Вакансии

Location: New York City DRW is a diversified trading firm with over 3 decades of experience bringing sophisticated technology and exceptional people together to operate in markets around the world. We value autonomy and the ability to quickly pivot to capture opportunities, so we operate using our own capital and trading at our own risk. Headquartered in Chicago with offices throughout the U.S., Canada, Europe, and Asia, we trade a variety of asset classes including Fixed Income, ETFs, Equities, FX, Commodities and Energy across all major global markets. We have also leveraged our expertise and technology to expand into three non-traditional strategies: real estate, venture capital and cryptoassets. We operate with respect, curiosity and open minds. The people who thrive here share our belief that it’s not just what we do that matters–it's how we do it. DRW is a place of high expectations, integrity, innovation and a willingness to challenge consensus. About the Role DRW is building out its offensive security capability, and we’re looking for a Senior Offensive Security Engineer to lead the charge. In this role, you’ll plan and execute red team engagements, penetration tests, and adversary simulations against our trading infrastructure, corporate environment, and cloud platforms, acting as a trusted adversary who helps us find and fix weaknesses before anyone else does. You’ll work closely with our security, infrastructure, and trading teams to translate what you find into real improvements, and you’ll help shape the methodology, tooling, and roadmap for offensive security at DRW as the function matures. This is a hands-on, high-trust role for someone who thinks like an attacker, communicates like a partner, and cares about making the firm measurably harder to compromise. What You'll Do Plan and execute red team engagements and adversary simulations against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidance Design and build custom tooling, scripts, and exploits to emulate adversary behavior, test control effectiveness, and validate detection coverage Partner with the Security Engineering and SOC teams in purple-team exercises to close gaps between what attackers can do and what defenders can see Run social engineering and phishing simulations to assess and improve organizational security awareness Identify, validate, prioritize, and track vulnerabilities and control weaknesses through to remediation in collaboration with infrastructure, platform, and application owners Present engagement results and risk narratives to both technical teams and senior leadership in a way that drives action Stay current on the threat landscape, emerging TTPs, and offensive tooling, and bring that knowledge back into DRW’s defenses Assess the security of AI and LLM-integrated systems, including prompt injection, model manipulation, data poisoning, and abuse of agentic workflows, and work with teams building these systems to harden them Leverage AI-assisted tooling to accelerate reconnaissance, vulnerability discovery, and exploit development, and evaluate new AI-powered offensive techniques as they emerge Help define and mature DRW’s offensive security methodology, standards, and tooling, and mentor other engineers on the security team What We're Looking For 5+ years of hands-on experience in offensive security, penetration testing, or red teaming, including full engagement lifecycle work: reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration Strong scripting or programming ability for building and adapting offensive tooling Solid understanding of networking fundamentals, Windows, macOS, and Linux internals, identity providers, and cloud platforms Practical experience with common offensive security tools (e.g., Cobalt Strike, Metasploit, BloodHound, Burp Suite, Nmap) and a track record of building your own when the situation calls for it Working knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improve A track record of clear, precise reporting and communication and you can translate technical findings into risk that both engineers and executives understand Experience with smart contract auditing and blockchain security Familiarity with AI/ML security risks, including adversarial attacks on models, prompt injection, and the offensive and defensive implications of LLM-powered tooling A collaborative mindset: you see red teaming as a way to make the whole organization more secure, not just to find flaws The annual base salary range for this position is $175,000 to $275,000 depending on the candidate’s experience, qualifications, and relevant skill set. The position is also eligible for an annual discretionary bonus. In addition, DRW offers a comprehensive suite of employee benefits including group medical, pharmacy, dental and vision insurance, 401k (with discretionary employer match), short and long-term disability, life and AD&D insurance, health savings accounts, and flexible spending accounts. For more information about DRW's processing activities and our use of job applicants' data, please view our Privacy Notice at https://drw.com/privacy-notice . California residents, please review the California Privacy Notice for information about certain legal rights at https://drw.com/california-privacy-notice . #LI-BL1

Location: Chicago DRW is a diversified trading firm with over 3 decades of experience bringing sophisticated technology and exceptional people together to operate in markets around the world. We value autonomy and the ability to quickly pivot to capture opportunities, so we operate using our own capital and trading at our own risk. Headquartered in Chicago with offices throughout the U.S., Canada, Europe, and Asia, we trade a variety of asset classes including Fixed Income, ETFs, Equities, FX, Commodities and Energy across all major global markets. We have also leveraged our expertise and technology to expand into three non-traditional strategies: real estate, venture capital and cryptoassets. We operate with respect, curiosity and open minds. The people who thrive here share our belief that it’s not just what we do that matters–it's how we do it. DRW is a place of high expectations, integrity, innovation and a willingness to challenge consensus. About the Role DRW is building out its offensive security capability, and we’re looking for a Senior Offensive Security Engineer to lead the charge. In this role, you’ll plan and execute red team engagements, penetration tests, and adversary simulations against our trading infrastructure, corporate environment, and cloud platforms, acting as a trusted adversary who helps us find and fix weaknesses before anyone else does. You’ll work closely with our security, infrastructure, and trading teams to translate what you find into real improvements, and you’ll help shape the methodology, tooling, and roadmap for offensive security at DRW as the function matures. This is a hands-on, high-trust role for someone who thinks like an attacker, communicates like a partner, and cares about making the firm measurably harder to compromise. What You'll Do Plan and execute red team engagements and adversary simulations against trading systems, corporate IT, and cloud environments, modeling realistic attacker tactics, techniques, and procedures (TTPs) mapped to frameworks such as MITRE ATT&CK Conduct penetration tests across networks, web and internal applications, APIs, and cloud infrastructure, and report findings with clear, actionable remediation guidance Design and build custom tooling, scripts, and exploits to emulate adversary behavior, test control effectiveness, and validate detection coverage Partner with the Security Engineering and SOC teams in purple-team exercises to close gaps between what attackers can do and what defenders can see Run social engineering and phishing simulations to assess and improve organizational security awareness Identify, validate, prioritize, and track vulnerabilities and control weaknesses through to remediation in collaboration with infrastructure, platform, and application owners Present engagement results and risk narratives to both technical teams and senior leadership in a way that drives action Stay current on the threat landscape, emerging TTPs, and offensive tooling, and bring that knowledge back into DRW’s defenses Assess the security of AI and LLM-integrated systems, including prompt injection, model manipulation, data poisoning, and abuse of agentic workflows, and work with teams building these systems to harden them Leverage AI-assisted tooling to accelerate reconnaissance, vulnerability discovery, and exploit development, and evaluate new AI-powered offensive techniques as they emerge Help define and mature DRW’s offensive security methodology, standards, and tooling, and mentor other engineers on the security team What We're Looking For 5+ years of hands-on experience in offensive security, penetration testing, or red teaming, including full engagement lifecycle work: reconnaissance, initial access, privilege escalation, lateral movement, persistence, and exfiltration Strong scripting or programming ability for building and adapting offensive tooling Solid understanding of networking fundamentals, Windows, macOS, and Linux internals, identity providers, and cloud platforms Practical experience with common offensive security tools (e.g., Cobalt Strike, Metasploit, BloodHound, Burp Suite, Nmap) and a track record of building your own when the situation calls for it Working knowledge of the MITRE ATT&CK framework, adversary emulation, and detection evasion techniques, along with enough understanding of defensive controls and tooling to help defenders improve A track record of clear, precise reporting and communication and you can translate technical findings into risk that both engineers and executives understand Experience with smart contract auditing and blockchain security Familiarity with AI/ML security risks, including adversarial attacks on models, prompt injection, and the offensive and defensive implications of LLM-powered tooling A collaborative mindset: you see red teaming as a way to make the whole organization more secure, not just to find flaws The annual base salary range for this position is $175,000 to $275,000 depending on the candidate’s experience, qualifications, and relevant skill set. The position is also eligible for an annual discretionary bonus. In addition, DRW offers a comprehensive suite of employee benefits including group medical, pharmacy, dental and vision insurance, 401k (with discretionary employer match), short and long-term disability, life and AD&D insurance, health savings accounts, and flexible spending accounts. For more information about DRW's processing activities and our use of job applicants' data, please view our Privacy Notice at https://drw.com/privacy-notice . California residents, please review the California Privacy Notice for information about certain legal rights at https://drw.com/california-privacy-notice . #LI-BL1

