Вакансии

Location: EMEA About the team The Security Team is responsible for providing key security capabilities covering application, cloud and enterprise security, incident response, detection and GRC. Our team is looking for an experienced, hands-on security practitioner, who will drive the adoption of modern security processes and tooling, with focus on supporting our engineering and product teams in improving the security posture of our platforms and services. What you will do: - Identify security gaps and vulnerabilities in all ClickHouse offerings triage a wide range of vulnerabilities reported via our bug bounty program, responsible disclosure, GitHub Issues covering web, API and server - client assets including low level memory issues like heap or buffer overflows - Improve and develop security assurance activities - pentests, vulnerability assessments, bug bounty programs, fuzzing - Plan and execute internal red team assessments and penetration tests against ClickHouse infrastructure, cloud environments, designing realistic adversary scenarios to test detection, response and control effectiveness - Assess AI/LLM-specific attack surface across ClickHouse's own AI-powered features and internal AI tooling, including prompt injection, model/data exfiltration, and unsafe agentic tool-use patterns - Build and operate agentic tooling for reconnaissance, exploit-chaining and attack-path discovery, and apply LLM-assisted fuzzing to accelerate vulnerability discovery across ClickHouse's products and infrastructure - Partner with detection engineering to validate and improve detection coverage during red team exercises, measuring and reporting on control effectiveness and time to detect/respond - Handle information security events and incidents across ClickHouse products and services - Develop processes, tooling and automation to scale security processes and mitigate risks to the business What you bring along: - 7+ years of experience in pentesting, red teaming and product security - Experience supporting engineering and product implementation efforts by performing threat assessments, assurance activities, advisory as well as, in some cases, implementation work across distributed systems covering web, API, client/server assets - Hands-on experience conducting offensive security engagements - internal red teaming, penetration testing and adversary simulation - across cloud, network and application environments - Ability to design adversary scenarios grounded in real threat intelligence (e.g. ransomware operators, supply chain attackers, insider threat) tailored to ClickHouse's risk profile as a multi-tenant cloud data platform - Strong written and verbal communication skills, with ability to translate attack chains into clear, actionable findings for engineering and leadership - Experience building or adapting agentic and LLM-assisted tooling for offensive security use cases (recon automation, exploit chaining, fuzzing harnesses), with judgment on where AI genuinely speeds up an engagement versus adds noise - Familiarity with AI/LLM-specific vulnerability classes and testing methodology - Strong knowledge of and experience with one or more cloud service providers (e.g. AWS, GCP, Azure), Kubernetes, Cilium - Experience implementing and operating engineering security tools and processes (e.g. static / dynamic code analysis, software composition analysis, SBOM, OWASP SAMM, client and network fuzzing tools) - Security as code mindset, with focus on solving problems with automation and scale in mind Bonus Points: - BS, MS, or PhD in Computer Science or related field - Previous contributions to open source projects - Security or cloud related certifications (AWS, GCP, Azure) - Previous experience in using AI security harnesses for pentesting purposes - Experience building or operating internal red team tooling and infrastructure from scratch, rather than relying solely on off-the-shelf frameworks - Offensive security certifications (e.g. OSCP, OSCE, OSEP, OSWE) PERKS - Flexible work environment - ClickHouse is a globally distributed company and remote-friendly. We currently operate in over 25 countries. - Healthcare - Employer contributions towards your healthcare. - Equity in the company - Every new eligible team member who joins our company receives equity. - Time off - Flexible time off in the US, generous entitlement in other countries. - A USD$500 Home office setup if you’re a remote employee. - Global Gatherings – We believe in the power of in-person connection and offer opportunities to engage with colleagues at company-wide offsites. CULTURE - WE ALL SHAPE IT As part of a rapidly scaling start-up, you will be instrumental in shaping our culture. Are you interested in finding out more about our culture? Learn more about our values here https://clickhouse.com/company/careers. Check out our blog posts https://clickhouse.com/blog or follow us on LinkedIn https://www.linkedin.com/company/clickhouseinc/life/0c1ee7f4-2129-488d-b413-e7f6270659fd/?viewAsMember=true to find out more about what’s happening at ClickHouse. EQUAL OPPORTUNITY & PRIVACY ClickHouse provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any type based on factors such as race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. Please see here https://clickhouse.com/legal/applicant-privacy-notice for our Privacy Statement.

Location: Hong Kong SAR; Kuala Lumpur, Malaysia About Us Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance. Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution. Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services. Job responsibilities Red-blue confrontation drill Responsible for developing and executing penetration testing, red-blue confrontation, and practical attack and defense drills that simulate real attack scenarios, identifying potential security risks in enterprise networks, applications, cloud environments, work networks, and core business systems. Lead or participate in red-blue confrontation exercises to evaluate the defense team's ability in attack detection, alarm analysis, traceability analysis, emergency response, and recovery. Based on the real attack chain design exercise scenario, covering extranet breakthrough, web vulnerability exploitation, phishing entrance, privilege escalation, lateral movement, Data Discovery, privilege maintenance, and defense bypass stages. Combining the attack review results, promote the continuous optimization of security detection rules, response processes, asset governance, and security base lines. Attack Surface Analysis and Threat Research Identify enterprise network exposure, internet assets, cloud assets, APIs, supply chain components, and third-party access risks, evaluate attack paths, and provide mitigation recommendations. Monitor and collect threat intelligence, track vulnerability exploitation trends, APT attack methods, red team toolchain changes, and apply them to enterprise attack and defense exercises. Combining business scenarios to model attack paths and discover feasible attack chains from external exposure surfaces to core assets. Tracking AI-related security risks, including security issues in large-scale model applications, RAG systems, Agent systems, plug-in/tool calls, MCP services, AI code generation, and automated workflows. AI Security and Large Model Attack and Defense Responsible for the security evaluation of AI applications, intelligent agent systems, RAG Knowledge Base, AI Agent toolchain and model services within the enterprise. Research and verify large-scale model-related attack techniques, including Prompt Injection, Jailbreak, Indirect Prompt Injection, data leakage, unauthorized tool invocation, security risks caused by model illusions, RAG poisoning, vector library pollution, sensitive information leakage, etc. Design AI red team test cases and evaluation framework, and conduct security verification on model input and output, context isolation, permission control, tool call chain, and data access boundary. Participate in the construction of AI security protection plan, including prompt word security policy, content security detection, tool call permission constraints, sensitive data desensitization, audit tracking, Agent sandbox isolation and security evaluation benchmark construction. Explore the application of AI in red team automation, vulnerability analysis, attack path planning, PoC verification, and report generation, and promote the platformization, automation, and intelligence of attack and defense capabilities. Tool and platform development Develop and optimize Red Team-specific tools and scripts for vulnerability mining, information collection, privilege escalation, lateral movement, credential analysis, traffic disguise, defense bypass, and automated report generation. Study and validate new attack techniques, and simulate real threats in combination with enterprise business scenarios. Build or participate in the construction of automated security evaluation platform, integrated vulnerability scanning, audio fingerprint recognition, asset mapping, PoC verification, attack path analysis, AI Agent arrangement and other capabilities. Combining LLM/Agent technology to explore automated penetration testing, intelligent vulnerability verification, code security auditing, and red team task scheduling. Security evaluation and reporting Conduct security evaluations on critical business systems, internal networks, cloud environments, work end points, API services, and AI applications, and output detailed technical reports, attack paths, impact analysis, and repair recommendations. Output AI security evaluation reports for AI applications, including attack examples, risk levels, exploitable paths, data leakage risks, permission boundary issues, and governance recommendations. Assist in improving enterprise security protection mechanisms, promote optimization of WAF, EDR, SIEM, NDR, HIDS, zero trust, identity permissions, and log auditing capabilities. Transform attack and defense discovery into security detection rules, base line specifications, develop security requirements, and continuous governance mechanisms. XFN collaboration Collaborate with the blue team, security operation, infrastructure, R & D, algorithm, data, and business teams to complete attack review, vulnerability repair, detection rule optimization, and security capability building. Provide security support to other departments of the enterprise, including emergency response drills, development security consulting, AI application pre-launch security review, and security training. Participate in the security design review of AI applications and security products, and promote the advance of security capabilities in R & D, testing, and Pushonline. Job requirements Basic skills Proficient in basic knowledge of cyber security, including TCP/IP protocol, network architecture, identity authentication, access control, principles and configurations of common security devices. Proficient in common attack techniques and red team toolchains, such as Sliver, Cobalt Strike, NPS, Burp Suite, Metasploit, Nmap, Masscan, Frida, Impacket, etc. Familiar with mainstream operating systems Windows, Linux, macOS security mechanism, log system, permission model and common use. Familiar with common web frameworks, API architectures, microservice structures, containers, and security risks in Kubernetes environments. Offensive and defensive technical capabilities Proficient in penetration testing and red team processes, including information collection, vulnerability scanning, vulnerability exploitation, intranet penetration, privilege escalation, lateral movement, privilege maintenance, Data Discovery, and trace cleaning. Familiar with the working principles and adversarial methods of enterprise-level security products, including WAF, EDR, SIEM, NDR, HIDS, zero-trust gateway, bastion host, and identity authentication system. Possess independent vulnerability analysis and PoC writing capabilities, able to reproduce, verify, and assess the impact of public vulnerabilities and 0day/1day risks. Proficient in one or more programming/scripting languages, such as Python, Go, Bash, PowerShell, JavaScript, etc., with experience in tool development and automation platform construction. AI security capabilities Familiar with the basic architecture of large-scale model applications, familiar with technical forms such as Prompt, RAG, Embedding, vector databases, Agent, Function Calling, MCP, and plugin systems. Understand or practice AI security testing methods, including Prompt Injection, Jailbreak, RAG data poisoning, sensitive information leakage, unauthorized tool invocation, model output security, Agent permission escape, etc. Able to design security test cases for AI applications, evaluate model input/output, context isolation, data boundaries, permission control, and tool invocation chain risks. Experience in using AI to assist security work, including vulnerability analysis, code auditing, intelligence analysis, attack path planning, report generation, or automated testing. Familiar with AI application security governance ideas, including model call auditing, prompt word security, sensitive data protection, content security detection, permission minimization, and sandbox isolation. Experience requirements More than 5 years of experience in red team, penetration testing, security research, or offensive and defensive exercises. Candidates with experience in large-scale enterprise attack and defense drills, red-blue confrontation, HW/major support, cloud attack and defense, or intranet penetration are preferred. Candidates with experience in AI security, large-scale model security, intelligent agent security, automated penetration testing platform or security tool platform construction are preferred. Familiar with enterprise security construction system, able to promote defense capability, detection capability, and governance process optimization from an attack perspective. Other capabilities Priority will be given to those who hold security-related certifications such as ♀ P, OSCE, CISSP, CISP, CEH, CISSP, CCSP, etc. Possess strong document writing and expression abilities, able to output high-quality technical reports, review documents, attack chain analysis, and security construction plans. Possess good problem analysis ability, learning ability, teamwork ability, and stress resistance. Be sensitive to new technologies, new Attack Surfaces, and new tools, and be able to proactively research and share internally. Bonus points Familiar with Cloud Computing Platform security and cloud attack and defense technologies, such as AWS, Azure, GCP, Tencent Cloud, Alibaba Cloud, etc. Familiar with Kubernetes, containers, Service Mesh, CI/CD, DevSecOps and supply chain security. Possess experience in zero trust, secure operation, threat hunting, Attack Surface management, and vulnerability management platform construction. Familiar with MCP Server, AI Agent framework, RAG system, vector database, LLM API gateway, model security evaluation framework. Experience in Automated Red Team, AI Penetration Testing, Intelligent Vulnerability Verification, Agent Orchestration, Security Knowledge Base or Security RAG System Construction. Experience in vulnerability submission, CVE, technical articles, open source projects, topic sharing, or tool release in the security community. Familiar with security frameworks such as MITRE ATT & CK, OWASP Top 10, OWASP LLM Top 10, NIST AI RMF, etc. Why Join Us At Bybit, we are committed to fostering a supportive and enriching work environment. Our benefits include: - Study Growth Fund: We support your professional development and continuous learning. - Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation. - Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world. - Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company. - Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.

