hear from you. About Patreon Patreon powers creators to do what they love and get paid by the people who love what they do. Our team is passionate about making this mission and our core values come to life every day in our work. Through this work, our Patronauts: - Put Creators First | They’re the reason we’re here. When creators win, we win. - Build with Craft | We sign our name to every deliverable, just like the creators we serve. - Make it Happen | We don’t quit. We learn and deliver. - Win Together | We grow as individuals. We win as a team. Patreon is proud to be an equal opportunity employer. We provide employment opportunities without regard to age, race, color, ancestry, national origin, religion, disability, sex, gender identity or expression, sexual orientation, veteran status, or any other protected class. If you need a reasonable accommodation during the interview process, please let us know via email at accommodations@patreon. Patreon offers a competitive benefits package including and not limited to salary, equity plans, healthcare, flexible time off, company holidays and recharge days, commuter benefits, lifestyle stipends, learning and development stipends, patronage, parental leave, and 401k plan with matching. Patreon operates under a hybrid work model, where employees based in office locations are expected to come into the office three days per week, excluding sick time and paid leave. The goal of this policy is to be intentional about the in-person time we spend together to strengthen the feeling of community at Patreon. Candidates hired into remote-eligible roles are not expected to meet the same requirements. At Patreon, we believe in fair and transparent pay. In compliance with New York and California pay transparency laws, we are sharing the expected salary range for this role. The posted salary range is dependent on the location and the level. This range may encompass multiple levels within the role’s job family. The final offer will be based on candidate’s experience, skills, competencies, and geographic location, aligning with the appropriate job level within Patreon’s leveling framework. For remote employees located outside CA and NY, salary may vary based on location and local market conditions. Patreon reserves the right to modify or update compensation and benefits at any time.

Location: San Francisco, California; New York, New York Workplace: Hybrid WHO WE ARE Notion is the collaborative AI workspace where teams and agents think together https://www.youtube.com/watch?v=vkpYpWfEK5s. We're building one place where your knowledge, projects, meetings, and AI tools live side by side, so work is faster, clearer, and less fragmented. Millions of individuals, small teams, and large companies run their work on Notion. Notinos (our employees) are customer zero in bringing this future of work to life. We care about craft, building things that last, and the belief that great work is still fundamentally human. Our goal isn’t to ship the next feature. Each and every team of Notinos is working to set the standard for how humans work together in the AI era. From building a business’s system of record to making and managing AI agents to automating away the busy work, we care deeply about giving our customers more time for their life’s work. ABOUT THE ROLE Millions of people rely on Notion to do their most important work, and protecting that trust is foundational to everything we build. We’re looking for a hands-on Detection Engineer to build and operate the systems and workflows we use to detect and respond to attacks across Notion’s cloud-native environment. You’ll ship high-signal detections, improve the platform that powers them, participate in incident response, and help shape how detection and response engineering scales at Notion. You’ll work closely with Engineering, Corporate Security, and Infrastructure, with broad latitude to identify gaps, prioritize investments, and build what’s needed next. We view detection and response as a software engineering discipline: detections are code, platforms are products, and measurement matters WHAT YOU'LL ACHIEVE - Build and tune high-signal detections across cloud, identity, endpoint, and SaaS environments, with review and mentorship from senior teammates as you ramp up. - Contribute to the detection platform, including rule lifecycle management, tuning, measurement, and rollout safety. - Build tooling and automation that speed up triage, enrichment, investigation, and detection authoring, including LLM-based workflows where useful. - Turn threat intelligence and adversary TTPs into detections, telemetry requirements, and response improvements. - Take part in investigations, incident response, and postmortems, and help turn what we learn into lasting fixes. - Help define and track metrics such as coverage, MTTD, and alert quality. - Join a shared on-call rotation for incident response. SKILLS YOU'LL NEED TO BRING - We're hiring across a range of experience levels. If you have some of these skills but not all, we'd still like to hear from you. - 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role. - Have written or tuned detections that run in production, and care about signal quality and cutting noise. - Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and the drive to learn one quickly. - An understanding of how attackers operate (for example, MITRE ATT&CK), and the ability to use it to decide what to detect. - Hands-on experience with AWS, GCP, or Azure, ideally including identity and access logs. - Have used SIEM, EDR, or SOAR tools in any size of environment. - Write clearly in runbooks, design docs, and incident notes, and can own well-scoped projects end to end. NICE TO HAVE - Have led purple team, blue team, or adversary emulation exercises that improved detections or telemetry. - Experience running SIEM, EDR, or SOAR platforms at large scale. - Experience building or maintaining detection-as-code workflows (version control, CI, and tests for detections). - Experience applying LLMs or agent-style tooling to security workflows. - Experience securing AI-enabled systems or endpoint tooling. - Kubernetes or container detection experience. - Background in threat intelligence, malware analysis, or digital forensics. - Contributions to the security community through research, tooling, CTFs, or talks. - Experience at a high-growth startup or AI company. Notion is committed to providing highly competitive cash compensation, equity, and benefits. The compensation offered for this role will be based on multiple factors such as location, the role’s scope and complexity, and the candidate’s experience and expertise, and may vary from the range provided below. For roles based in San Francisco or New York City, the estimated base salary range for this role is $185,000 - $280,000 per year.   By clicking “Submit Application”, I understand and agree that Notion and its affiliates and subsidiaries will collect and process my information in accordance with Notion’s Global Recruiting Privacy Policy https://notion.notion.site/Notion-Global-Recruiting-Privacy-Policy-fc3eb4e829354a26a2bb6fd5e289b550 and and NYLL 144 https://notion.notion.site/Ashby-AI-Bias-Audit-2b0efdeead05803bbbfae159ec86c528.   #LI-Onsite A NOTE ON AI You don’t need deep AI expertise for every role, but we do expect every Notino to be intellectually curious, drawn to tinkering and discovery, and excited to use AI as a real collaborator in their work. For some roles, AI fluency is a core requirement — when that’s the case, we'll say so explicitly in the qualifications. People who thrive here don’t treat AI as a novelty. They use it to think better, and make their work easier for others to build on. EQUAL OPPORTUNITY & ACCOMMODATIONS We hire talented people from a wide range of backgrounds. If you’re excited about this role but don’t meet every bullet, we still encourage you to apply. Notion is an equal opportunity employer and does not discriminate on the basis of any legally protected characteristic. Consistent with applicable law, we will consider for employment qualified applicants with arrest and conviction records. Notion provides reasonable accommodations during the application process; if you need one, please let your recruiter know. Notion is proud to be an equal opportunity employer. We do not discriminate in hiring or any employment decision based on race, color, religion, national origin, age, sex (including pregnancy, childbirth, or related medical conditions), marital status, ancestry, physical or mental disability, genetic information, veteran status, gender identity or expression, sexual orientation, or other applicable legally protected characteristic. Notion considers qualified applicants with criminal histories, consistent with applicable federal, state and local law. Notion is also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, please let your recruiter know.