Location: Ireland, Dublin Why Sony Interactive Entertainment? Sony Interactive Entertainment isn’t just the Best Place to Play — it’s also the Best Place to Work. Sony Interactive Entertainment (SIE) is the company behind the PlayStation brand. As a subsidiary of Sony Group Corporation, we’re part of a proud legacy of innovation and excellence. SIE is a dynamic technology company, delivering cutting-edge hardware and network services to more than 100 million people and an entertainment leader, home to some of the most beloved and recognizable intellectual properties (IP) in the world. Our role at SIE is to create and nurture the experiences under the PlayStation brand, a name synonymous with entertainment excellence and creativity. We are looking for an inspirational and hardworking person to join the Platform Hosting Cloud Security Engineering team at SIE! You'll be joining a team of innovative engineers who are unified in their mission to make PlayStation the best and most secure gaming platform. This support is fulfilled by minimizing impact to the platform while ensuring security needs are met. This role is highly technical and requires a shown grasp of security principles and how they are applied to production environments. You will assist in the planning, design, development, testing, and management of security tools and processes that provide protection and visibility of our cloud environments. Key Responsibilities Design, architect, and implement security controls and frameworks for PlayStation Infrastructure Be responsible for the detection of security gaps, and lead efforts to mature security tooling and operational processes Work with product and platform teams to define system requirements, engineer, and implement cloud based security applications and controls Write code to automate security processes which seamlessly integrate into code builds and deployments, applying DevSecOps processes and tools Architect, develop, and deploy automation solutions that help audit, secure, and affect changes across multi-cloud environments Champion tools for improving platform availability using automated protection mechanisms Document security designs, operating procedures, and technical recommendations clearly. Review existing security policies and maintain their freshness and understandability. Mentor senior and junior engineers and guide them in making design choices that protect Platform Advocate for security and privacy best practices across engineering teams. Qualifications 5-7+ years of experience in cloud security, security engineering, DevOps, platform engineering, or a related field. Hands-on experience securing cloud infrastructure in AWS, GCP, or both. Understanding of common security frameworks and compliance concepts, such as NIST or PCI DSS Proficient in multiple programming and scripting languages such as Python and Go Experience architecting and deploying IaC tools such as CloudFormation and Terraform Familiarity with CI/CD and DevOps tools and practices, such as GitHub, Jenkins, Kubernetes, and automated deployment pipelines. Shown experience building end-to-end enterprise level systems Hands-on experience with utilizing tooling like Wiz and AI tooling like Codex, etc. Strong written and verbal communication skills, with the ability to collaborate effectively across technical and non-technical teams. Proven record of success in coaching and growing people Technical certifications or other demonstrations of passion in security and technology such as CISSP, CCSP, AWS Certified Security are a plus! Strong written and verbal communication skills, with the ability to collaborate effectively across technical and non-technical teams. Technical certifications or demonstrated passion for security and technology, such as Security+, AWS Certified Security – Specialty, CISSP, or CCSP, are a plus. At SIE, we consider several factors when setting each role’s base pay range, including the competitive benchmarking data for the market and geographic location. Please note that the base pay range may vary in line with our hybrid working policy and individual base pay will be determined based on job-related factors which may include knowledge, skills, experience, and location. In addition, this role is eligible for SIE’s top-tier benefits package that includes paid time off, wellness program and coveted employee discounts for Sony products. This role also may be eligible for a bonus package. Click here to learn more. The estimated base pay range for this role is listed below. €87.800 — €131.800 EUR Please note, Sony Interactive Entertainment conducts background checks at the offer stage for all new employees (which may include criminal background checks for some roles) and will need to process personal information to support these checks. Please refer to our Candidate Privacy Notice (where applicable) for more information about what personal information we collect, how we use it, who we share it with, and your data protection rights. Equal Opportunity Statement: Sony is an Equal Opportunity Employer. All persons will receive consideration for employment without regard to gender (including gender identity, gender expression and gender reassignment), race (including colour, nationality, ethnic or national origin), religion or belief, marital or civil partnership status, disability, age, sexual orientation, pregnancy, maternity or parental status, trade union membership or membership in any other legally protected category. We strive to create an inclusive environment, empower employees and embrace diversity. We encourage everyone to respond. Sony Interactive Entertainment is a Fair Chance employer and qualified applicants with arrest and conviction records will be considered for employment.