Location: Remote, Global ABOUT SUPABASE Supabase is the Postgres development platform, built by developers for developers. We provide a complete backend solution including Database, Auth, Storage, Edge Functions, Realtime, and Vector Search. All services are deeply integrated and designed for growth. ABOUT THE ROLE We are hiring a AI Platform Engineer to build the execution layer for Supabase's internal AI systems. Supabase is building an AI-native internal operating system: a common way of working across the company where AI carries a meaningful share of the operational load rather than sitting alongside it as an assistant. We are standing up a new central team to build those systems, enable the teams, and embed AI operations throughout the organization. You are the engineer on that team. The execution layer is yours. You will build the platform that actually runs agents: an event-triggered queue, a headless model-agnostic runtime, durable state so work survives a restart, a human review gate, atomic rollback, and full logging of every prompt, tool call and decision so any run can be reconstructed. You will build the evaluation layer that makes any of it trustworthy, because an agent that cannot be measured cannot be trusted with anything beyond reading. And you will build the agents themselves, across everything from executive reporting down to a layer of agents that watch the platform and improve it. This is a governance-heavy environment by design, and that is the interesting part of the problem. Agents are risk-tiered from read-only internal data through to external-facing output, with review depth, evaluation requirements and human approval scaling by tier. Some capabilities are permanently off limits: an agent may read and report, it may carry a human-authored update into a system of record once a human consents, and it may initiate contact within a strict budget, but it may never autonomously write a commitment (an owner, a due date, a status) into a shared work system. Your job is to make that structurally impossible rather than merely forbidden. You will be the only engineer on this platform. You will close open architecture decisions yourself, own the infrastructure end to end, and instrument the system so it reports its own return. WHAT YOU'LL BE RESPONSIBLE FOR In this role, you'll: - Ship the agent platform to production. An event-triggered queue, a headless model-agnostic runtime (choosing the runtime is an open decision you will close), durable state that survives a failed run, a human review gate, atomic rollback, and complete run logging in the warehouse. - Own the evaluation layer, and switch on the gate that depends on it. Golden suites with behavioral assertions rather than intuition, judge criteria with a written rubric, safety cases that must pass on every run, and a CI gate that blocks a regression from merging. This is the precondition for every agent that does anything beyond read internal data. - Build and register the agent portfolio. Reporting, drafting, linting, triage and question-answering agents across the executive, team-lead and individual-contributor layers, plus a meta layer that observes the platform and improves it. - Enforce governance in code. Risk tiers the pipeline actually enforces, least-privilege credentials per agent, tool-permission gates, a decision audit log, and autonomy classes where the dangerous class has no code path rather than a warning label. Nothing runs without a registered owner, tier, tool grant and human gate. - Design how the system contacts people. A hard interruption budget per person, message bundling instead of a stream of pings, and a structure that gives something useful before it asks for anything. Adoption depends on this more than on any other single design choice. - Own the platform tooling. The compiler and validator, inventory integrity, and the paths that distribute context and capabilities into the repositories and chat surfaces where work happens. - Compute the operating measures from production data. A pipeline from raw system activity through to a computed maturity grade per team, defensible enough that a team can dispute the result and be answered with the query rather than an opinion. - Instrument the platform's own return. A ledger that logs the work each agent absorbs and computes the monthly figure, so the value of the system is a measurement rather than a claim. HOW YOU'LL THINK RECURSIVE THINKING You build the generator, not the artifact. When you need thirty agents, you do not write thirty agents; you build the inventory, the compiler and the distribution path that makes the thirty-first cost an afternoon, then a meta layer whose job is to watch the platform, find its drift and file the fix. The evaluation layer is the same move applied to trust. You are not checking whether one agent is correct today. You are building the machine that decides whether every future agent is allowed to ship, which means the suite has to be right in a way the agent does not, and the thing that grades has to be graded too. INVERSION THINKING You start from the failure and work backward to the design. The rule is that an agent may never autonomously write a commitment into a shared work system. The weak implementation is an instruction in a prompt. The strong one is that the credential in the agent's tool grant physically cannot set an owner, a due date or a status, so no amount of clever input, prompt injection or model error produces the forbidden write. You reach for the second one first. Same for evaluation. Before writing a suite you enumerate how the agent can be wrong: an update that invents progress that did not happen, one that quotes a private channel into a public digest, one that is accurate and reads as an accusation, one that credits the wrong person. Then the suite is that list, each case caught before the agent ships rather than after it embarrasses someone. AI-NATIVE EXECUTION You use agentic tools on real work, in files and repositories, with the same rigor you apply to anything else you ship. You have a setup of your own and can describe it mechanically: what triggers it, what it is allowed to touch, where the human approves, what it logs, and how you found out the one time it went wrong. That experience is this job, generalized. You are building for async engineers across 40+ countries who will judge the platform by whether it saves them an hour or costs them one, so you are your own first user and your own harshest reviewer. YOU MIGHT BE A GOOD FIT IF YOU MUST HAVE - Have shipped production LLM agent systems that other people depended on. Not demos, not internal showcases. Systems with operational history, real users and at least one incident you can talk through. Prompt engineering on its own does not clear this bar. - Design evaluations, not spot checks. You build golden sets, write behavioral assertions, define judge rubrics, set pass thresholds and gate CI on the result. You can explain why "we reviewed a bunch of outputs and they looked good" is not evaluation. - Have done deep API work against the systems work actually lives in, and have authored MCP servers. You know the specific failure modes of those APIs, not just that they exist. - Own infrastructure end to end in Python on GCP, with a cloud warehouse and infrastructure as code. You provision, deploy, monitor and roll back your own systems, and you close architecture decisions rather than routing them onward. - Have taste about how software contacts humans. You treat every notification as spending a limited amount of trust. STRONG SIGNAL - Public work in this space. An open-source agent framework, an MCP server, an evaluation harness, or writing on agent reliability that other practitioners cite. - LLM observability and cost instrumentation. Tracing agent runs, attributing spend per run, and building the queries that turn raw logs into a report someone acts on. - You have built an internal platform that non-engineers adopted voluntarily, and can describe what you changed after watching them use it. WHAT SUCCESS LOOKS LIKE - The platform is boring. Agents run on a schedule and on events, state survives restarts, failed runs roll back cleanly, and every run can be reconstructed from its log. - Nothing ships unevaluated. Every registered agent has a real suite with safety cases, the gate blocks regressions, and when someone challenges an output the answer is a test case rather than an argument. - The dangerous action is impossible, not discouraged. An audit of any agent's credentials shows it cannot perform the writes it is not allowed to perform, and the audit log makes every consequential decision traceable. - Teams pull the platform instead of being pushed. Agents get adopted because the reports are useful and the contact is rare and well-timed, and each team ends up with at least one workflow that runs automatically. - The platform reports its own value. The work absorbed is measured and published, so the case for expanding it is made with data rather than enthusiasm. WHAT WE OFFER - Fully Remote We hire globally. We believe you can do your best work from anywhere. There are no Supabase offices, but we provide a WeWork membership or co-working allowance you can use anywhere in the world. - ESOP Every team member receives ESOP (equity ownership) in the company. We want everyone to share in the upside of what we’re building together. - Tech Allowance Use this budget to set up your ideal work environment—laptop, monitor, headphones, or whatever helps you do your best work. - Health Benefits Supabase covers 100% of health insurance for employees and 80% for dependents, wherever you are. Your wellbeing and your family’s health are important to us. - Annual Off-Sites Once a year, the entire company gathers in a new city for a week of connection, collaboration, and fun. It’s a highlight of our year. - Flexible Work We operate asynchronously and trust you to manage your own time. You know what needs to be done and when. - Professional Development Every team member receives an annual education allowance to spend on learning—courses, books, conferences, or anything that supports your growth. ABOUT THE TEAM Supabase was born-remote and open-source-first. We believe our globally distributed team is our secret weapon in building tools developers love. - ~400 team members - 60+ countries - 20+ languages spoken - Over $1B raised (including our $500M Series F) - 540,000+ community members We move fast, build in public, and use what we ship. If it’s in your project, we probably use it in ours too. We believe deeply in the open-source ecosystem and strive to support—not replace—existing tools and communities.