Location: San Francisco, CA | New York City, NY | Seattle, WA About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Frontier AI is on track to be among the most consequential and most adversarially-targeted technology in the world. The capability curve is steep, the adversaries who want these systems are extremely well-resourced, and the security bar this will eventually require is well beyond where the industry operates today. Incremental hardening alone is not going to close that gap, so we need breakthroughs and a group of people to go find them. Security Labs is that team. We run a portfolio of high-risk, high-expected-value security projects: the work that seems impractical until someone optimistic and stubborn enough actually tries it. Projects run on the order of weeks rather than quarters, and each one is either handed off to the Anthropic team that will own it in production or wound down with a writeup of what we learned. We expect a meaningful fraction of our bets not to land. This team is intentionally scrappy and ambitious. We're intentionally iterating fast on high-risk research bets and we expect a meaningful fraction not to land. If a 30% project success rate sounds uncomfortable, or uncharted and chaotic territory isn’t both frightening and exciting, this probably isn't the right fit. There are other places in Anthropic Security doing important work with more structure, less risk, and more certain paths to positive outcomes. The questions we're trying to answer include: Can our core research workflows survive extreme isolation? Can we replace trust with cryptographic guarantees? Can the models themselves become our most effective security control? What would it actually take to defend against a tier-1 state adversary, and how much of that can we build now? Who we're looking for. We're hiring generalists with rare depth. You're a strong software engineer as a baseline, and on top of that you've gone deep in at least one area most engineers don't get near: firmware or hardware security, applied cryptography, OS / kernel / hypervisor internals, formal methods, reverse engineering, or high-assurance and cross-domain systems. You've built things under your own direction, you're comfortable jumping layers when the problem demands it, and you'd rather take a swing at something that might not work than ship the safe incremental thing. You think the trajectory of AI matters a great deal, you're not comfortable with how the security side of it is going by default, and you'd rather be on the inside building the answer than watching from outside. Current Project Areas The portfolio changes as we learn. The kinds of bets currently in flight or queued: Standing up a prototype high-assurance research cluster: running real Anthropic training and research workloads under extreme isolation and physical security controls, and finding out exactly where productivity breaks and what we'd need to invent to get it back Provable inference: cryptographic verification (zero-knowledge proofs, attestation chains) that a given output came from a specific model running specific code, replacing "trust us" with math Build hypervisor-isolated microVM workload isolation across the fleet Compiling an ML kernel through a formally verified pipeline where every lowering step carries a machine-checked proof of equivalence, making compilation-layer sabotage mathematically detectable Regenerating clusters: automation that spins up a purpose-built cell, runs a workload, and tears the whole thing down on a TTL measured in hours, so attacker persistence has an expiry date Using Claude itself to drive security work end to end: threat modeling new compute platforms, rewriting critical services to zero external dependencies, running the test equipment that validates what hardware datasheets claim Part of your job is deciding what comes next. We hire people we trust to pick good bets, and project selection is owned by the engineers doing the work. Key responsibilities Own Security Labs projects end to end. You'll scope the bet, build the prototype, run it against real workloads, and bring it to either a hand-off or a documented exit Stand up novel security infrastructure fast (isolated clusters, attestation chains, hypervisor and runtime work, verification tooling) optimizing for what we learn rather than for permanence Find the receiving team early, bring them along while you build, and hand them something they actually want to own Work embedded with research and infrastructure teams (Pretraining, RL, Inference, Compute) to test whether their workflows survive what you're proposing, and document precisely where they don't Turn experimental results into short writeups that shape Anthropic's long-term security architecture, and into costed contingency plans we could execute on short notice Help pick the next round of bets and influence the industry to get better along the way Minimum qualifications Genuinely care about where AI is heading and want to work on the security problems that determine whether it goes well. This is the most important thing on this list Have real depth in at least one area most software engineers don't touch (e.g. firmware or hardware security, applied cryptography, OS / kernel / hypervisor internals, formal methods and verification, reverse engineering and exploit development, or high-assurance / cross-domain systems) Have built and shipped things under your own direction. Maybe you founded a company or research group, maintained an open-source project other people depend on, or shipped research that changed how people in your field work. We weight this far more than where you've worked or for how long Have a track record of choosing the problem yourself and seeing it through, rather than only executing a plan someone else handed you Are comfortable jumping between domains and layers of the stack when the problem calls for it, and have actually done so Have run prototypes or experiments where the goal was answering a hard question rather than shipping a permanent system, including ones that didn't pan out Write clearly enough to turn weeks of work into a couple of pages someone can act on Change your mind when the evidence says to, and are fine being the least-expert person in a room full of specialists Care about defense. Plenty of folks here come from offense and that background is valuable, but what you actually want to spend your time on now is making systems hold up Are a strong programmer (Python plus at least one of Rust, Go, or C/C++) and can stand up real infrastructure without that being the interesting part of your week Preferred qualifications Experience inside airgapped or high-side environments (classified networks, cross-domain solutions, ICS/SCADA, financial trading infrastructure) and the operational realities of working in them A background in offensive security, red teaming, or vulnerability research, with calibrated intuitions for which threats actually matter Familiarity with ML infrastructure (training pipelines, distributed schedulers, inference serving, accelerator hardware) sufficient for grounded conversations with researchers about what their workloads actually need A history of working in environments built around rapid iteration rather than rigid change control: startups, applied research groups, independent consulting, small security shops The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 — $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: San Francisco, CA | New York City, NY | Seattle, WA About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the team Secure Frameworks is the team in Anthropic's Security Engineering org that builds shared security libraries and frameworks the rest of the company builds on. We collaborate closely with teams and leaders across Anthropic to own critical security foundations, including workload identity and authorization, cryptographic frameworks, and the centralized access proxy that  secures traffic to internal applications. Our mission is to make the secure thing easy and the easy thing secure by helping Anthropic engineers get secure behaviour by default and preventing entire classes of vulnerabilities through careful design. We own what we ship, help customers adopt better security practices and at times we work embedded directly in research, infrastructure or product teams. About the role You will design, build and run security foundations used across Anthropic's fleet, from threat model through production, on-call and adoption. Much of the work is greenfield: our infrastructure is growing quickly and the timelines are compressed, so you will help define the architecture rather than inherit it. Depending on your strengths you will focus on one or two of the areas below and contribute across the rest. Build critical security foundations including cryptographic frameworks, mTLS infrastructure, secure serialization, and authorization systems, designed to prevent entire classes of vulnerabilities Partner with product, research, infrastructure, and other security teams to ensure frameworks integrate smoothly with lower-layer security controls Scope, design and build security services and libraries end-to-end, maintain them in production, and drive through ambiguous technical problems with minimal oversight Build and operate the zero-trust access gateway that fronts Anthropic's internal services Design and roll out authorization frameworks so services enforce least privilege consistently instead of each inventing its own access controls Own cryptographic frameworks and libraries Mentor engineers, contribute to hiring, and grow security engineering culture across Anthropic Minimum qualifications 8+ years of software engineering experience building security-relevant systems in production, including leading complex initiatives independently Strong programming skills in Go, Rust or Python Deep understanding of authentication and authorization systems: OAuth 2.0 / OIDC, JWTs, service-to-service auth, policy-based access control Hands-on experience with PKI, X.509, mTLS and workload identity Working knowledge of applied cryptography: choosing and composing primitives correctly, key management, and the ways libraries fail in practice Experience shipping and operating high-reliability services on Kubernetes across cloud and on-prem environments, including being on call for them A track record of bringing clarity and ownership to ambiguous technical problems and driving them to resolution across teams A strong sense of developer experience Clear communication across all levels of the organization Passion for AI safety and the role security engineering plays in building trustworthy AI systems Preferred qualifications Built security frameworks or libraries adopted across an engineering organization, and done the work to drive that adoption Built or operated a zero-trust / BeyondCorp-style access gateway or identity-aware proxy Migrated a fleet to mTLS at scale, including certificate issuance and staged enforcement Maintained or contributed to open-source cryptographic libraries Designed authorization systems using policy languages or relationship-based models Familiarity with ML infrastructure (training, inference serving) The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 — $485,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: Foster City, CA Workplace: Hybrid Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. ABOUT THE ROLE We're looking for a Security Engineer with deep incident response experience to help defend Replit, a fast-moving, cloud-native AI vibe-coding platform. You'll be the person who takes charge when something goes wrong. You'll lead investigations from first signal to root cause, coordinate containment across Security, SRE, and Engineering, and keep stakeholders informed while the incident is moving fast. This isn't a pure responder role. We want a well-rounded security engineer who has run real incidents and wants to make the next one faster. You'll write the scripts, automations, and tooling that take manual work out of triage, evidence collection, and containment. You'll also turn lessons from each incident into better detections, playbooks, and platform hardening.   RESPONSIBILITIES Incident Response - Serve as incident commander or technical lead for security incidents, from detection and triage through containment, eradication, recovery, and post-incident review. - Coordinate response across Security, SRE, Engineering, Legal, and leadership. Drive decisions under pressure and keep a clear record of actions taken. - Communicate incident status, impact, and risk clearly to technical and executive audiences. - Participate in and help shape the security on-call rotation. Investigation & Forensics - Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers using SIEM, Cloud Logging, telemetry, and host and container artifacts. - Determine scope, root cause, attacker behavior, and blast radius for confirmed incidents. - Quickly assess whether emerging threats (0-days, active exploitation campaigns, bug bounty findings, customer reports) apply to Replit, and whether we're already affected. IR Automation & Tooling - Build scripts, automations, and tools (Python, Go, Bash, or directly on Replit) that speed up response, such as automated enrichment, evidence collection, credential and session revocation, workload isolation, and alert triage. - Develop and maintain response playbooks and runbooks, and automate them where possible. - Integrate response workflows with SIEM, SOAR, ticketing, and chat tooling to cut time-to-contain. Detection & Continuous Improvement - Turn incident findings into new or improved detections, logging coverage, and visibility. - Lead blameless post-incident reviews and drive remediation items to completion. - Run tabletop exercises and simulations to test readiness and find gaps.   REQUIRED SKILLS & EXPERIENCE - Proven experience leading or serving as technical lead on security incidents in a cloud or SaaS environment. - Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis. Comfortable working through large datasets under time pressure. - Proficiency writing production-quality scripts or tools in Python, Go, or Bash for investigation and automation. - Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking). - Working knowledge of Kubernetes and containers, including how to investigate and contain compromised workloads. - Understanding of identity systems, SaaS architectures, and common cloud attack paths (credential theft, privilege escalation, supply chain, token abuse). - Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems, so you can work effectively with Engineering on code-level fixes. - Understanding of IR frameworks and lifecycle (for example NIST 800-61), plus the vulnerability lifecycle and exploitability analysis.   PREFERRED QUALIFICATIONS - Experience building or operating SOAR or other response automation platforms. - Digital forensics experience with cloud, Linux hosts, or containers. - Experience with threat intelligence, threat hunting, or security research. - Experience with bug bounty programs or coordinated vulnerability disclosure. - Familiarity with detection-as-code practices and writing detection rules. - Experience in fast-paced, cloud-native, or AI/ML-driven environments. - Relevant certifications (such as GCIH, GCFA, GCFR), or equivalent hands-on experience. WHAT WE VALUE - Curiosity & initiative: Strong desire to understand attacker behaviors, emerging threats, and how they apply to real-world systems. - Speed & analytical rigor: Ability to quickly assess high-risk vulnerabilities with clear, evidence-based reasoning. - Collaboration: Comfort working across cross-functional teams spanning Security, SRE, Engineering, and Infrastructure. - Clear communication: Ability to explain findings, risks, and mitigation strategies to stakeholders at all levels. - Ownership mindset: Takes initiative to drive investigations, improvements, and remediations to completion. - Continuous learning: Passion for staying up to date on new vulnerabilities, exploit trends, and cloud-native security best practices. Full-Time Employee Benefits Include: 💰 Competitive Salary & Equity 💹 401(k) Program with a 4% match (US Only) ⚕️ Health, Dental, Vision and Life Insurance 🩼 Short Term and Long Term Disability 🚼 Paid Parental, Medical, Caregiver Leave 🏝 Flexible Time Off (FTO) + Holidays 🚗 Commuter Benefits (In-Office & US Only) 📱 Monthly Wellness Stipend 🧑‍💻 Autonomous Work Environment 🖥 In Office Set-Up Reimbursement (In-Office Only) 🚀 Quarterly Team Gatherings ☕ In Office Amenities (In-Office Only) Want to learn more about what we are up to? - Self-driving Company https://replit.com/blog/self-driving-company - Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale - AI Adoption https://replit.com/blog/ai-adoption - Build Open-Source Apps https://replit.com/build/open-source-app-builder   Interviewing + Culture at Replit - Operating Principles https://blog.replit.com/operating-principles - Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.

Location: Atlanta, Georgia; Toronto, Ontario; Athens, Georgia Workplace: Hybrid Artificial Intelligence. Actual Impact. At Docebo, we’re using AI to change how people learn at work—and we mean actually change it. We’re an AI-powered learning platform that helps organizations create, deliver, and manage training all in one place. But our real mission goes deeper: we help teams move faster, work smarter, and focus on the work that truly matters. Our platform is built with intelligent, time-saving tools that personalize learning, eliminate busywork, and turn training from a checkbox into a superpower. The result? Better experiences for learners and real results for businesses. We’re shaping the future of learning with a team that isn’t afraid to challenge the status quo. If you're excited by the idea of using AI to make work-life better for real people–you’ll feel right at home here. And it’s not just what we build, it’s how we show up. At Docebo, our values aren’t just posters on the wall—they guide how we work every day. We call it the Docebo Heart: trust by default, assume positive intent, and create space for different perspectives to thrive. So… what are you waiting for? Join 900+ Docebians around the world and help us reinvent the way people learn, because learning never stops. THE ADVENTURE AHEAD 🚀 As our Vice President, Information Security, you will step up as the de facto security leader owning Docebo’s global security strategy across product, cloud, GRC, and AI. This is not an advisory tower role; you will operate at executive altitude while staying close to real architecture, engineering decisions, threat modeling, and control execution. You will drive hard, measurable risk reduction while pioneering AI-first security practices that empower our business to move fast with complete confidence. THE DAY-TO-DAY 🗓️ - Architect Global Strategy: Own and evolve Docebo’s enterprise security roadmap across product security, cloud hardening, GRC, privacy, and incident response to achieve measurable control maturity. - Embed Security by Design: Partner deeply with Product and Engineering to integrate threat modeling, secure SDLC, CI/CD security, identity controls, and vulnerability remediation into core engineering workflows. - Pioneer AI-First Security: Build robust governance and controls for AI products and internal tooling while harnessing AI to automate detection, vulnerability management, and threat response. - Champion Customer Trust: Lead compliance programs (SOC 2, ISO 27001) backed by real controls, and represent Docebo with executive credibility in board updates, audits, and enterprise customer due diligence. - Elevate Defense Operations: Strengthen security telemetry, threat intelligence, and detection across cloud and corporate environments to protect against emerging modern attack patterns. - Empower High-Impact Teams: Lead and coach a talented security team, building a high-accountability culture focused on clear outcomes, rapid execution, and continuous learning. YOUR SUPERPOWERS ⚡ - Proven Executive Leadership: Significant experience leading information security programs in a software, SaaS, or tech product environment with a track record of executive and board collaboration. - Deep Technical Foundations: Hands-on mastery of application security, cloud security (AWS), infrastructure, identity systems, secure SDLC, and modern vulnerability management. - Mandatory Certification: Active CISSP credential backed by a deep understanding of SOC 2, ISO 27001, privacy regulations, and enterprise SaaS security standards. - Collaborative Business Driver: Exceptional ability to forge trusted partnerships across Product, Engineering, Legal, and Sales, acting as an enabler who balances security with business velocity. - Outcome-Focused Execution: A clear track record of using metrics and business risk language to make decisive, risk-informed choices in complex, ambiguous environments. BONUS POINTS 🎯 - AI Security Expertise: Hands-on experience securing AI-enabled products and LLMs, or utilizing AI tools to scale security operations and automated testing. - Advanced Technical Certifications: Additional credentials such as CISM, CISA, CCSP, AWS Security Specialty, or GIAC, combined with offensive security or red teaming experience. - Enterprise & Public Sector Reach: Proven experience navigating FedRAMP standards, public-sector requirements, and high-growth global SaaS expansion. OUR HYBRID WORK PHILOSOPHY 🤝 Great work can happen anywhere but coming together helps us go further. Our team spends three days a week in the office (Tuesday-Thursday) to collaborate, solve problems, and learn from each other. With flexibility the rest of the week, it’s a balance designed to help everyone do their best work and keep growing. OUR TOTAL REWARDS PHILOSOPHY 🎉 Our Total Rewards Philosophy centers around three core areas to reward and care for our People: - Rewarding Impact: We lead with competitive pay to reward the impact, skills and traits that fuel our success. - Fostering Holistic Wellbeing: We care deeply about and invest in the whole person with programs that support our people’s physical, mental, and financial well-being. - Empowering Our Talent Culture: We build a culture of trust and empowerment by designing our rewards and benefits with transparency, equity, and flexibility, enabling our people to do their best work and stay for the long haul. OUR PROMISE TO YOU 😍 - Financial Wellness: Own a piece of Docebo through our Employee Share Purchase Plan (ESPP) at a 15% discount, plus a competitive compensation package. - Your Well-Being, Covered: You’ll get access to health benefits, so you can get the care you need when you need it. - Rest, Relax, Repeat: Rest and recharge with paid vacation days, two company-wide Docebo Days, floating holidays for cultural celebrations, and your birthday off! - Family First: We provide coverage offering you time with your little one(s) so you can soak up all those precious moments. Fun fact: we had 30 Docebian babies join the family in 2025! - Connections That Count: Connect with global communities through our Employee Resource Groups (including PRIDE, DWA, BIDOC, and Green Ambassadors) and company-wide events that keep the fun rolling all year long. ABOUT DOCEBO 💙 At Docebo, we create seamless, AI-powered learning experiences for over 3,000 customers worldwide. We have successfully achieved two IPOs (TSX: DCBO & NASDAQ: DCBO https://www.docebo.inc/home/default.aspx), been recognized as a top SaaS e-learning solution, and are growing exponentially in the process. We're a global company, with office across North America, EMEA, APAC, and beyond. Our team is guided by five core values—Grow Together Win Together, Build with Our Customer, Clear is Kind, Own Outcomes, Progress Over Perfection—that shape everything we do. If this resonates with you, now is the perfect time to join one of the fastest-growing learning technology companies in the world. Docebo is an Equal Employment Opportunity employer https://www.eeoc.gov/sites/default/files/2022-10/EEOC_KnowYourRights_screen_reader_10_20.pdf. We are committed to diversity and inclusion in our workforce. All qualified applicants and employees will receive consideration for employment regardless of their race, colour, religion, sex (including pregnancy, gender identity, and sexual orientation), national origin, citizenship status, age, disability, genetic information, or any other category protected under applicable law. As a federal contractor, Docebo is committed to the principles of affirmative action and equal employment opportunity for protected veterans and individuals with disabilities. Docebo does not discriminate because of protected veteran status or on the basis of disability, and Docebo takes affirmative action to employ and advance in employment qualified protected veterans and individuals with disabilities. Any individuals requiring a reasonable accommodation or would like to voluntarily disclose a disability or protected veteran status to assist with their employment application should send an e-mail to their recruiter directly.