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock human performance. WHOOP empowers members to perform at a higher level through a deeper understanding of their bodies and daily lives. By delivering actionable insights and innovative hardware, WHOOP helps members achieve their goals and push the boundaries of human potential. As a Mechanical Engineer on the Hardware Advanced Development Team at WHOOP, you will contribute to the design and development of WHOOP’s innovative hardware solutions. You will push the boundaries of technology by driving product innovation from conceptual prototypes to manufacturing-ready designs. You’ll work alongside a multidisciplinary team of engineers and designers to help bring innovative concepts to life, supporting prototyping, mechanical design, and testing efforts. This is a great opportunity for an engineer with a solid technical foundation to grow their skills in a dynamic, fast-paced environment while contributing to impactful projects in early-stage product development. RESPONSIBILITIES: - Contribute to mechanical design and development of early-stage projects to shape the future of WHOOP hardware. - Design, prototype, and test complex mechanical components around microelectronics, meeting stringent technical, performance, and industrial design requirements to guide projects from concept through manufacturing release. - Develop and present multiple design solutions for novel and complex technical challenges, articulating them clearly to cross-functional teams and documenting design process and specifications thoroughly. - Support the design and execution of comprehensive testing and validation plans, employing advanced design of experiments (DOE) methodologies to drive understanding, uncover insights, and deliver actionable results that enhance product quality, performance, and manufacturability. - Partner with the Hardware Product Team to lead engineering evaluation of new technologies, addressing risks that build confidence in NPI readiness. - Operate and maintain in-house prototyping tools, including 3D printers and CNC machines, to create proof-of-concept prototypes and support early-stage development. - Collaborate with senior engineers to evaluate new technologies and manufacturing methods. - Up to 10% travel to contract manufacturers and suppliers. QUALIFICATIONS: - Bachelor’s degree in Mechanical Engineering or related field. - 0-3 years of experience in the design of complex mechanical products, preferably for consumer electronics, wearables, or medical devices. - Experience with SolidWorks, or transferable CAD program - Hands-on experience with rapid prototyping tools to craft proof-of-concept models. - Strong communication skills and comfort working on cross-functional teams. - Working understanding of SolidWorks best practices, including advanced assemblies, surfacing, configuration management and applying DFx feedback. - Familiarity with validation testing methods and statistical analysis tools. - Experience with high-volume manufacturing processes (e.g., injection molding, sheet metal design, metal injection molding) and manual assembly. - Prior experience in high-quality consumer electronics or wearable technologies is preferred. This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.   Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply.   WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/ to determine employment eligibility. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.   The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values.   At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success.   The U.S. base salary range for this full-time position is $90,000 - $130,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.   In addition to the base salary, the successful candidate will also receive benefits and a generous equity package.   These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Location: Remote Canada At Affirm, we exist for the moments that matter—giving people a clear, predictable way to pay over time, with no hidden fees, no surprises, and no tradeoffs on what matters most. About the InfoSec & IT Team The Application Security team helps Affirm build and launch products that earn customer trust, meet compliance obligations, and reduce business risk. We partner closely with product, engineering, infrastructure, risk, compliance, and other teams to identify security risks early, recommend pragmatic mitigations, and help teams find safe paths to launch. We are looking for an early-career Application Security Engineer who is curious, collaborative, and comfortable working with code. You will help assess application risks, support vulnerability management efforts, partner with engineering teams on secure design decisions, and contribute lightweight tooling, automation, and code-informed analysis that helps AppSec scale across Affirm. This role is a great fit for someone who has hands-on software or security experience, enjoys reading and reasoning about code, is actively developing offensive security skills, and wants to apply those skills in a product-minded, risk-based way. What You'll Do Partner with product and engineering teams to identify application security risks and help frame them as clear business risks, launch options, and recommended next steps. Read application code, configuration, pull requests, logs, and documentation to understand how systems work and where security risks may exist. Contribute small code changes, scripts, detections, tests, secure defaults, or automation that improve AppSec workflows and reduce recurring issues. Work in GitHub to review code changes, understand engineering context, participate in pull request discussions, track remediation work, and collaborate with engineers. Help evaluate vulnerabilities from internal testing, bug bounty reports, security tooling, penetration tests, and other sources; partner with teams to prioritize and remediate issues based on real-world risk. Contribute to vulnerability management workflows, including triage, validation, severity assessment, remediation guidance, tracking, and reporting. Translate recurring security findings into repeatable mechanisms such as secure coding guidance, checklists, paved paths, lightweight automation, detection logic, reusable review patterns, or developer-facing documentation. Work with engineers to understand system designs, data flows, trust boundaries, authentication and authorization models, code paths, and potential abuse cases. Communicate security issues clearly to both technical and non-technical audiences, including the risk, tradeoffs, recommended mitigations, and residual risk. Build strong relationships across Affirm teams and influence security outcomes without relying on formal authority. Help connect AppSec work to customer trust, regulatory/compliance expectations, operational resilience, and business outcomes. Continue developing hands-on offensive, defensive, and software engineering skills through practical work, labs, tooling, research, certifications, or contributions to internal security programs. What We Look For 4+ years of experience in application security, software engineering, security engineering, vulnerability management, penetration testing, security operations, or equivalent practical experience. Foundational programming ability in one or more languages such as Python, JavaScript/TypeScript, Kotlin, or similar. Comfort reading, navigating, and reasoning about code, even in unfamiliar codebases. Experience using Git and GitHub or similar version-control workflows, including branches, commits, pull requests, code review, issues, or project tracking. Some hands-on experience building, testing, breaking, or securing software. This could include professional experience, internships, security labs, CTFs, bug bounty work, open-source contributions, personal projects, automation scripts, internal tools, or coursework. Ability to write clear, maintainable scripts or small programs to solve practical problems, automate manual workflows, analyze data, validate findings, or improve security processes. Foundational understanding of common web, API, mobile, cloud, and application security risks, such as OWASP Top 10 issues, authentication and authorization flaws, injection, insecure design, secrets exposure, dependency risks, and data protection concerns. Interest in offensive security, such as studying for or completing security certifications, practicing web/API testing, learning exploit development fundamentals, using tools like Burp Suite, or participating in labs and capture-the-flag environments. Exposure to vulnerability management concepts, including triage, severity assessment, remediation tracking, false-positive analysis, compensating controls, and risk-based prioritization. Ability to reason about risk and tradeoffs, not just identify issues. You can explain what could go wrong, how likely it is, what impact it may have, and what options exist to reduce risk. Strong product and engineering empathy. You seek to understand launch goals, technical constraints, user impact, and business priorities before recommending a path forward. Clear written and verbal communication skills, including the ability to explain security findings in practical, actionable terms. A collaborative mindset and comfort working across product, engineering, compliance, risk, infrastructure, and security teams. Curiosity, humility, and a growth mindset. You proactively seek feedback, ask good questions, and continue building your technical depth. Secure-by-design judgment, including the ability to spot patterns, recommend simple controls, and balance launch velocity with meaningful risk reduction. Base Pay Grade - L Equity Grade - 5 Employees new to Affirm typically come in at the start of the pay range. Affirm focuses on providing a simple and transparent pay structure which is based on a variety of factors, including location, experience and job-related skills. Base pay is part of a total compensation package that may include monthly stipends for health, wellness and tech spending, and benefits (including 100% subsidized medical coverage, dental and vision for you and your dependents). In addition, the employees may be eligible for equity rewards offered by Affirm Holdings, Inc. (parent company). CAN base pay range per year: CAD $133,000 - $183,000 Location - Remote Canada This remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan. #LI-Remote Remote-first with flexibility built in Affirm is proud to be a remote-first company. Most roles can be done from almost anywhere within the country of employment. Some positions may occasionally require in-person work at an Affirm office, and a few are office-based due to the nature of the work. All new hires will be invited to attend an in-person onboarding experience. Benefits designed for you Our benefits reflect our commitment to care, transparency, and flexibility. Here are a few highlights: Health coverage at no cost: We cover 100% of premiums for employees and their dependents. Spending stipends: Monthly stipends support your tech setup, and the ability to choose health and wellness options that are right for you. Time off to recharge: Flexible time off and generous holiday calendars help you rest when you need to. Own a piece of what you build: Our employee stock purchase plan (ESPP) lets you buy Affirm stock at a discount. We’re committed to providing an inclusive interview process, including accommodations for candidates with disabilities. If you need support, we’re happy to help. For positions based in San Francisco or Los Angeles: Affirm considers qualified applicants with arrest and conviction records, as required by law. By clicking "Submit Application," you acknowledge that you have read Affirm's Global Candidate Privacy Notice and consent to the use of your personal information as described.