Location: Remote - Europe About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. Offensive security The internal offensive security team is responsible for the penetration testing program, red team engagements, and offensive research aimed at uncovering sophisticated attack scenarios targeting high-value assets across the Nebius Cloud stack. The Role We're hiring an Offensive Security Engineer to join us at Nebius. You'll design and execute adversarial simulation across our cloud platform - attacking the same infrastructure our customers depend on - and translate findings into measurable security improvements. This is a hands-on engineering role within Product Security Team. You will be part of an internal red team, establish a penetration testing program, and conduct research to uncover sophisticated attack scenarios targeting high-value assets across the Nebius tech stack. What you’ll do Validate and extend early-stage Secure SDLC threat models via continuous penetration testing , assessing threat severity and mitigation status while challenging assumptions made during threat modeling and system development. Automate routine validations to keep pace with increasing feature flow, reserving manual analysis for genuinely complex cases. Plan and execute full-scoped red team engagements against Nebius cloud platform - including compute, storage, inference, networking, orchestration layers, and internal tooling. Identify threats, which are able to impact an organization's operations. Work closely with Detection & Response and other security engineering teams to run purple team exercises, validate detection coverage, and close gaps collaboratively. Research novel attacks against GPU infrastructure (e.g., closed-source firmware and vendor driver binaries, device passthrough exploits, SR-IOV/IOMMU misconfigurations, RDMA/InfiniBand fabric attacks, etc.), the inference stack (e.g., vLLM, TRT-LLM), and AI platform managed services (e.g., managed Slurm). Assess tenant-isolation boundaries and how they can be broken at the low-level stack Conduct targeted assessments of new products and infrastructure changes before they ship. Deliver clear, actionable reports for both technical audiences and leadership - with prioritized findings and remediation guidance. Establish red team processes, tooling, and a methodology that scales as the platform grows. What we’re looking for 6+ years in offensive security - penetration testing, red teaming, or adversary simulation Deep experience attacking cloud-native environments: Kubernetes privilege escalation, cloud IAM abuse, virtualization and container escapes. Strong fundamentals across the attack lifecycle: initial access, persistence, lateral movement, data exfiltration. Proficiency developing custom tooling and post-exploitation capabilities (Python, Go, or similar). Experience running purple team exercises and working constructively with blue teams. Ability to write clear, senior-level reports with business-contextualized risk (not just raw findings) that engineers can easily use. Nice to have Experience attacking ML infrastructure, model serving pipelines, or GPU clusters. Reverse engineering and exploits development experience Application security experience Familiarity with eBPF bypass techniques or kernel-level exploitation. Background in vulnerability research or CVE discovery. Experience with cloud provider internals (hypervisor/networking layers). Presenting your security research at conferences like BlackHat/DefCon, etc. Why this role at Nebius Attack surface that's genuinely novel - GPU clusters, AI platforms, multi-tenant cloud at scale. Work alongside world-class engineers on infrastructure that powers frontier AI. Competitive compensation with equity upside in a Nasdaq-listed, high-growth company. Flexible, remote-first culture Hiring process Recruiter's chat (30mins) Live-coding interview (60mins) to asses basic coding skills Security interview (60mins) to asses domain expertise Security System Design interview (90mins) to assess practical experience (Optional) Technical deep dive (90mins) to present a complex and impact project. Final interview to close the hiring process (45mins) Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

About the Role: You'll work alongside diverse, cross-border teams and supportive colleagues who share knowledge and want to see you succeed. Salesforce, Marketo, Salesloft, and a growing web of integrated SaaS tools run large parts of Wrike's business. As that footprint grows, we're hiring a dedicated analyst to bring stronger visibility, governance, and risk understanding to this business systems estate — partnering closely with the teams who own and use these tools. Your Impact: — Own security for Wrike's business systems SaaS tools such as Salesforce, Marketo, Salesloft, and the integrations that connect them, covering permissions, sharing rules, connected apps, OAuth scopes, and integrations. — Build and maintain clear visibility into what data lives in these systems, why it's there, and how it flows between integrated tools. — Partner with RevOps, Marketing, Legal and others to embed security into how these platforms are configured, extended, and connected to third-party services. — Translate security and business-continuity issues into clear, actionable terms for non-technical stakeholders. — Ensure business systems handling personal data hold up against privacy frameworks including GDPR and CCPA, in close collaboration with Legal and Compliance. — Chase data-flow and permission questions to ground truth which means following through until the answer and its implications are genuinely clear. Your Qualifications: — Your primary expertise is in Salesforce administration and business systems security. — Everything else listed here is context you'll operate in. — Depth in the primary domain matters more than breadth across all of them. — Salesforce administration experience with a strong security lens. — This means permissions, sharing rules, connected apps, and integration patterns. — Solid understanding of how business systems interconnect and why that matters for data exposure and business continuity. — Able to communicate issues precisely to both technical and non-technical audiences. — Working knowledge of privacy frameworks such as GDPR and CCPA at minimum. — You don't need to tick every box! We're looking for depth in business systems security and the drive to grow across the rest. Standout Qualities: — Certified Salesforce Administrator credential. — Security+, ISC2 CC, or an equivalent security certification. — Experience auditing or governing SaaS-to-SaaS integrations. — Exposure to data security posture management (DSPM) or data classification in SaaS environments. — You use AI as a force multiplier — to move faster, think wider, and go deeper — but your security instincts and judgement are your own. — You don't outsource thinking to a tool. — Demonstrated tenacity in chasing complex data flows and access permissions across multi-tool integrations to a definitive answer. Team Dynamics: — You will be joining Wrike's 15-member global Security team led by Maksim Pekuryn, Director of Security. — You will report directly to Swen Groeneveld, Head of Security Operations, whose 8-person sub-team includes Security Engineers, Application Security, and SOC specialists. — You'll also work closely with cross-functional partners in RevOps, Marketing, and Legal. Our Work Style: — Tech stack: Salesforce, Marketo, Salesloft, OAuth integrations, connected apps, and related business SaaS tooling. — Collaborative environment working closely with RevOps, Legal, and Marketing teams. — Hybrid mode. Benefits & Perks: — 28 calendar days of paid vacation — Sick Leave Compensation (5 Paid Uncertified Sick Days) — Parental Leave: 18 Weeks Maternity / 4 Week Paternity — 2 Volunteer Days — Health Insurance (Employees + Dependents) — Life Insurance Plan — Utility Allowance (30 EUR/month, subject to taxation) — Fitness Plan (800 EUR/year) — Full-remote & On-demand access to Co-working space

Location: Remote Workplace: Remote ABOUT THE COMPANY Rain is the global stablecoin payments platform for enterprises, neobanks, platforms, developers, and AI agents. Our technology allows partners to move, store, and use stablecoins instantly and compliantly through global payment cards, rewards, on/offramps, wallets, and cross-border rails. As both a Visa and Mastercard Principal Member, Rain issues cards that work at more than 175 million merchant locations in over 220 countries and territories. Built natively for stablecoins and trusted by more than 100 organizations worldwide, Rain delivers secure, scalable infrastructure that makes money move freely and instantly around the world. You will have the opportunity to deliver massive impact at a hypergrowth company backed by some of the top investors in fintech, crypto, and SaaS. In January 2026, we closed a $250M Series C led by ICONIQ, valuing Rain at $1.95B, with Sapphire Ventures, Dragonfly, Bessemer Venture Partners, Galaxy Ventures, FirstMark, Lightspeed, Norwest, and Endeavor Catalyst also participating. If you're curious, bold, and excited to help shape a borderless financial future, we'd love to talk. OUR ETHOS We believe in an open and flat structure. You will be able to grow into the role that most aligns with your goals. Our team members at all levels have the freedom to explore ideas and impact the roadmap and vision of our company. ABOUT THE TEAM Security Engineering is a small team that answers one question: was it built right? We run our own AI-driven red team against Rain's code and cloud, gate pull requests before they merge, and write the baselines that say how every system should be configured. Our blockchain work is covered. This role owns everything else: the backend services, APIs, cloud, and edge that move real money for real customers. We work closely with Security Operations: we give them high-quality findings to coordinate fixes for, and clear configuration rules they can build detections on. ABOUT THE TEAM Security Engineering makes sure Rain is built right. We run our own AI-driven red team against our code and cloud, gate pull requests before they merge, and set the baselines for how every system is configured. This role owns everything outside blockchain: the backend services, APIs, cloud, and edge that move real money. We give Security Operations high-quality findings to coordinate fixes for, and clear configuration rules to build detections on. ABOUT THE ROLE You'll be Rain's application security expert and the quality bar for every non-chain finding we produce. The calls are yours: what's real, how bad it is, and what has to be fixed before launch. You'll hold the line with engineers when it matters, and make the case so they agree, not just comply. WHAT YOU'LL DO - Review red team findings before they reach engineers: reproduce them, cut false positives, set severity, and write tickets clear enough to fix without a meeting. Improve the scoring that grades them - Harden our backend services and APIs, especially the money-moving paths. You'll often write the fix yourself - Own edge defenses: DDoS protection, rate limiting, WAF rules, and abuse controls - Write secure configuration baselines for our cloud, code, and SaaS, and turn them into automated checks - Grow our PR security gate so more bugs are blocked before merge - Own attack surface coverage, and run architecture reviews on new and high-risk systems - Find, test, and pick the best security tools, whether we buy, adopt, or build WHAT WE'RE LOOKING FOR - 4+ years in application security, product security, or security-minded backend engineering - You've owned security decisions. You can tell a senior engineer their design needs to change and keep a good working relationship - You can read an unfamiliar codebase (TypeScript/Node.js) and find the bug that matters, and you know a scary-sounding finding from a real one - Hands-on cloud security (ideally GCP), Terraform, and edge defenses like WAFs and rate limiting - Experience with threat models or architecture reviews. You've run tool bake-offs and dropped tools that didn't earn their cost - You'd rather ship a check than write a document, and you use AI tools heavily without trusting them blindly BONUS ATTRIBUTES - Fintech, payments, or card issuing background (PCI DSS a plus) - Pentest, bug bounty, or red team experience - Experience building security scanners, static analysis rules, or LLM-based review tools - If you have the background: AI security for our agents and agentic payments, or corporate security alongside IT THINGS THAT ENABLE A FULFILLING, HEALTHY AND HAPPY EXPERIENCE AT RAIN: Unlimited time off 🌴 Unlimited vacation can be daunting, so we require Rainmakers to take 10 days minimum for themselves. Flexible working ☕ We support a flexible workplace – work from home, come into an office, or both. We want everyone to work in an environment where they're their most confident and productive selves. New Rainmakers receive a stipend to set up a comfortable home workspace. Easy to access benefits 🧠 For US Rainmakers, we cover 95% of your health, dental, and vision plan costs and 90% for your dependents, plus a 100% company-subsidized life insurance plan. Retirement goals💡 Plan for the future with confidence. We offer a 401(k) with a 4% company match. Equity plan 📦 Every Rainmaker gets an equity option plan so we all benefit from our success. Health and Wellness 📚 High performance begins from within. Rainmakers receive a monthly stipend to be used for eligible health and wellness spending like gym memberships/fitness classes, massages, acupuncture - whatever recharges you! In-office meals 🍜 Rainmakers working from the office enjoy lunch and dinner on us, covered with a DoorDash credit. Team summits ✨ Summits play an important role at Rain. Time together helps us build relationships and a common destiny. Expect team and company offsites, both domestic and international.

Задачи: — внедрение и эксплуатация NTA решений (Suricata, PT NAD); — внедрение и эксплуатация NGFW (PT NGFW, Check Point и многие другие); — эксплуатация 802.1x на базе Cisco ISE (возможно Huawei NAC); — разработка правил корреляции и сценариев выявления инцидентов ИБ сетевых устройств; — мониторинг и расследование инцидентов в рамках SOC L2; — участие в разработке сценариев реагирования (playbook); — анализ выявленных инцидентов; — аудит сетевой инфраструктуры; — интеграция NTA (PT NAD) и WAF (PT AF) в SOC через сценарии и плэйбуки. Требования: — фундаментальные знания ИБ, Linux, Network; — опыт администрирования сетевого оборудования Cisco, Eltex, Huawei; — опыт администрирования любых МСЭ Cisco, CheckPoint, Palo Alto, PT NGFW и т.д.; — опыт работы с Windows и Linux системами; — опыт работы с 802.1x, Cisco ISE, Huawei NAC; — умение анализировать журналы регистрации событий СЗИ, журналы ОС, сетевого оборудования. Дополнительным преимуществом будет: — курсы и сертификаты SIEM вендоров: ELK (Elastic Search) и другие; — курсы и сертификаты Cisco, Positive, Linux и др.; — опыт работы с NGFW вендора; — сертификаты CCNP Security, Huawei Security, Positive сетевые решения. Условия: — официальное оформление со всеми социальными гарантиями.

В роли инженера по безопасности приложений в AIFC предстоит заниматься обеспечением защиты программных продуктов, выявлением и устранением уязвимостей, а также внедрением современных методов безопасности. Кандидат должен обладать глубокими знаниями в области информационной безопасности, владеть инструментами анализа кода и тестирования на проникновение, а также иметь опыт работы с технологиями, применяемыми в разработке и эксплуатации приложений. Важны навыки работы с системами контроля версий, понимание принципов безопасного программирования и способность сотрудничать с командами разработчиков для повышения уровня безопасности продуктов.

Location: United States; Canada Workplace: Remote ABOUT DOCKER Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout. We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default. _______________________________________________________________________ THE ROLE As a Senior Security Engineer, Offensive Security, you'll help drive offensive security at Docker, putting our products, platforms, and cloud infrastructure under realistic adversarial testing to surface and drive out attack paths before real adversaries find them. You'll partner with engineering, product, and leadership to turn findings into durable fixes and to shape how security is designed into every Docker product. You'll apply your expertise in penetration testing, threat modeling, and exploit development to find and eliminate risks across Docker products and infrastructure. Working across cloud infrastructure (AWS, GCP, Azure), containerized environments, and AI/ML products, you'll implement proactive security solutions that scale with Docker's growth. This role offers the opportunity to help improve security programs at a company whose products are trusted by millions of developers worldwide. You'll work in a fast-paced, technically challenging environment where your security expertise directly impacts both Docker's platform and the broader container ecosystem. _______________________________________________________________________ RESPONSIBILITIES - Contribute to security initiatives that align with business goals, helping ensure security is a core component of our products and infrastructure - Support and help implement key security programs such as automated security design reviews, and vulnerability management - Build deep knowledge of software security and architecture, and act as a go-to resource for engineering teams - Partner with engineering to design and implement security architecture and controls across Docker products and platforms - Plan, scope, and execute penetration tests and red-team / adversary-emulation engagements against Docker's products and services - Develop proof-of-concept exploits and produce clear, risk-rated findings with actionable remediation guidance, then retest fixes to confirm closure - Build and maintain offensive security tooling and automation to expand testing coverage and repeatability - Perform security reviews and threat modeling (design, architecture, and code) across Docker products and services, including emerging AI products, and write automated security tests and exploits - Serve on rotating on-call schedule to respond to security events, investigate threats, and coordinate remediation efforts - Educate and collaborate with cross-functional teams (e.g., engineering, product) to promote security practices - Participate in Security Incident response _______________________________________________________________________ QUALIFICATIONS - Have 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure - Possess 2+ years of hands-on development experience in Python or Golang - Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles. - Have strong hands-on experience with securing cloud ecosystems (e.g. AWS, GCP, Azure) - Have hands-on penetration testing experience across SaaS web applications and APIs., including manual exploitation beyond automated scanners - Are proficient with offensive tooling and techniques such as. Burp Suite, and OWASP frameworks - Can write security tests and develop exploits and proof-of-concepts that find real vulnerabilities in a product - Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks - Have practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows - Have a track record of building security programs and automations from scratch, applying risk-based prioritization - Have experience performing security reviews and building or improving security review automation - Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders - Understand industry standards, and actively keep up with emerging security technologies and models - Are a team player who drives security change via collaboration and cross-functional partnerships - Hold offensive security certifications such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO - Have published CVEs, original security research, or conference talks Bonus if you: - Have experience with container escape, Kubernetes attack paths, or cloud red teaming - Have experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning _______________________________________________________________________ WHAT TO EXPECT FIRST 30 DAYS: - Meet with security team and key partners across engineering - Gain access to team owned systems, and internal documentation - Complete security awareness training and compliance onboarding - Review application architecture, tech stack and data flow - Review risk registry and annual roadmap - Familiarize oneself with team workflows and processes - Shadow a fellow security engineer during their on-call/secops rotations FIRST 90 DAYS: - Conduct security review on emerging Docker products - Scope and execute your first penetration test against a Docker product or service - Actively participate in architecture design reviews with the team - Contribute to a Security-owned project or initiative - Collaborate with Docker developers to validate and resolve discovered vulnerabilities - Enhance incident response capabilities by participating in on-call rotation and post-incident activities - Create and maintain security documentation and runbooks FIRST YEAR OUTLOOK - Contribute to the security roadmap for improving security controls - Strengthen Zero Trust architecture and least privilege access controls - Enhance security monitoring and anomaly detection - Perform security reviews for major product releases - Own and run recurring penetration tests and adversary-emulation exercises across Docker products, and engage with external researchers - Support audits and ensure compliance with SOC 2, ISO 27xxx - Advocate for “security by design” in all product features - Become well versed in Docker products and emerging AI technologies Visa sponsorship: Not available for this role. _______________________________________________________________________   COMPENSATION & EQUITY All full-time roles include equity. Final compensation is determined on factors including but not limited to experience, skills, qualifications, and location. Canada: CA$271,150 – CA$434,000 base United States: $194,150 – $312,950 base ______________________________________________________________________ POSTING INFORMATION - Open vacancy: This posting is for an existing open role. - AI in hiring: Docker may use AI-assisted tools during our recruiting process. - Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent. ______________________________________________________________________ PERKS & BENEFITS - Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration. - Flexibility that fits your life – We trust you to manage your schedule while delivering great work. - Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break. - Home office support – Set up your workspace for comfort and success. - Technology stipend – Equivalent to US$100 net per month to help support your work. - Learning & development – Annual stipend for conferences, courses, certifications, and continued learning. - Parental leave – 16 weeks of paid parental leave after six months of employment. - Equity for all full-time employees – Share in Docker's long-term success as we continue to grow. - Comprehensive benefits – Medical, retirement, and paid holidays vary by country. - Docker swag – Because representing the whale never gets old. Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community. #LI-REMOTE