Задачи: - Разрабатывать и поддерживать высоконагруженный бэкенд корпоративного портала на Python и FastAPI (async/await, dependency injection, middleware); - Проектировать схемы и работать с PostgreSQL (SQL) и MongoDB (NoSQL), а также с объектными хранилищами (S3). Интегрировать локальные LLM, работать с векторным хранилищем Qdrant и поисковым движком OpenSearch; - Настраивать инструменты наблюдаемости (OTEL, Jaeger, Prometheus, Grafana) для отладки распределённых систем. Работать с Docker, Nginx, настраивать CI/CD пайплайны в GitLab; - Проектировать отказоустойчивые API, участвовать в Code Review, поддерживать высокий стандарт качества кода. Требования: - Ключевой стек: Python, FastAPI, PostgreSQL, MongoDB, AI/LLM, Qdrant; - Core: глубокое знание Python и фреймворка FastAPI: async/await, dependency injection, middleware; - Базы данных: опыт проектирования схем и работы с PostgreSQL, SQL и MongoDB NoSQL, знание объектных хранилищ S3; - AI & Search: опыт интеграции локальных LLM, работы с векторными хранилищами Qdrant и поисковыми движками OpenSearch; - Наблюдаемость: опыт настройки и использования инструментов мониторинга OTEL, Jaeger, Prometheus, Grafana для отладки распределённых систем; - DevOps: уверенная работа с Docker, Nginx, настройка CI/CD пайплайнов в GitLab; - Уровень: Middle от 3 лет, Senior от 5 лет; умение проектировать отказоустойчивые API.

Location: Global Anywhere Who We Are: Alpaca is a US-headquartered, global leader in agent-first brokerage infrastructure for stocks, ETFs, options, crypto, fixed income, 24/5 trading, and more. Amongst our subsidiaries, Alpaca is a licensed financial services company, serving hundreds of financial institutions across 40 countries with our institutional-grade APIs. This includes broker-dealers, investment advisors, wealth managers, hedge funds, and crypto exchanges, totalling over 10 million brokerage accounts. Our global team is a diverse group of experienced engineers, traders, and brokerage professionals who are working to achieve our mission of opening financial services to everyone on the planet. We're deeply committed to open-source contributions and fostering a vibrant community, continuously enhancing our award-winning, developer-friendly API and the robust infrastructure behind it. Alpaca is proudly backed by $400 million in funding from top-tier global investors including Portage Ventures, Spark Capital, Tribe Capital, Social Leverage, Horizons Ventures, Opera Tech Ventures, SBI Group, Derayah Financial, Unbound, Peak XV, Elefund, and Y Combinator. Our Team Members: We're a dynamic team of 400+ globally distributed members who thrive working from our favorite places around the world, with teammates spanning the USA, Canada, Japan, Hungary, Nigeria, Brazil, the UK, and beyond! We're searching for passionate individuals eager to contribute to Alpaca's rapid growth. If you align with our core values—Stay Curious, Have Empathy, and Be Accountable—and are ready to make a significant impact, we encourage you to apply. Your Role As a Senior Software Engineer on the Platform team, you will build and own the frameworks, tooling, and CI/CD infrastructure that let Alpaca’s engineers ship new features quickly and reliably. This is a software engineering role at its core: you will spend most of your time writing Go, designing automated test frameworks, and digging into application code and Kubernetes when needed. Just as importantly, you will help redefine how we use AI to raise the bar on quality - leveraging LLMs and AI-driven tooling to generate tests, catch regressions before they ship, and turn every incident into durable, automated coverage. We are looking for engineers who treat quality as an engineering discipline and see AI as a force multiplier for it - people who build the systems that make testing fast, reliable, and effortless for the teams that depend on them. Things You Get To Do Design and build automated test frameworks across our REST and gRPC API surface. Leverage AI and LLM-based tooling to accelerate test generation, harden regression coverage, and turn production incidents into automated tests - embedding these practices into the frameworks the whole engineering org relies on. Build and maintain CI/CD pipelines - we use a mix of GitHub Actions and Google Cloud Build. Design and execute load, stress, and scalability tests to ensure our platform can handle growing demand. Introduce chaos engineering practices - designing fault-injection and resilience experiments that surface failure modes before our customers do. Standardize tooling and infrastructure to improve the day-to-day developer experience. Partner with other teams to raise test coverage, reliability, and speed across services. Dig into application code to root-cause failures and drive fixes to completion. Mentor and guide product engineers, fostering a culture of quality and continuous improvement. Who You Are (Must-Haves) You have 5+ years of experience as a software engineer building and maintaining production systems. You have written code in strongly typed languages and have at least 1 year of experience with Go. You are fluent with AI-assisted engineering - you actively use LLM-based tools in your workflow and have a clear point of view on where they elevate quality (and where they don’t). You have built and maintained CI pipelines before - ideally with GitHub Actions or Google Cloud Build. You have designed and built automated test frameworks, and you understand the challenges microservices pose for reliable integration and end-to-end testing. You are familiar with Kubernetes beyond the basics - you can write a Helm chart for a new service with relative ease, you understand best practices around security, and you have prior job experience or certifications to prove this. You have worked at a startup before - you understand that things don’t always go according to plan, that there is significant technical debt, that some tasks just need to be done, and that sometimes there are no processes or documentation to guide your hand. You are not afraid of taking a task from start to finish - gathering requirements, figuring out and implementing the best technical solution, then deploying and monitoring the results. Who You Might Be (Bonus Points) You have used AI/LLM tooling to build QA automation - test generation, flaky-test triage, or incident-to-regression pipelines - and can speak to what worked and what didn’t. You have written code in Python or TypeScript, and can build efficient Dockerfiles and secure container images. You have implemented load tests with k6 (REST) and ghz (gRPC) and have experience analyzing pprof/trace output. You have done IaC deployments with Argo CD or Terraform, or have used Google Cloud Platform and Google Kubernetes Engine before. You are familiar with Tilt and have written a Kubernetes Operator before. You have practiced chaos engineering - running fault-injection or resilience experiments with tools like Chaos Mesh, LitmusChaos, or Gremlin. You are familiar with testing event-driven systems using Kafka (or even better, Redpanda). How We Take Care of You: Competitive Salary & Stock Options Health Benefits New Hire Home-Office Setup: One-time USD $500 Monthly Stipend: USD $150 per month via a Brex Card Alpaca is proud to be an equal opportunity workplace dedicated to pursuing and hiring a diverse workforce. Recruitment Privacy Policy

Location: Москва Это возможность возглавить исследовательское направление в команде, занимающейся проектами в новом, динамично развивающемся направлении безопасности искусственного интеллекта. Ваши задачи будут связаны с поиском и исследованием уязвимостей GenAI и AI-приложений с их использованием, в том числе AI-агентов. В коллективе опытных экспертов вы будете оценивать безопасность разрабатываемого ПО, предлагать инструменты для автоматизации исследования и тестирования безопасности GenAI-моделей, а также формировать и развивать исследовательскую команду, участвуя в международных и внутренних CTF. Это не административная роль, мы ищем «играющего тренера», который сам может написать первый прототип, проверить гипотезу об угрозе и решить таск на CTF - и только потом делегирует масштабирование команде. Если ваш опыт ограничивается управлением процессами без hands-on разработки и исследований, эта позиция не подойдёт. Обязанности ### Вам предстоит: * исследование угроз GenAI: создание, поддержка и развитие инструментов для анализа и поиска угроз, в т.ч.: \-разработка средств автоматизации сбора, хранения и анализа новых публикаций, инцидентов и методов атак на GenAI (краулинг, парсинг информации, разработка и управление системами хранения) \-создание и тестирование прототипов (Proof of Concept) для поиска уязвимостей GenAI (скрипты, основные библиотеки GenAI, AI-агенты для генерации кода) * DevOps: CI/CD, контроль версий (git), тестирование качества, инфраструктура для работы (linux) * внедрение практик AI PDLC: исследование и применение методов и инструментов создания и развития программного обеспечения с применением передовых ИИ-моделей * погружение в экосистему: изучение и практическое применение передовых фреймворков и библиотек для работы с LLM и AI-агентами * управление командой: формирование и развитие исследовательской команды (3–5 человек), приоритизация исследований, защита решений перед руководством и смежными командами * CTF и хакатоны: формирование и капитанство команды на международных CTF по AI/ML security, трансляция найденных техник в работу направления * публикации и нормативные документы: оформление результатов исследований, вклад в нормативные документы безопасности AI. Требования ### Что для нас важно: * профиль и образование: законченное высшее образование в области информационных технологий, компьютерных наук, прикладной математики, программной инженерии или смежных направлений * продвинутые навыки программирования: понимание принципов проектирования и разработки программного обеспечения, опыт в написании и чтении программного кода (понятный, поддерживаемый) * навыки DevOps: работа с git, администрирование linux, автоматизация этапов жизненного цикла разработки ПО * LLM и AI-агенты: экспертный уровень применения LLM для разработки ПО, глубокое понимание архитектуры агентов и их векторов атак * английский язык на уровне не менее чтения технической документации, статей и участия в международных CTF * опыт командной работы в проектах разработки: канбан (спринты, трекинг задач), jira/git/confluence, презентации и умение понятно объяснять свои идеи команде/руководству и согласовывать требования * Adversarial ML и red teaming LLM: практический опыт поиска уязвимостей в GenAI-моделях (prompt injection, jailbreaking, tool poisoning, data extraction) * знание инструментария для LLM security: Giskard, Garak, LLM Guard и др. * CTF и хакатоны: участие в международных CTF по AI/ML security (желательно — победы или призовые места). Условия ### Мы предлагаем: * комфортный современный офис ул. Вавилова 19 * офисный формат работы * ежегодный пересмотр зарплаты, годовая премия * корпоративный спортзал и зоны отдыха * более 400 образовательных программ СберУниверситета для профессионального и карьерного развития * программа адаптации и помощь руководителя на старте * расширенный ДМС, льготное страхование для семьи и корпоративная пенсионная программа * гибкий дисконт по ипотечному кредиту, равный 1/3 ключевой ставки ЦБ * подписка Прайм с возможностью совместного использования на трёх близких * вознаграждение за рекомендацию друзей в команду Сбера.

Location: Costa Mesa, United States ABOUT THE TEAM The Air Dominance and Strike Mechanical Engineering Team is responsible for designing and integrating advanced hardware for Group 5 air vehicles and missile platforms . Air Dominance and Strike Mechanical Engineers own the full development lifecycle , from concept generation, to integration and flight test, ensuring high-performance, resilient, and scalable mechanical systems that meet the demands of complex, contested environments. WHAT YOU’LL DO: Develop and integrate hardware on unmanned air vehicles Own designs from concept generation to real world use Use first principles physics as a basis for every decision Lead design reviews, run analysis, visit vendors, define and execute hardware test plans Build prototypes, analyze failures, and transition successful projects into production Support critical hardware demonstrations with customers as needed Travel to test sites as needed REQUIRED QUALIFICATIONS: 5+ years of mechanical engineering experience Advanced Air Vehicles Programs Experience integrating electrical and mechanical subsystems into advanced air vehicles Experience designing mechanical parts (CAD). Understanding of manufacturing methods (machining, sheet metal, composites, 3D printing, injection molding, composite lamination, etc) High competence with, and fluid use of, engineering first principles BS or higher degree in Mechanical, Aerospace, or Electrical Engineering Eligible to obtain and maintain an active U.S. Secret security clearance PREFERRED QUALIFICATIONS Experience in NX/Teamcenter Experience developing aircraft subsystem layouts, performing architectural trade studies, and evaluating vendor performance data Competency in engineering analysis, including structural, thermal, and electrical

Location: Boston, MA Workplace: OnSite At WHOOP, we're on a mission to unlock and inspire performance for life. WHOOP is seeking a Governance, Risk, and Compliance Analyst II, to lead the day-to-day operation and support the ongoing risk management program at GRC in a fast-paced, high-growth environment. This role is responsible for operations of GRC initiatives - including but not limited to structured cybersecurity and AI risk assessments, exceptions management, SDLC reviews and security compliance process ownership. The role will partner closely with Legal, Security, Product, and other teams to advance compliance objectives, reduce enterprise risk, and strengthen operational resilience. The ideal candidate combines strong analytical thinking, critical risk mind-set, familiarity with AI governance and has the ability to communicate complex risk scenarios clearly to both technical and non-technical stakeholders. RESPONSIBILITIES: - Lead governance, risk assessment, and compliance activities specific to AI/ML systems, LLM integrations, AI agents, and retrieval-augmented workflows - Partner with the Senior Security Engineer, AI/ML to integrate risk assessment findings into GRC frameworks and translate technical risk into governance requirements - Develop, maintain, and refine AI risk and compliance controls aligned with relevant frameworks, including ISO/IEC 42001, NIST Cybersecurity Framework, NIST AI Risk Management Framework, EU AI Act, GDPR, and other applicable standard - Execute risk assessments for new AI vendors, LLM platforms, AI APIs, and enterprise AI tools, including third-party risk scoring, control mapping, and remediation tracking - Manage the vendor risk assessment lifecycle for AI/ML related suppliers, ensuring documented controls, evidence collection, and follow-up on remediation items - Support audit activities, capturing evidence and coordinating cross-functional stakeholders for internal and external compliance reviews involving AI systems - Develop and maintain AI-specific GRC policies, standards, and procedures that map to AI risk domains, explainability requirements, and compliance obligations - Facilitate AI risk and compliance reporting to leadership, including risk dashboards, trend analysis, control effectiveness measurements, and key metrics - Monitor emerging AI governance requirements, guidance, and best practices, translating them into GRC program updates and compliance recommendations - Support security incident documentation and post-incident analysis for AI system events, coordinating with Legal and Security teams to ensure appropriate governance response QUALIFICATIONS: - 6+ years of experience in Governance, Risk & Compliance, including risk assessment, policy development, audit coordination, and third-party risk management - Demonstrated experience performing governance or risk assessments for AI/ML systems, including LLM integrations, model pipelines, AI agents, or data-driven algorithmic systems - Experience translating AI-specific risks (i.e., data poisoning, prompt injection, model misuse, data leakage, explainability gaps) into documented control requirements and governance standards - Hands-on experience conducting third-party risk assessments for AI vendors, LLM platforms, AI APIs, or machine learning service providers - Experience mapping AI-related risks and controls to frameworks such as ISO/IEC 42001, NIST CSF, NIST AI RMF, ISO/IEC 42001, GDPR, PCI DSS, or similar standards - Strong understanding of data governance concepts relevant to AI systems, including training data lineage, data retention, model output handling, and human oversight requirements - Experience supporting regulatory readiness or compliance efforts related to AI systems - Proven ability to collaborate with engineering and security teams to validate control implementation and remediation - Bachelor’s degree in Information Security, Computer Science, Business Risk, Compliance, or a related field This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office.   Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply. WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/to determine employment eligibility The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values. At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success. The U.S. base salary range for this full-time position is $100,000 - $140,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training.  In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements.

Location: Worldwide IMPORTANT NOTE: If you have already passed the 20four7VA Recruitment Process after the Final Interview, or you have been hired by a 20four7VA Client before, make sure that you are applying via the 20four7VA Team Portal , for faster processing of your application. You will be logging in using your 20four7VA email address. If you have just logged in to the Team Portal, please continue reviewing the Job Description below. If you have just logged in to the Team Portal, please continue reviewing the Job Description below. You don't need to type all the information in the application form, upload your resume first and see the magic! If you are interested in the job, click APPLY TO POSITION. ******************************************************************** Job Description: Java Developer Client: 20four7VA Experience: Minimum 2.5 years of relevant experience Client Time Zone: EST Hours/Week: 20 hrs to start with Shift Time Zone: EST morning preferred, Flexible shift during weekends Candidates applying for the Java Developer post should have the following at least in their resumes (and other skills are secondary): Strong knowledge of Core Java: Proficient in Java SE with a solid understanding of object-oriented programming principles. Experience with Java 8+ features, such as lambdas and streams. JSP, Servlets ( MUST ): Skilled in JavaServer Pages (JSP) and Servlets for web application development. Understanding of the MVC (Model-View-Controller) design pattern. At least one framework idea: Experience with popular Java frameworks such as Spring, Spring Boot, Hibernate, or Struts. Understanding of dependency injection and aspect-oriented programming in Spring. JavaScript (JS): Basic to intermediate knowledge of JavaScript for enhancing web applications. Familiarity with modern JS frameworks/libraries like React, Angular, or Vue.js is a plus. CSS Basics: Basic understanding of Cascading Style Sheets (CSS) for web design and styling. Ability to work with CSS preprocessors like SASS or LESS is a plus. Worked on Desktop Apps & Web-based projects (MUST): Hands-on experience in developing and deploying desktop & web-based applications for Windows, MAC & Linux. Knowledge of RESTful web services and APIs. Worked on any of the following IDEs: Proficiency in using integrated development environments such as NetBeans, Eclipse, or IntelliJ IDEA (preferred). Familiarity with IDE plugins and tools for enhanced productivity. Additional Skills (preferred but not mandatory): Database Management: Experience with SQL databases like MySQL, PostgreSQL, or Oracle. Knowledge of ORM tools like Hibernate. Version Control: Proficiency in version control systems like Git and platforms like GitHub or Bitbucket. DevOps: Familiarity with continuous integration/continuous deployment (CI/CD) pipelines using Jenkins, CircleCI, or GitLab CI. Experience with containerization tools like Docker and orchestration platforms like Kubernetes. Understanding of cloud services like AWS, Google Cloud Platform (GCP), or Microsoft Azure. Testing: Experience with unit testing frameworks such as JUnit or TestNG. Knowledge of test automation tools like Selenium is a plus. Employee Onus: Must follow instructions of Senior Team Team Player Knowledge in Core Java ( OOP ) Work with honesty & integrity Want to work with this amazing client? Apply now and join 20four7VA! Join the remote world, today. What we offer: Competitive rates Weekly payments Annual rate increase (based on performance) Paid time off Paid holidays Various open roles are available Free training and upskilling Constant support and guidance from managers and mentors Clear schedules and guidelines A vibrant community always ready to support you And more!

Location: Brussels; Rome; Zug; Porto; Istanbul; Eindhoven; Geneva; Milan; Amsterdam; Manama; Madrid; London; Berlin; Antwerp; Copenhagen; Vienna; Prague; Athens; Budapest; Paris; Frankfurt; Dublin; Warsaw; Sofia; Luxembourg; Remote; Zurich; Lisbon; Tallinn; London OR Brussels; Rotterdam; Krakow; Zagreb Workplace: Remote RUST ENGINEER - TRADING SYSTEMS ABOUT KEYROCK Since our beginnings in 2017, we've grown to be a leading change-maker in the digital asset space, renowned for our partnerships and innovation. Today, we rock with over 200 team members around the world. Our diverse team hails from 42 nationalities, with backgrounds ranging from DeFi natives to PhDs. Predominantly remote, we have hubs in London, Brussels, Singapore and Paris, and host regular online and offline hangouts to keep the crew tight. We are trading on more than 80 exchanges, and working with a wide array of asset issuers. As a well-established market maker, our distinctive expertise led us to expand rapidly. Today, our services span market making, options trading, high-frequency trading, OTC, and DeFi trading desks. But we’re more than a service provider. We’re an initiator. We're pioneers in adopting the Rust Development language for our algorithmic trading, and champions of its use in the industry. We support the growth of Web3 startups through our Accelerator Program. We upgrade ecosystems by injecting liquidity into promising DeFi, RWA, and NFT protocols. And we push the industry's progress with our research and governance initiatives. At Keyrock, we're not just envisioning the future of digital assets. We're actively building it. MISSION STATEMENT We are seeking a Senior Rust Engineer with deep trading systems experience and strong AWS knowledge to join our core Capital Markets division. Candidates with a passion for the Rust ecosystem and a proven track record designing, building, and operating mission-critical trading systems will be at a significant advantage. As part of the engineering team in Capital Markets, you will take ownership of high-impact trading infrastructure, set technical direction in your domain, and drive continuous improvement in system performance, reliability, and operability. You will join a highly-profitable, fast-paced division within Keyrock, where you will be expected to make a senior individual-contributor impact while collaborating with a global, fully-remote team. This role is open to candidates located in European time zones. JOB DESCRIPTION - Design, develop, and optimise low-latency, mission-critical trading systems - Own key trading stack components end-to-end — from architecture through to production operation - Collaborate closely with quants, traders, and engineers to deliver solutions that improve trading performance and resilience - Maintain and evolve trading infrastructure with a focus on performance, stability, observability, and operational excellence - Troubleshoot complex production issues across exchange connectivity, execution, and market data handling - Drive engineering standards through technical leadership, code reviews, and mentoring - Embrace agentic engineering principles: leverage AI-assisted workflows, drive automation of operational tasks, and help evolve the team's agentic tooling - Contribute to functional, component, and production-readiness testing for critical trading components BACKGROUND AND EXPERIENCE TECHNICAL SKILLS - Production-grade Rust experience building high-performance, concurrent systems; proficiency with Tokio is a strong advantage - Hands-on experience in a systematic trading environment (HFT, Market Making, Quantitative Trading, or similar), with solid understanding of execution, market data, and operational risk - Strong AWS and Linux expertise, including cloud infrastructure trade-offs for latency-sensitive workloads, shell scripting, debugging, and production troubleshooting - Proficiency in Python or other scripting languages for strategy development, automation, and operational tooling - Deep familiarity with trading system protocols (FIX, REST, WebSocket), exchange connectivity, and market data feeds - Solid grasp of low-latency networking: TCP/UDP, packet and latency path analysis, dedicated network infrastructure, and kernel bypass techniques (DPDK) - Familiarity with agentic engineering tools and concepts: LLMs, MCP APIs, AI-First IDEs (e.g. Cursor, Claude Code), harness engineering, and workflow automation - Ability to make sound architectural decisions, articulate trade-offs clearly, and guide implementation across complex systems SENIORITY & COMPETENCIES - Ownership & Reliability – Take full responsibility for your work. Deliver high-quality service, meet deadlines, and follow through on commitments. Anticipate and proactively address potential issues before they arise. - Initiative & Problem-Solving – Approach challenges with a problem-solving entrepreneurial mindset. Make sound, independent judgments and take the initiative to drive solutions rather than waiting for instructions. - Operational Diligence – Respond strategically to technical and operational challenges, ensuring robust and reliable trading infrastructure while instilling confidence in the team’s processes. - Technical Leadership – Influence system design, raise engineering standards, mentor other engineers, and help the team make pragmatic, high-quality technical decisions. - Curiosity & Growth Mindset – Continuously seek to improve your technical skills and knowledge. Stay ahead of industry trends and take the initiative to practice and explore new technologies that excite you. - Agentic Engineering – Embrace AI-assisted workflows and autonomous agents, pushing the boundaries of what engineering teams can achieve through intelligent automation. - Excellent Communication Skills with a team player mindset, collaborating within a fully remote global team. OUR RECRUITMENT PHILOSOPHY We value self-awareness and powerful communication skills in our recruitment process. We seek fiercely passionate people who understand themselves and their career goals. We're after those with the right skills and a conscious choice to join our field. The perfect fit? A senior engineer and crypto enthusiast who’s driven, collaborative, acts with ownership, raises the bar for others, and delivers solid, scalable outcomes. OUR OFFER - A competitive salary package - Autonomy in your time management thanks to flexible working hours and the opportunity to work remotely - The freedom to create your own entrepreneurial experience by being part of a team of people in search of excellence As an employer we are committed to building a positive and collaborative work environment. We welcome employees of all backgrounds, and hire, reward and promote entirely based on merit and performance. Due to the nature of our business and external requirements, we perform background checks on all potential employees, passing which is a prerequisite to join Keyrock. https://keyrock.com/careers/

Location: San Francisco, CA About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Anthropic's Safeguards team is seeking a Red Team Engineer to help ensure the safety of our deployed AI systems and products. In this role, you'll take an adversarial approach to uncover vulnerabilities across our product ecosystem before they can be exploited by malicious actors. Your work will span from technical infrastructure vulnerabilities on our products to emergent risks from advanced AI capabilities. While you'll bring best practices from traditional security approaches, the focus is on broader safety implications and novel abuse unique to advanced AI systems and associated products. You'll investigate the full spectrum of potential abuse — from coordinated account manipulation and payment fraud to novel exploitation of product features — and simulate sophisticated threat actors who chain multiple attack vectors to achieve their objectives. Key responsibilities Conduct comprehensive adversarial testing across Anthropic's product surfaces, developing creative attack scenarios that combine multiple exploitation techniques Research and implement novel testing approaches for emerging capabilities, including agent systems, tool use, and new interaction paradigms Design and execute "full kill chain" attacks that emulate real-world threat actors attempting to achieve specific malicious objectives Build and maintain systematic testing methodologies that evaluate every aspect of our systems Develop automated testing frameworks to enable continuous assessment at scale Collaborate with Product, Engineering, and Policy teams to translate findings into concrete improvements Help establish metrics for measuring detection effectiveness of novel abuse Minimum qualifications Experience in penetration testing, red teaming, or application security Experience in model jailbreaking and testing large-scale agentic workflows for non-obvious prompt injection vectors Strong technical skills in web application security, including hands-on expertise with security testing tools (e.g., Burp Suite, Metasploit, custom scripting frameworks) Experience building custom automation, including LLM-specific testing frameworks A track record of discovering novel attack vectors and chaining vulnerabilities in creative ways A public body of work such as CVEs, blog posts, or disclosed bug bounty reports Strong written and verbal communication skills, with the ability to explain technical concepts to varied audiences Preferred qualifications Experience with AI/ML security or adversarial machine learning Understanding of AI safety considerations beyond traditional security, including modern guardrails against jailbreaks Experience testing API security and rate-limiting systems Background in testing business logic vulnerabilities and authorization bypass techniques Background in anti-fraud, trust & safety, or abuse prevention systems Familiarity with distributed systems and infrastructure security Familiarity with abuse detection mechanisms and the ability to engineer novel bypasses Adaptability to understand and build engagements around emerging threats outside your direct area of expertise The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $320,000 — $405,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Location: Remote - United Kingdom Who we are At Twilio, we’re shaping the future of communications, all from the comfort of our homes. We deliver innovative solutions to hundreds of thousands of businesses and empower millions of developers worldwide to craft personalized customer experiences. Our dedication to remote-first work , and strong culture of connection and global inclusion means that no matter your location, you’re part of a vibrant team with diverse experiences making a global impact each day. As we continue to revolutionize how the world interacts, we’re acquiring new skills and experiences that make work feel truly rewarding. Your career at Twilio is in your hands. . Hiring and how we work We use Artificial Intelligence (AI) to help make our hiring process efficient. That said, every hiring decision is made by real Twilions! Also, while we are a remote-first company, you may be asked to report in person on an ad-hoc basis for team gatherings, functional off-sites or customer meetings. . See yourself at Twilio Join the team as Twilio’s next Security Engineer, Incident Response About the job The Security Incident Response Team (SIRT) is looking for a Security Engineer who is passionate about solving Twilio’s mission of security and reliability by working across the organization to lead the technical response to security events and incidents across Twilio’s global infrastructure, services and applications by effectively conducting triage, containment, remediation and driving post-incident betterments.  You will work within a team that partners with R&D Engineering and R&D Business teams to develop scalable processes and technical solutions. You will be a valued member of a team of deeply technical Security Engineers to focus on creating bespoke and standard Security response processes, enhancing our capabilities for threat mitigation and incident response, and then automating as much as you possibly can (and more)! You will help us to grow our global, scaled team and program. Responsibilities In this role, you’ll: Lead and support the response to all security events and incidents across Twilio’s complex global infrastructure, services and applications. Be responsible for documentation of incidents and projects you work on and craft best practices as runbooks and standard operating procedures to share knowledge across teams. Work cross-collaboratively to understand and help solve challenges related to a broad spectrum of threat actors and activity. Work to improve Twilio’s security and reliability posture by driving identified betterments from security events and incidents. Rapidly acquire new technical skills and knowledge in a fast-paced, highly disruptive industry environment. Own the security incident lifecycle, respond to incidents and participate in on-call rotation and participate in RCAs for security incidents. Build, cultivate, and maintain positive relationships with internal customers to identify and facilitate solutions to increase the impact of the team’s work. Provide mentorship, support, and care for the team in a way that enables long-term career development, happiness, and success at scale. Qualifications Twilio values diverse experiences from all kinds of industries, and we encourage everyone who meets the required qualifications to apply. If your career is just starting or hasn't followed a traditional path, don't let that stop you from considering Twilio. We are always looking for people who will bring something new to the table! Required: Proven experience: 3+ years of security incident response in a production-cloud environment Subject-matter expert on security issues and technologies Ability to utilize AI for comprehensive, complex security incident response activities delivering high fidelity detections Advanced knowledge of service-oriented architectures, as well as experience with security tools and technologies fit for a cloud environment Experience working across a technology stack on difficult security challenges and initiatives Experience with SIEM platforms and the ability to extend their functionality Experience with SOAR tools and automating manual security processes Experience in either AWS, GCP, or other large cloud platform Excellent written and verbal communication skills Ability to influence and build effective working relationships with every level of the organization. Desired: AI Model Security & Posture Management: Support Implementation of  controls and safeguards to prevent AI vulnerabilities, such as prompt injections, model evasion, and data poisoning AI-Driven Threat Response: Utilize GenAI and LLM-based security use cases to rapidly interpret alerts, reduce false positives, and contextualize threat data Artifact & Evidence Triage: Collects intrusion artifacts and forensically sound images to analyze malware, trojans, and source code. Threat Intelligence Integration: Monitors external vendor data and threat intelligence to analyze trends and proactively defend against emerging risks. Location This role will be remote, and based in Ireland or U.K. Travel We prioritize connection and opportunities to build relationships with our customers and each other. For this role, you may be required to travel occasionally to participate in project or team in-person meetings. What We Offer Working at Twilio offers many benefits, including competitive pay, generous time off, ample parental and wellness leave, healthcare, a retirement savings program, and much more. Offerings vary by location. Twilio thinks big. Do you? We like to solve problems, take initiative, pitch in when needed, and are always up for trying new things. That's why we seek out colleagues who embody our values — something we call Twilio Magic . Additionally, we empower employees to build positive change in their communities by supporting their volunteering and donation efforts. So, if you're ready to unleash your full potential, do your best work, and be the best version of yourself, apply now! If this role isn't what you're looking for, please consider other open positions. . Stay alert to recruitment fraud We care about your safety. Scammers sometimes impersonate Twilio recruiters through fake job postings, emails, websites, or messages. Please ensure you are engaging with an official @ twilio.com email address. We will never ask for payment, gift cards, cryptocurrency, or banking information during the recruiting process. We do not make job offers without a formal interview process or conduct interviews exclusively through text-based messaging apps. . Twilio is proud to be an equal opportunity employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law. Qualified applicants with arrest or conviction records will be considered for employment in accordance with the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act. Additionally, Twilio participates in the E-Verify program in certain locations, as required by law.

Location: Metn, Lebanon The Company Toters is an on-demand e-commerce and delivery platform that enables customers to get anything in their city with the highest level of convenience. Technology is at the heart of everything we do. Our product and engineering teams work every day to build experiences that make customers’ lives easier while continuously improving internal systems to deliver faster and at the best cost. If you’re excited about working in a high-growth startup environment and want to be part of a team shaping the future of how people shop in the Middle East, we’d love to hear from you. About the Role We’re looking for a Mid-Level Android Engineer who takes ownership of delivering medium-to-large features end-to-end, from design to production. You’ll make technical decisions independently, manage risks and dependencies, and ensure reliable, high-quality releases that drive team and product impact. You’ll design scalable Android modules, write clean, maintainable, and well-tested code, and improve existing workflows through automation, tooling, and documentation. You’ll collaborate closely with Product, Design, QA, and Backend teams to resolve ambiguity early and deliver features smoothly across functions. As a key contributor, you’ll also provide informal mentorship, share knowledge through code reviews, and help onboard and guide newer engineers, reinforcing a culture of collaboration and continuous improvement. In this role, you will: Lead the delivery of medium-to-large mobile features from design to production. Break down requirements, estimate effort, and manage risks with minimal oversight. Write clean, maintainable code with strong unit and integration test coverage. Design and implement scalable modules aligned with team architecture standards. Ensure stability post-launch through proactive testing, monitoring, and debugging. Collaborate closely with Product, Design, QA, and Backend teams to deliver high-quality user experiences. Improve team efficiency through automation, tooling enhancements, and better documentation. Provide constructive code reviews and support peers through informal mentorship. Key Qualifications Bachelor’s degree in Computer Science or a related field. 3–5 years of professional experience in Android development. Strong proficiency in Kotlin and experience with Jetpack Compose and other Jetpack libraries. Familiarity with Dependency Injection (DI) frameworks. Experience designing and building Android features or modules following best practices and design patterns. Understanding of mobile architecture principles, performance optimization, and scalability basics. Knowledge of the mobile development lifecycle, including testing and debugging. Experience with Git and collaborative development workflows. Ability to write clean, maintainable, and well-tested code. Good problem-solving skills and ability to work independently with minimal guidance. Experience with app analytics or crash reporting tools (e.g., Firebase Analytics, Crashlytics) is a plus. Familiarity with reactive programming (RxKotlin, Flows, etc.) is a plus. Strong communication and collaboration skills within a cross-functional team. Why Toters Flexible work environment with hybrid-friendly roles. Opportunity to lead impactful initiatives and shape technical strategy. Collaborate with talented engineers while growing your career. Strong culture of mentorship, collaboration, and continuous learning. Direct impact on products used by thousands of customers every day. Competitive compensation package. Exclusive discounts on Toters orders. First-class medical insurance.

Location: Baku Workplace: onsite ABOUT YOU We are looking for a junior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will work closely with senior specialists to identify, assess, and help remediate security vulnerabilities across our products and infrastructure. You will be involved in day-to-day AppSec work - code reviews, vulnerability triage, threat modeling, and security testing. You are curious, detail-oriented, and eager to develop deep expertise in application security. You do not need to have all the answers, but you ask the right questions and follow through. This is a strong learning environment. You will be exposed to real-world security challenges in a payment platform operating at scale, and supported by experienced security specialists who will help you grow.   ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Triage Security Findings - Assess incoming bug bounty reports and scanner findings. Evaluate validity, calculate real severity, and escalate appropriately with clear written summaries. Assist with Vulnerability Assessments - Participate in security assessments of web applications and APIs. Help identify and document risks in new features and existing systems. Write Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way that engineering teams can act on. Support Threat Modeling - Participate in threat modeling sessions. Learn to identify trust boundaries, data flows, and attack surfaces in system designs. Monitor Security Tools - Help operate SAST , DAST , and dependency scanning tooling. Track findings, reduce noise, and support remediation workflows. Support Code Reviews - Review code for common vulnerability classes under guidance of senior specialists. Learn to identify security issues across PHP, Python, and Go codebases. Stay Current - Follow developments in the security community. Bring awareness of new vulnerability classes, CVEs, and attack techniques relevant to our stack. What You Bring Web Security Fundamentals - Solid understanding of common vulnerability classes: OWASP Top 10, CSRF , XSS , IDOR , SQL injection, open redirect, authentication and session management weaknesses. You understand root causes, not just names. Web and Browser Fundamentals - Solid understanding of how web applications work: HTTP request/response cycle, client-server model, REST APIs, how browsers handle same-origin policy, cookies and their attributes, and CORS . This is the foundation everything else builds on. Security Testing Tools - Hands-on experience with Burp Suite or similar web application security testing tools. You have used them to intercept, modify, and replay requests — not just run automated scans. Vulnerability Documentation - Able to reproduce a vulnerability and write it up clearly: reproduction steps, proof of concept, and impact statement. Findings that engineering teams cannot reproduce or understand do not get fixed. Secure Development Awareness - Familiarity with foundational secure coding concepts: input validation, output encoding, parameterized queries, and least privilege. Code Readability - Ability to read and follow code in at least one language relevant to web security - PHP, Python, JavaScript, or Go. You don't need to be a developer, but you need to follow logic and spot security-relevant patterns. Analytical Thinking - You reason through problems methodically. You can explain not just what a vulnerability is but why it exists, how it is exploited, and what fixing it actually requires. Clear Written Communication - You write findings and summaries that are precise, reproducible, and useful to the engineers who need to act on them. Curiosity and Initiative - You dig into problems rather than stopping at the surface. When something looks wrong, you investigate before concluding Nice to Have Participation in bug bounty programs or CTF competitions; Basic scripting ability for automation - Python or Bash; Familiarity with CI/CD pipelines and where security tooling fits; Exposure to cloud environments - GCP, AWS, or Azure; Relevant coursework or certifications - eWPT, CEH , PortSwigger Web Security Academy progress, or similar entry-level credentials. Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.

Location: Costa Mesa, United States WHAT YOU’LL DO: Develop and integrate hardware on unmanned air vehicles Own designs from concept generation to real world use Use first principles physics as a basis for every decision Lead design reviews, run analysis, visit vendors, define and execute hardware test plans Build prototypes, analyze failures, and transition successful projects into production Support critical hardware demonstrations with customers as needed Travel to test sites as needed REQUIRED QUALIFICATIONS: 5+ years of mechanical engineering experience Advanced Air Vehicles Programs Experience integrating electrical and mechanical subsystems into advanced air vehicles Experience designing mechanical parts (CAD). Understanding of manufacturing methods (machining, sheet metal, composites, 3D printing, injection molding, composite lamination, etc) High competence with, and fluid use of, engineering first principles BS or higher degree in Mechanical, Aerospace, or Electrical Engineering Eligible to obtain and maintain an active U.S. Secret security clearance PREFERRED QUALIFICATIONS Experience in NX/Teamcenter Experience developing aircraft subsystem layouts, performing architectural trade studies, and evaluating vendor performance data Competency in engineering analysis, including structural, thermal, and electrical

Location: Hong Kong, Hong Kong SAR; Singapore, Singapore OKX will be prioritising applicants who have a current right to work in Singapore, and do not require OKX's sponsorship of a visa. Who We Are At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom. OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves. Across our multiple offices globally, we are united by our core principles: We Before Me , Do the Right Thing , and Get Things Done . These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more. About The Opportunity As a Technical Expert, you will lead the development of the company’s core security engineering and DevSecOps capabilities, with a strong focus on security product development, platform engineering, and SDK /Agent development . The ideal candidate should demonstrate deep security expertise, broad technical coverage, strong hands-on engineering capability, and exceptional influence in driving security governance across business teams . What You’ll Be Doing Lead the architecture and core development of the company’s end-to-end DevSecOps platform, security products, and SDKs/Agents , covering code, build, artifacts, images, deployment, and runtime security. Own the design and development of RASP / Java Agent runtime protection , leveraging ASM, ByteBuddy, and Java Instrumentation for bytecode enhancement, runtime hooks, detection and blocking engines, while continuously improving performance, stability, and compatibility. Build and integrate SAST, DAST, IAST, SCA, code security scanning, and image security scanning into CI/CD workflows, and drive deep integration of tools such as SonarQube and Coverity to form a closed loop of scanning, gating, remediation, and re-validation. Drive core application security protection and offensive/defensive capabilities across scenarios such as XSS, SQL injection, SSRF, deserialization, command execution, authentication/authorization flaws, privilege escalation, and API security . Advance AI-Native Security Engineering by applying LLMs and AI Agents to vulnerability analysis, rule generation, false-positive reduction, remediation suggestions, security knowledge management, and workflow automation, while building deep understanding of their architecture, principles, and security implications. Partner closely with business engineering teams to drive security standards, integration rules, quality gates, risk classification, remediation workflows, and overall security governance adoption. Collaborate with engineering, architecture, operations, QA, and business stakeholders to solve complex security problems and turn them into scalable product capabilities, engineering solutions, and governance mechanisms. What We Look For In You Strong fundamentals in computer science and security, with deep understanding of operating systems, networking, compilers/ JVM internals, distributed systems, application security, cloud-native security, and software supply chain security , with both breadth and depth in security technologies. Expert-level Java proficiency , especially in JVM internals, ClassLoader , Java Agent, ASM, ByteBuddy, bytecode instrumentation, profiling, and performance tuning ; proficient in Python or Golang as well. Proven hands-on experience with RASP, SAST, DAST, IAST, SCA, image security, and code security scanning , with the ability to independently design, integrate, and productionize security capabilities. Strong offensive and defensive security experience , with deep understanding of vulnerability root causes, exploitation techniques, detection logic, bypass methods, and remediation strategies in web, API, and microservice environments. Strong practical experience with LLMs and AI Agents , plus deep understanding of model architecture, agent design, tool invocation, context engineering, evaluation methods, and the impact of AI on both security engineering and attacker capabilities. Strong engineering and product mindset, capable of leading the design and implementation of security products, platform modules, and SDKs/Agents while balancing security effectiveness, performance overhead, integration cost, and operability . Strong ownership, communication skills, and cross-functional influence, with a proven ability to drive business teams on security governance, policy adoption, and remediation outcomes. Preferred Qualifications Background from top-tier Internet companies, cloud providers, or leading cybersecurity vendors ; Experience leading DevSecOps platforms, application security platforms, RASP systems, code scanning platforms, or cloud-native security platforms ; Strong experience in security product development, SDK /Agent development, vulnerability research, penetration testing, red/blue team exercises, or incident response ; Hands-on experience in AI + Security initiatives such as security copilots, intelligent rule generation, automated vulnerability analysis, or remediation recommendation systems. Perks & Benefits Competitive total compensation package L&D programs and education subsidy for employees' growth and development Various team building programs and company events Wellness and meal allowances Comprehensive healthcare schemes for employees and dependants More that we love to tell you along the process! Notice: All official OKX vacancies are published on this website. While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. If in doubt, please apply directly through our official careers website. Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to OKX 's Candidate Privacy Notice .