Location: Remote - Costa Rica Founded in 2012, Bugcrowd is the preemptive security platform that unifies exposure discovery and assessment, offensive testing, and intelligence shaped by AI and human insight to help organizations avoid, discover, and validate real-world risk. Bugcrowd helps security teams move faster by identifying the exposures that matter most so they can act first and stay ahead of attackers. By combining the power of humans and AI, teams can preempt attack paths and prevent breaches. Based in San Francisco and New Hampshire, Bugcrowd is supported by General Catalyst, Rally Ventures, Costanoa Ventures, and others. Visit www.bugcrowd.com . Job Summary If you like owning problems end to end, making security a default property of everything we build, and working closely with engineering, we want to meet you. Bugcrowd is looking for security engineers who move beyond standard tooling and drive measurable security outcomes our customers can rely on. You will help us shape a culture where security helps others succeed, not just points out problems. Essential Duties and Responsibilities Partner Closely with Engineering : Refine architecture, validate new features, and drive security investment while prioritizing engineering velocity Build Security Paved Roads : Contribute to the secure defaults, libraries, and "paved roads" that systematically eradicate entire classes of vulnerabilities rather than fixing bugs one by one Create Feedback Loops : Tune security tooling such as SAST, DAST, SCA, and secret scanning to reduce noise and focus on what matters Be our Best Customer : Ensure our bug bounty program can be a model for other customers. Experiment with new ways to leverage the creativity of the crowd. Provide feedback on new platform features to engineering and product Own Projects End to End : Lead cross-functional product security projects from scoping through delivery, influencing product and engineering roadmaps and clearly communicating risk to both technical and non-technical stakeholders Amplify our Impact : Use code and automation as a lever to scale coverage and eliminate repetitive work. Build systems based on incentives and accountability rather than just bureaucratic process Education, Experience, Knowledge, Skills, and Abilities 3+ years of experience in product security, application security, or secure software development Can review code, automate tasks, and build security tooling in at least one modern programming language (e.g., Python, Go, Ruby, Java) Hands-on experience with core application security practices — threat modeling, secure code review, and automated testing (SAST, DAST, SCA) — and a solid grasp of common vulnerability classes (e.g., OWASP Top 10) Demonstrated ability to manage projects and influence cross-functional partners across engineering, DevOps, and product. Bachelor's degree in engineering, computer science or relevant field, or equivalent practical experience Bonus Points (Preferred but not required) Previous experience with Bug Bounty or vulnerability disclosure programs A background in building "paved roads" or secure-by-default internal libraries to eliminate entire classes of vulnerabilities Hands-on experience securing cloud-native platforms and Infrastructure as Code (e.g., Terraform, AWS, GCP, Kubernetes, Docker) Experience working within a fast-paced, high-growth security or SaaS company Working Conditions and Physical Requirements The ideal candidate must be able to complete all physical requirements of the job with or without reasonable accommodation. Sitting and / or standing - Must be able to remain in a stationary position 50% of the time Carrying and / or lifting - Must be able to carry / move laptop as needed throughout the work day. Environment - remote, work-from-home 100% of the time Culture At Bugcrowd, we understand that diversity in the workplace is vital to a company’s success and growth. We strive to make sure that people are included and have a sense of being part of making Bugcrowd not only a great product but a great place to work. We regularly hear from both customers and researchers that Bugcrowd feels like a family, and we strive to maintain that internally as well. Our team consists of a broad range of people: musicians, adventure sports junkies, nature lovers, parents, cereal enthusiasts, night owls, cyclists, artists—you get the point. At Bugcrowd, we are solving security threats and vulnerabilities that are relevant to everyone, therefore we believe solving these problems takes all kinds of backgrounds. We value the perspectives and experiences people from underrepresented backgrounds bring. Disclaimer This position has access to highly confidential, sensitive information relating to the technologies of Bugcrowd. It is essential that the applicant possess the requisite integrity to maintain the information in the strictest confidence. The company is authorized to obtain background checks for employment purposes under state and federal law. Background checks will be conducted for positions that involve access to confidential or proprietary information (including trade secrets). Background checks may include Social Security verification, prior employment verification, personal and professional references, educational verification, and criminal history. Applicants with conviction histories will not be excluded from consideration to the extent required by law. Any personal data you submit in connection with your application will be processed in compliance with Bugcrowd's Privacy Policy, which you may review here: https://www.bugcrowd.com/privacy . Equal Employment Opportunity: Bugcrowd is EOE, Disability/Age Employer. Individuals seeking employment at Bugcrowd are considered without regards to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, or sexual orientation. Bugcrowd is committed to the full inclusion of all qualified individuals. In keeping with our commitment, Bugcrowd will take the steps to assure that people with disabilities are provided reasonable accommodations. Accordingly, if reasonable accommodation is required to fully participate in the job application or interview process, to perform the essential functions of the position, and/or to receive all other benefits and privileges of employment, please contact HR at ADA at bugcrowd.com. Apply at: https://www.bugcrowd.com/about/careers/

Задачи: — проводить независимый обзор безопасности готовых технических решений перед их запуском — оценивать безопасность кода и архитектуры, права доступа AWS/IAM, интеграции OAuth (например, Gmail), pull-реквесты в GitHub, процессы резервного копирования и восстановления Требования: — опыт senior уровня в области облачной безопасности, AppSec или DevSecOps — подтверждённый опыт независимых обзоров с примерами кейсов — умение составлять понятные отчёты для нетехнических читателей — знание английского языка обязательно, русский приветствуется Условия: — удалённая работа — контрактная занятость Отмечено, что это только обзор, без разработки или исправления систем.

Задачи: — Формирование 12-месячного security roadmap; — Access & Device Security: IAM / RBAC, MFA / 2FA, VDI / Remote Desktop, MDM, шифрование; — Infrastructure & Business Continuity: сегментация и защита критической инфраструктуры, Disaster Recovery; — OPSEC & Communications: защита корпоративных каналов, контроль внешних доменов и digital footprint; — Monitoring & Incident Response: построение incident response процесса, SIEM / DLP, root-cause analysis; — OSINT & Data Leak Prevention: мониторинг утечек корпоративных данных, паролей и упоминаний; — Vendor Security & Compliance: оценка рисков сторонних сервисов, payment gateways, security awareness. Требования: — Опыт работы в Information Security от 5 до 8 лет; — Опыт от 2 лет в FinTech / Payments / iGaming или других high-risk направлениях; — Опыт построения security-функции с нуля; — Проживание за границей (строго за пределами РФ и РБ); — Практический опыт IAM / RBAC, MFA / 2FA и управления доступами; — Опыт разработки и внедрения security policies; — Опыт расследования реальных security-инцидентов и внедрения превентивных мер; — Понимание рисков платежного бизнеса (fraud, insider threats, API access, data leaks); — Опыт работы с безопасностью распределенных (distributed / remote) команд; — Понимание OSINT, OPSEC и digital footprint; — Умение быстро принимать решения и брать ответственность в кризисных ситуациях. Условия: — Полностью удаленный формат; — Конкурентная оплата (до $5,000 GROSS) с гибкостью в обсуждении финансовых условий; — Прямое подчинение CEO и влияние на стратегические решения; — Бюджет на security tools и инфраструктуру, а также возможность набрать свою команду; — Соцпакет: оплачиваемый отпуск, day off, больничные, emergency leave, курсы английского.

Location: Hong Kong, Hong Kong SAR Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more. About the Opportunity We are seeking a highly motivated Technology and Security Risk Manager within the Second Line of Defence (2LOD). You will be responsible for continuously refining and scaling the Technology and Security oversight program, guiding first-line of defence (1LOD) execution, and providing independent risk challenge. You will be a key member of OKX's Risk team, helping to shape and scale the firm’s 2LOD Security & Data Risk programs. You’ll work closely with stakeholders including Engineering, Product, Risk, Compliance and Internal Audit. You will play a key role in developing and implementing a comprehensive Technology and Security Risk Management program. This includes 2LOD oversight of technology defects, issues, and incidents, Risk and Control Self-Assessments (RCSA), key risk indicators (KRIs) and reporting. The ideal candidate has a strong understanding of Technology Risk (including Technology Resilience, Change Management, SDLC, CI/CD pipeline, and software quality assurance) and Cybersecurity (covering internal and external threat vectors, control weaknesses, and organisational cyber hygiene). We are looking for a candidate with a strong drive for improvement and career growth. What You’ll Be Doing Collaborate with internal stakeholders across the company to proactively identify, escalate, assess, and mitigate Technology and Security risks, ensuring adherence to the Technology Risk Policy. Providing oversight of Technology and Security Risk incidents and issues, and partnering with 1LOD stakeholders to enhance related processes and ensure effective oversight Lead the Technology Risk and Control Self-Assessment (RCSA) process from a 2LOD perspective, ensuring adherence to the ERM RCSA methodology, and providing effective challenge and oversight of 1LOD Security risks and controls. Support the Security Key Risk Indicators (KRIs) definition, monitoring, and reporting. Supporting the implementation and ongoing enhancement of Governance, Risk, and Compliance (GRC) systems to enable effective risk oversight Advocate and support the implementation of Risk Management frameworks for technology stakeholders, serving as a trusted advisor for the first line. Stay up to date on emerging trends and regulations in the digital asset space, proactively identifying and addressing new risk considerations. What We Look For In You 8+ years in information security, with a strong security architecture or technical security background; fintech, crypto or cloud-native experience preferred. Practical experience designing, implementing or reviewing cloud, IAM, cryptographic, network or application security controls. Experience in risk oversight, or readiness to transition, with the technical judgement to challenge controls and recommend proportionate improvements. Ability to threat-model systems and assess technical evidence, including architecture diagrams, IAM policies, logging configurations and dependencies. Working knowledge of cloud resilience, multi-region/AZ failover, RTO/RPO and disaster recovery testing. Familiarity with NIST CSF, ISO 27001, SOC 2 and relevant privacy requirements, including GDPR and PDPA, and their application to technical controls. Ability to independently assess and test controls, evaluate incidents and drive remediation with engineering and security teams; GRC platform experience desirable. Clear written and verbal communication, translating technical findings into prioritised actions for business stakeholders and governance committees. Strong stakeholder management skills, providing constructive challenge and collaborating across functions and geographies. A proactive, adaptable approach, with confidence taking ownership and improving practices in a fast-paced environment. A relevant degree or equivalent practical experience; CISSP, CCSP, cloud security/architecture, CISA or CISM qualifications desirable. Perks & Benefits Competitive total compensation package L&D programs and Education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Please note that Hong Kong is a group-level service hub, and OKX does not carry on a business of operating a virtual asset trading platform in Hong Kong . Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .

Location: Singapore, Singapore Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more. About the Opportunity We are seeking a highly motivated Technology and Security Risk Manager within the Second Line of Defence (2LOD). You will be responsible for continuously refining and scaling the Technology and Security oversight program, guiding first-line of defence (1LOD) execution, and providing independent risk challenge. You will be a key member of OKX's Risk team, helping to shape and scale the firm’s 2LOD Security & Data Risk programs. You’ll work closely with stakeholders including Engineering, Product, Risk, Compliance and Internal Audit. You will play a key role in developing and implementing a comprehensive Technology and Security Risk Management program. This includes 2LOD oversight of technology defects, issues, and incidents, Risk and Control Self-Assessments (RCSA), key risk indicators (KRIs) and reporting. The ideal candidate has a strong understanding of Technology Risk (including Technology Resilience, Change Management, SDLC, CI/CD pipeline, and software quality assurance) and Cybersecurity (covering internal and external threat vectors, control weaknesses, and organisational cyber hygiene). We are looking for a candidate with a strong drive for improvement and career growth. What You’ll Be Doing Collaborate with internal stakeholders across the company to proactively identify, escalate, assess, and mitigate Technology and Security risks, ensuring adherence to the Technology Risk Policy. Providing oversight of Technology and Security Risk incidents and issues, and partnering with 1LOD stakeholders to enhance related processes and ensure effective oversight Lead the Technology Risk and Control Self-Assessment (RCSA) process from a 2LOD perspective, ensuring adherence to the ERM RCSA methodology, and providing effective challenge and oversight of 1LOD Security risks and controls. Support the Security Key Risk Indicators (KRIs) definition, monitoring, and reporting. Supporting the implementation and ongoing enhancement of Governance, Risk, and Compliance (GRC) systems to enable effective risk oversight Advocate and support the implementation of Risk Management frameworks for technology stakeholders, serving as a trusted advisor for the first line. Stay up to date on emerging trends and regulations in the digital asset space, proactively identifying and addressing new risk considerations. What We Look For In You 8+ years in information security, with a strong security architecture or technical security background; fintech, crypto or cloud-native experience preferred. Practical experience designing, implementing or reviewing cloud, IAM, cryptographic, network or application security controls. Experience in risk oversight, or readiness to transition, with the technical judgement to challenge controls and recommend proportionate improvements. Ability to threat-model systems and assess technical evidence, including architecture diagrams, IAM policies, logging configurations and dependencies. Working knowledge of cloud resilience, multi-region/AZ failover, RTO/RPO and disaster recovery testing. Familiarity with NIST CSF, ISO 27001, SOC 2 and relevant privacy requirements, including GDPR and PDPA, and their application to technical controls. Ability to independently assess and test controls, evaluate incidents and drive remediation with engineering and security teams; GRC platform experience desirable. Clear written and verbal communication, translating technical findings into prioritised actions for business stakeholders and governance committees. Strong stakeholder management skills, providing constructive challenge and collaborating across functions and geographies. A proactive, adaptable approach, with confidence taking ownership and improving practices in a fast-paced environment. A relevant degree or equivalent practical experience; CISSP, CCSP, cloud security/architecture, CISA or CISM qualifications desirable. Perks & Benefits Competitive total compensation package L&D programs and Education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .