Вакансии

Location: Remote Workplace: Remote Phantom https://phantom.com is on a mission to connect the world to the freedom of open markets. Tens of millions of people all over the world use Phantom to access global markets that never close, including perpetuals, prediction markets, tokenized assets, stablecoins and memes. Phantom users are able to discover the markets that matter and the cultural moments that shape them, building conviction through real-time data and the verified performance of top traders. With self-custody and access to open networks at its core, Phantom lets them control their financial moves in the same app they use to safely store or spend money worldwide. Phantom has reached #1 in Google Play's finance category and consistently ranks in the top 50 apps across all categories. Check out our Forbes Fintech 50 https://www.forbes.com/sites/ninabambysheva/2026/02/23/inside-phantoms-battle-plan-to-win-the-crypto-fueled-superapp-war/ and CNBC and Statista's World's Top Fintech Companies 2026 https://www.cnbc.com/worlds-top-fintech-companies-2026/! We are around 180 people, fully remote, backed by a $150M Series C investment from a16z, Sequoia Capital and Paradigm. ROLE DESCRIPTION Security is core to Phantom’s product and the trust millions of users place in us. We’re building an AI-native security team that aggressively uses AI to expand the speed, depth, and reach of our work—from code review and threat modeling to vulnerability discovery and security automation. We’re looking for strong security engineers with high agency who can identify the risks that matter, build practical solutions, and take ownership from initial discovery through verified remediation. This is a hands-on, high-impact role spanning architecture, source code, testing, and production systems across Phantom’s mobile, web, and backend products. You’ll work directly with engineering and product teams, lead complex security initiatives, and build capabilities that scale across the company. At the Staff level, you’ll set technical direction and raise the bar for how Phantom designs, builds, and ships secure products. This role is fully remote and open to candidates based in the US, UK and Canada. RESPONSIBILITIES - Product Security Ownership: Partner with engineering teams to identify and address security risks across Phantom’s mobile applications, web products, APIs, and backend services. - Architecture and Threat Modeling: Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations. - Secure Product Development: Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation. - Code Review and Security Testing: Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production. - Security Tooling: Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed. - Software Supply Chain Security: Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows. - Vulnerability Management: Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation. - Incident Response: Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards. - Technical Leadership: Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team. QUALIFICATIONS - 5+ years of experience in product security, application security, security engineering, or software engineering, including experience operating at a senior or staff level. - Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes. - Hands-on experience building or applying AI-assisted security tooling to test applications and APIs, combining automated analysis with source-code review and manual validation. - Demonstrated ability to review production code in one or more languages such as TypeScript, JavaScript, Rust, Python and Go. - Experience securing software supply chains and CI/CD systems, including dependencies, build infrastructure, secrets, artifacts, signing, and release integrity. - Experience threat modeling complex products and translating security risks into concrete engineering requirements. - Strong judgment when evaluating exploitability, business impact, and appropriate remediation. - Track record of partnering effectively with engineering and product teams while maintaining a high security bar. - Clear written and verbal communication, including the ability to explain technical risk to both engineers and non-security stakeholders. NICE TO HAVES - Experience securing consumer financial products, wallets, payments, or other systems where client integrity and transaction safety are critical. - Familiarity with blockchain systems, smart-contract interactions, transaction simulation, signing workflows, or self-custodial wallet architecture. - Experience securing browser extensions or native mobile applications. - Experience building and integrating application-security tooling, static or dynamic analysis, security test infrastructure, or policy-as-code controls. - Familiarity with AWS, Kubernetes, CI/CD systems, and cloud-native service architectures. - Experience working with bug bounty programs or coordinating external security assessments. The target base salary for this role will range between $200,000 to $250,000 with the addition of equity and benefits. This is determined by a few factors including your skillset, prior relevant experience, quality of interviews and market factors (such as location) at the point in time of offer. Why Work With Us Phantom's journey to becoming a global trading app began with making crypto easier to use. Today, we’re building on that foundation to help people discover the markets that matter, make informed financial moves, and safely store or spend their money worldwide. Joining Phantom means helping shape that next chapter: building products that bring the freedom of open markets to more people.   - Build for global impact: Create products used by tens of millions of people, making innovative financial markets more accessible to users around the world. - Make complexity feel simple: Solve meaningful challenges across design, engineering, and user experience to make discovering markets and managing money seamless. - Put users in control: Help build a future where people have greater freedom over their assets and financial decisions, with security and self-custody at the foundation. Benefits (only available to full-time employees) - Competitive salary and equity - Comprehensive insurance (medical/dental/vision): base plan 100% covered - Flexible hours and a long-standing, supportive remote environment - Unlimited vacation: Take time when you need it (and we really mean it!) - 401(k) retirement plan - Wellness stipend - Weekly meal stipend - Learning & Development stipend - Remote / WFH set-up stipend We strongly encourage candidates of all backgrounds to apply. We believe that our work is stronger with a variety of perspectives, and we’re eager to further diversify our company. If you have a background that you feel would make an impact at Phantom, please consider applying. We’re committed to building an inclusive, supportive place for you to do the best work of your career. By submitting your resume and application materials, you acknowledge and agree that Phantom Technologies, Inc. ("Phantom") collects and processes your personal information (including application materials, interview records, and related data) to evaluate your candidacy. Phantom may use AI-powered tools and third-party service providers for transcription, note-taking, scheduling, and other administrative tasks. Phantom does not sell your information and your materials will be handled securely and in accordance with applicable data protection laws.

Задачи: — Защищать серверы, сети, облачную инфраструктуру и веб-сервисы. — Выстраивать Zero Trust и безопасный доступ к внутренним системам. — Выявлять угрозы, расследовать инциденты и устранять уязвимости. — Работать над архитектурой безопасности вместе с DevOps и разработчиками. Требования: — От 3 лет в кибербезопасности и администрировании Zero Trust. — Практический опыт ZTNA — обязателен: Cloudflare Zero Trust, Teleport, Tailscale, CyberArk или аналоги. — Уверенный Linux, понимание сетей, TLS, VPN и сегментации. — Опыт с WAF, SIEM, IDS/IPS, управлением уязвимостями и расследованием инцидентов. — Знание OWASP Top 10, принципов управления доступом и безопасности Docker; Bash или Python для автоматизации. Условия: — Официальное трудоустройство. — Комфортный офис в Пафосе. — Сильная техническая команда. — Возможность влиять на архитектуру безопасности. — Рассматриваются кандидаты, которые уже на Кипре или готовы переехать для работы в офисе.

В рамках данной позиции необходимо разрабатывать и внедрять механизмы изоляции и контроля для агентных систем, включая создание песочниц для выполнения инструментов, строгую изоляцию контуров, установку лимитов на действия и реализацию функции аварийного отключения агентов. В задачи входит настройка детального аудита логов действий агентов в продакшене, а также разработка и настройка системы мониторинга аномального поведения с оповещениями о подозрительных паттернах. Требуется проводить моделирование угроз и threat modeling для новых сценариев агентов на этапе проектирования, а также разрабатывать архитектурные решения и фильтры для защиты от атак на LLM, таких как prompt injection, data exfiltration и jailbreak, включая внедрение строгой валидации выходных данных агентов. Необходимо организовывать и проводить атаки на собственные агентные системы для выявления уязвимостей до их эксплуатации злоумышленниками, а также проводить аудит безопасности агентных пайплайнов от команды LLM-инженеров до продакшен-выкатки. Контроль исходящих данных включает обеспечение соблюдения политик по использованию данных и инвентаризацию всех потоков информации, направляемой во внешние LLM-провайдеры. Важной частью работы является настройка IAM и управление секретами, проектирование и внедрение ролевой модели доступа для агентов, определение прав доступа и безопасное хранение с ротацией секретов. Также требуется опыт использования сканеров исходного кода (SAST/DAST), включая подбор, пилотирование, установку, администрирование и интеграцию в CI/CD-конвейер, а также помощь разработчикам в расшифровке результатов и устранении уязвимостей. Кандидат должен уверенно владеть Python, иметь глубокие знания Docker и Linux, а также понимание принципов работы CI/CD. Необходим практический опыт threat modeling, работа с системами управления секретами (например, HashiCorp Vault), внедрение IAM-моделей, настройка песочниц и изолированных окружений. Важно понимание работы LLM и агентных систем, опыт с фреймворками LangChain, LangGraph, MCP и знание принципов Claude Code. Кандидат должен быть готов не только проводить ревью кода, но и самостоятельно проектировать и создавать безопасных агентов.

Ищем энергичного и опытного специалиста, который поможет поддерживать культуру, делая информацию о кибербезопасности понятной и доступной для каждого сотрудника.

Ищем энергичного и опытного специалиста, который поможет поддерживать культуру, делая информацию о кибербезопасности понятной и доступной для каждого сотрудника.

Location: Remote-Friendly (Travel-Required) | San Francisco, CA | Seattle, WA | New York City, NY About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the Role: As part of Anthropic’s Global Safety, Intelligence, and Security (GSIS) team, the Security Technology Deployment Engineer will own the validation, standardization, and deployment of physical security technology across Anthropic’s rapidly expanding global office portfolio. This role bridges the gap between technology selection and production-ready operation — ensuring that every security platform deployed is rigorously tested, properly integrated with enterprise infrastructure, fully documented, and built for scale. You’ll define the installation standards, configuration baselines, and deployment processes that the broader team executes against — from access control migrations and intercom replacements to AI analytics onboarding and new application integrations. You’ll work across InfoSec, IT, Networking, and Identity Management to ensure every security application passes review, integrates with SSO, and is supported within Anthropic’s infrastructure before going live. Your work will directly determine whether Anthropic’s security technology stack scales reliably as the company grows from dozens of locations to a global enterprise footprint. Responsibilities: Validate and deploy new and replacement security technology platforms including access control systems, intercom solutions, video management, visitor management, and AI/analytics tools across all Anthropic locations Build and maintain staging environments for pre-production testing and validation of all security applications, hardware, firmware, and system configurations Define installation standards, configuration baselines, licensing structures, update procedures, and maintenance requirements for every deployed security platform Deploy integrations between security applications, validating that platforms communicate and share data correctly before transitioning to production Support colleagues’ security applications through InfoSec review processes, ensuring new tools meet Anthropic’s information security and compliance requirements Coordinate SSO integration for newly deployed security applications with Identity Management and IT teams Transition applications requiring custom integration or data pipeline development to the IT Engineering team with documented technical requirements for roadmap inclusion Initiate onboarding of deployed hardware and systems into Anthropic’s health monitoring platform to ensure operational visibility from day one Develop standardized deployment playbooks, checklists, configuration templates, and handoff documentation that enable repeatable installations across all current and future sites Evaluate security platforms for scalability, identifying capacity constraints, single points of failure, and architectural limitations before they impact operations at scale Coordinate with Networking, IT Infrastructure, and Facilities teams to ensure all infrastructure prerequisites (network, power, rack space, cloud resources) are met prior to deployment Execute structured handoffs to Project Management (for site programming), Break-Fix Support (for maintenance), and Access Control Administration (for ongoing system management), ensuring each team has the standards and documentation to execute independently You may be a good fit if you: Have 5+ years of hands-on experience deploying, validating, and managing enterprise physical security technology across a large or rapidly growing organization Have deployed security technology across 50 or more sites, or have demonstrated experience in a high-growth environment where deployment velocity and repeatability were essential Have built standardized deployment processes, playbooks, and configuration templates that enabled others to execute installations independently and consistently Have experience working across InfoSec, IT, Networking, and Identity Management teams to onboard and integrate security applications into enterprise environments Have supported SSO integration, InfoSec reviews, and enterprise application onboarding workflows for security tools Possess broad technology experience across access control, video management, intercoms, visitor management, AI/analytics, and alarm monitoring platforms Are a strong technical communicator who can define standards clearly enough that PMs, integrators, and service teams execute against them without ambiguity Have experience with IP networking, VLANs, PoE, and infrastructure requirements for security devices Are comfortable with 25% travel for site deployments, commissioning, and validation Strong candidates may have: Previous experience at a hyper-growth technology company or managing security technology programs for high-profile corporate environments Experience with Anthropic’s specific technology stack: Genetec Security Center, Axis cameras, Wavelynx, Commend Symphony Cloud, Alcatraz.ai , Ambient.ai , SureView, Envoy Industry certifications: Genetec, Axis, CCNA, PSP, CPP, or PMP Experience with OSDP, modern credential technologies, and encryption protocols for physical security systems Familiarity with scripting or automation (Python, PowerShell) for configuration management and deployment automation Experience with health monitoring and observability platforms Knowledge of SOC 2 compliance, GDPR, and physical security compliance frameworks Experience with change management, configuration control, and version-controlled infrastructure documentation Deadline to apply: None. Applications will be received on a rolling basis. The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $180,000 — $230,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

About the Team The Security Operations team protects CircleCI’s infrastructure, product, and customer data against evolving threats, working closely with engineering to maintain security and resilience. About the Role As a Security Operations Engineer, you will protect CircleCI’s infrastructure, product, and customer data from AI-driven attacks and defenses. This intermediate role involves ownership of security challenges, collaboration with Engineering, contributing to the security roadmap, and leveraging AI tools to detect, respond to, and automate security threats. What You’ll Do: Threat Detection & Incident Response — Monitor, investigate, and respond to security threats across cloud and application environments using security and AI-assisted tools. — Participate in risk assessments, incident response, post-incident reviews, and on-call support, improving controls and processes. Security Engineering & Architecture — Build and maintain security tooling, controls, and automation across cloud, application, and CI/CD environments following best practices. — Identify vulnerabilities and configuration risks, contribute to runbooks and compliance, and understand CircleCI’s security architecture. AI & Security — Incorporate AI-powered security tools into workflows and evaluate emerging technologies for detection, response, and automation. — Stay current on AI-specific security threats and contribute to responsible AI use in security operations. Cross-Team Partnership & Ownership — Partner with Engineering teams to understand security needs, provide guidance, and translate risks into actionable recommendations. — Contribute to security roadmap planning, technology evaluations, and documentation while building relationships across teams. What You’ll Bring: — 3+ years of security engineering or operations experience or equivalent expertise. — Hands-on experience with cloud, application, and CI/CD security in AWS, GCP, or Azure. — Experience with incident response and security tools including EDR, CNAPP, SASE, vulnerability scanners, and log analysis. — Ability to build and maintain security automation and tooling using Go, Python, or Terraform. — Strong security judgment and problem-solving skills. — Hands-on experience with AI/ML-powered security tools in production and understanding of AI’s role in security workflows. Bonus Skills (Nice to Have): — Familiarity with AI-specific threat categories like prompt injection and model supply chain risks. — Experience securing developer platforms, SaaS, or CI/CD infrastructure. — Relevant certifications such as CEH, AWS Security Specialty, Security+. — Contributions to process improvement, runbook development, or knowledge sharing. Accommodation CircleCI provides reasonable accommodation for individuals with disabilities during application and employment. About CircleCI CircleCI is the world’s largest CI/CD platform, processing over 3 million jobs daily, helping companies leverage AI in software delivery. Founded in 2011, headquartered in San Francisco with a global remote workforce, and venture-backed by multiple investors. Equal Opportunity CircleCI is an Equal Opportunity and Affirmative Action employer, not discriminating based on legally protected characteristics and considering applicants with criminal histories consistent with laws.

Задачи: — Проектировать, внедрять и управлять решениями и контролями безопасности для AWS и Kubernetes, включая методы изоляции для платформы RCE-as-a-Service. — Создавать, развёртывать и поддерживать инфраструктуру как код с использованием Terraform, обеспечивая высокие стандарты безопасности. — Проводить оценки безопасности, моделирование угроз и аудиты AWS и Kubernetes. — Сотрудничать с командами разработки и эксплуатации для внедрения лучших практик безопасности в CI/CD. — Мониторить и реагировать на инциденты безопасности в облаке, выявлять причины и рекомендовать меры по устранению. — Обеспечивать соответствие требованиям комплаенса (SOC 2, ISO 27001, GDPR, HIPAA, PCI DSS). — Наставлять инженеров и продвигать культуру облачной безопасности в организации. Требования: — Опыт работы в облачной безопасности не менее 5 лет, глубокие знания AWS. — Профессиональные навыки в области безопасности Kubernetes: защита кластеров, RBAC, сетевые политики, управление уязвимостями контейнеров. — Экспертное владение Terraform. — Знание сервисов безопасности AWS (IAM, GuardDuty, Security Hub, CloudTrail, WAF). — Знакомство с CNAPP решениями (Wiz) и SIEM (Panther). — Понимание безопасного жизненного цикла разработки ПО, безопасности CI/CD и DevSecOps. — Желательны сертификаты AWS Certified Security – Specialty, Certified Kubernetes Security Specialist (CKS), Terraform Associate. — Приветствуются сертификаты SANS или OffSec. — Отличные навыки решения проблем, коммуникации и лидерства. Условия: — Удалённая работа из США (SF, NYC или Remote). — Конкурентная зарплата и пакет вознаграждений, включая акции, медицинские льготы и гибкий отпуск. Дополнительно: — Работа в команде инженеров, тесное сотрудничество с командой безопасности. — Технологический стек включает Typescript, React, Apollo GraphQL, Redux, Express, Postgres, Redis, Kubernetes, Terraform, Helm, AWS.

Задачи: — Построение threat model для CoinJoin-протокола и всей системы. — Анализ возможных атак на coordinator и участников протокола. — Проектирование защиты от Sybil-атак и DoS. — Анализ возможных утечек метаданных. — Анализ privacy-свойств протокола. — Аудит механизмов authentication, authorization и rate limiting. — Анализ key-management архитектуры. — Security review Bitcoin transaction flow. — Code review критичных компонентов. — Анализ attack surface backend и инфраструктуры. — Подготовка рекомендаций по hardening. — Участие в security testing и подготовке к внешним аудитам. Требования: — Опыт application security, protocol security или security engineering. — Умение самостоятельно строить threat models. — Хорошее понимание сетевой безопасности. — Понимание DoS/DDoS и Sybil attack моделей. — Опыт security review backend-систем. — Понимание криптографических примитивов и digital signatures. — Опыт анализа key-management систем. — Умение проводить code review с точки зрения безопасности. — Понимание рисков metadata leakage и privacy-sensitive систем. Будет большим плюсом: — Глубокое понимание Bitcoin protocol. — Опыт security-аудита Bitcoin или других cryptocurrency-протоколов. — Знание UTXO, PSBT, SegWit, Taproot и Bitcoin transaction signing. — Опыт анализа CoinJoin или других privacy protocols. — Понимание blockchain analysis и deanonymization techniques. — Опыт аудита non-custodial систем. — Практический опыт Rust/C++/Go. Что важно в этой роли: Security engineer должен оценивать не только классические уязвимости backend-приложения, но и экономические, протокольные и privacy-атаки. Для CoinJoin особенно важны поведение злонамеренных участников, Sybil/DoS, корреляция активности и возможные утечки метаданных.

Location: Remote What you’ll be part of Garner is on a mission to transform the U.S. healthcare system — and we’re the only proven player doing exactly that. We partner with employers to redesign how healthcare works: applying 550+ proprietary clinical metrics across 80+ specialties to a dataset of 320M+ patients to identify the best-performing doctors, then using compelling incentives to steer members to the care that helps them get healthier, faster. The result is a rare “win win” — better care and lower costs for both members and employers. In just five years, our work has helped over 2.5 million people access higher-quality care and saved $1B in healthcare costs. We recently raised our Series E and have doubled five years running. If you've ever wanted your work to solve a problem that touches every person in this country, this is the opportunity to do exactly that. You'd be joining a team fundamentally reimagining healthcare in the U.S. — and using AI to scale that impact further and faster than anyone else can. About the role: We are seeking a Staff Security Engineer to serve as a technical anchor for our security function. This role is critical for leading technical design reviews and ensuring our security posture scales alongside our rapid customer growth. You will be responsible for defining the security standards that protect sensitive healthcare data, ensuring our systems are resilient against evolving threats while maintaining high engineering velocity. Where you will work: Garner is headquartered in NYC, but this position is available for individuals who are comfortable with remote work and occasional travel to HQ. What you will do: Lead technical security design: Own the technical design and review process for security-critical systems, ensuring all new features meet Garner's high standards for data protection and resilience Master complex domains: Maintain and apply a mastery of one or more technical security domains (e.g., Cloud Security, AppSec, or Data) to solve the most complex business and technical challenges Course-correct technical direction: Identify when technical paths are inefficient or insufficient and proactively redirect efforts to capture higher ROI for the firm Architect automated defenses: Create and implement advanced tools and automation that increase the efficacy of security monitoring and incident response Translate ambiguity into execution: Take broad, complex security objectives and break them down into well-defined deliverables and architectural requirements for the broader engineering team Mentor through technical rigor: Raise the bar for the engineering function by providing high-level feedback during code and design reviews, fostering a culture of security-first development The ideal candidate has: Exceptional Technical Judgment: Proven ability to make high-stakes technical decisions that result in positive long-term outcomes for the company's security posture Strategic Problem-Solving: Effectively leverages context and data to analyze root causes and prioritize security initiatives that offer the greatest impact on risk reduction Influential Stakeholder Management: Builds strong relationships across the organization, conveying complex security risks in a clear and compelling manner to both technical and non-technical partners Drive for Innovation: Continuously identifies and implements creative solutions to pay down technical debt and improve the efficiency of our security infrastructure Reliability Under Pressure: Handles complex escalations and security incidents with discipline, ensuring rigorous analysis and comprehensive resolution without jumping to conclusions A desire to be a part of a high-performing, mission-driven team that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback Technologies we use: Python, Kubernetes, Snowflake, AWS, Terraform, Wiz, Cyberhaven, and more This is a unique opportunity to join a fast-growing company in a transformative role, helping shape the future of healthcare. Compensation Transparency: The target salary range for this position is $258,000 - $310,000. Individual compensation for this role will depend on various factors, including qualifications, skills, and applicable laws. In addition to base compensation, this role is eligible to participate in our equity incentive and competitive benefits plans, including but not limited to: flexible PTO, Medical/Dental/Vision plan options, 401(k), Teladoc Health and more. Fraud and Security Notice: Please be aware of recent job scam attempts. Our recruiters use getgarner.com and garnerhealth.com email domains exclusively. If you have been contacted by someone claiming to be a Garner recruiter or a hiring manager from a different domain about a potential job, please report it to law enforcement here and to candidateprotection@garnerhealth.com . Equal Employment Opportunity: Garner Health is proud to be an Equal Employment Opportunity employer and values diversity in the workplace. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. Garner Health is committed to providing accommodations for qualified individuals with disabilities in our recruiting process. If you need assistance or an accommodation due to a disability, you may contact us at talent@garnerhealth.com .

Location: London, United Kingdom - Deliveroo Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. About the Role As a Senior Enterprise Security Engineer, you will lead the design and operation of security controls that protect our internal networks, workforce identities, endpoints and corporate systems. You will be working globally with security teams across US, EU and APAC, delivering against our goals and objectives - reducing risk and maturing controls. As a Senior, you will operate with a high degree of autonomy. You will define technical direction, make architectural decisions, and deliver complex security initiatives end-to-end. You will be expected to balance risk reduction with usability, ensuring controls are robust without impeding employee productivity. This role focuses on Identity and Access Management (IAM), Endpoint security (EDR), Network Security, logging and detection engineering, and secure SaaS enablement. You will work closely with IT, Legal, Privacy, Engineering and business stakeholders to embed security as a default practice across the organisation. Security controls will be aligned to recognised frameworks such as the CIS Critical Security Controls and the NIST Cybersecurity Framework (CSF). Key Responsibilities Architecture & Control Implementation: Design, deploy, and maintain core corporate security controls, including phishing-resistant MFA, Just-In-Time (JIT) access, strict role-based access control (RBAC), zero-trust architectures, device and identity bound proofing and modern network isolation. Tooling Ownership: Serve as the technical owner for a broad suite of corporate security systems, managing deployments, configurations, and API integrations for tools across the corporate environment. Technical Leadership: Lead and implement the technical strategy for Endpoint Device trust, Data Loss Prevention, Intellectual property storage, and SaaS application security. Alongside wider corporate security technical controls. Automation & Engineering: Write scripts and build tools to automate security workflows, incident response tasks, and audit evidence collection for compliance. Cross-Functional Collaboration: Work with IT and business operations to integrate security tools into everyday workflows. Guide non-security teams to adopt secure baselines (e.g., CIS Benchmarks) as standard practice. Mentorship: Mentor junior and mid-level engineers, explain technical concepts clearly to non-technical staff, and help improve the team's engineering standards. Minimum Qualifications Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or equivalent practical experience. 5+ years’ experience in Security Engineering, Corporate Security, Detection & Response, or a related field. Hands-on experience administering IAM platforms (e.g. Okta, GoogleWorkspace). Deep hands-on experience with GoogleWorkspace products Practical hands-on experience with Cloud platforms (e.g AWS, GCP) Relevant and practical experience with Infrastructure-as-code (e.g Terraform) Experience implementing modern authentication standards (FIDO2, WebAuthn, SAML, OAuth 2.0, OpenID Connect). Practical experience securing macOS, Windows and Linux endpoints using MDM and EDR/XDR tooling. Experience operating SIEM and/or SOAR platforms and tuning detection logic. Experience with vulnerability management and patch governance. Ability to write production-quality automation scripts. Demonstrated experience leading cross-functional technical initiatives. Desirable Skills Experience with SASE or Zero Trust Network Access platforms. Hands on experience deploying applications into K8 and Docker environments Data Loss Prevention (DLP) and SaaS security governance. Advanced detection engineering or SOAR playbook development. Experience supporting ISO 27001 or SOC 2 audits. Relevant certifications (e.g. CISSP, CISM, GIAC). Diversity, Equity and Inclusion At Deliveroo, we know that a great workplace reflects the world around us and that true diversity and inclusion make us stronger, more creative, and better at what we do. We’re committed to fostering an environment where everyone can do their best work and feel they belong. We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief. If you have a disability or long-term health condition and need support to apply for one of our roles, or require any reasonable adjustments during the recruitment process, you’ll have the opportunity to let us know once you’ve submitted your application. We’ll share details on how to request support so we can ensure you have a fair and equitable experience. If you’re excited about making a real impact in a fast-moving marketplace and growing your career alongside ambitious, supportive teams, we’d love to hear from you! Beware of recruitment scams: DASH Brands will never ask you to pay money or share sensitive financial information during hiring — learn more about DASH Brands' legitimate recruiting process at careersatdoordash.com/recruitment-scam-awareness .

Location: London, United Kingdom - Deliveroo Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. Who We Are Join us in our mission to transform the way people shop and eat, where impact, innovation and growth drive everything we do. Our Engineering teams tackle complex technical challenges across a global, three-sided marketplace, building and scaling systems that serve millions of customers, riders and partners every day. From real-time logistics to resilient infrastructure and marketplace optimisation, we design, build and operate technology that powers Deliveroo’s growth at scale. We’re looking for a Senior Software Engineer, Proactive Security to join our London (Hybrid) team. In this role, you will be a part of our inclusive, collaborative global team responsible for enabling proactive security outcomes with “security paved paths” to ensure a safe, reliable and resilient delivery network. Get to know our Proactive Security Engineering team — what drives us, how we work, and what you can expect. About the Team At Deliveroo we’re striving to build London’s best and most admired Security Engineering organisation as part of our global team based across North America and Europe. Our London based Security Engineering team is looking for a Software Engineer to lead the design, development and operation of security services within Deliveroo’s Product and Cloud Security domains. You will be a part of our inclusive, collaborative global team responsible for building “ security paved paths ” to ensure a safe, reliable and resilient delivery network. This is a London based position reporting directly to the European Senior Manager of our Security Engineering team based in London. What You’ll Need to Thrive Build and maintain core security products, including but not limited to Remote Access Management, Secrets Management, Tokenization, Encryption and Knowledge Graphs, Access Control at global scale. Partner cross-functionally with Core Infrastructure, Product Engineering, Legal, Security teams and Vendor Partners to build “paved paths” that provide actionable feedback to embed secure design practices into the product and infrastructure development process. Lead the technical direction and roadmap for your assigned area of ownership. Build and maintain high Operational Excellence (OE) to ensure we operate T0 services with excellence, rigor and durable standards to ensure minimal to no downtime. Participate in on-call rotation and promptly respond to on-call events with urgency and rigor. Manage the lifecycle of security product feature requests and improvements full life-cycle from triage, validation, design, testing, and implementation. Influence and drive improvements to engineering standards, leverage advancements and LLMs to improve productivity and velocity. Mentor and coach earlier career engineers, setting and enforcing high standards for Operational Excellence and Software Engineering. Requirements Able to demonstrate a track record of driving improvements to a company’s infrastructure security posture. Breadth of technical experience across various infrastructure and security areas running in large production environments. Highly skilled in distributed systems and platforms development using program languages such as Java/Scala/Kotlin, Golang, or Python. Strong experience with infrastructure as a code tooling like Terraform. Expertise with cloud infrastructure and management in AWS. Experience solving complex, systemic issues that require creative thinking and solutions. Exceptional analytical and investigative abilities with hands-on experience leading root cause analysis. Excellent verbal and written communication skills to review design documents with respect to cloud infrastructure, security and engineering personnel. Must be comfortable regularly exercising discretion and independent judgment in performing job duties, including evaluating options, making informed decisions, and determining appropriate courses of action within the scope of assigned responsibilities with minimal oversight. Why Join Us? At Deliveroo, you’ll do work that matters—solving real-world problems in a three-sided marketplace that’s constantly evolving. We’re food lovers, problem solvers, community organisers, proud parents, and more, brought together by a shared drive to make things better. Working here you can expect to: 🔧 Solve meaningful problems at real scale Work on a complex, always-on marketplace that impacts millions every day. 🌱 See your impact, ship fast, leaning into AI, test and improve ideas quickly in a low-hierarchy, high-ownership environment. 🧠 Grow through challenge and ownership. Take on big, ambiguous problems and accelerate your career with strong support. 🌎 A culture built for builders high standards, collaboration, flexible working and continuous learning. 💰 Share in the success you help create competitive salary and DoorDash RSUs, so you’re rewarded for the impact you make. ➡️ Want a deeper look at how we build? Check out our Tech Blog. We aim to create a fair process that lets your skills shine—our interview typically includes 5-6 stages. Explore our Engineering Interview Guide here to help you feel confident at each stage. Our Global Structure Deliveroo is now part of DoorDash, bringing together teams with even greater reach, scale, and ambition. Depending on your role, you may collaborate with teammates, systems, and leaders across DoorDash and Wolt. Together, we’re unlocking new possibilities as one global team. Diversity, Equity and Inclusion At Deliveroo, we know that a great workplace reflects the world around us and that true diversity and inclusion make us stronger, more creative, and better at what we do. We’re committed to fostering an environment where everyone can do their best work and feel they belong. We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief. If you have a disability or long-term health condition and need support to apply for one of our roles, or require any reasonable adjustments during the recruitment process, you’ll have the opportunity to let us know once you’ve submitted your application. We’ll share details on how to request support so we can ensure you have a fair and equitable experience. If you’re excited about making a real impact in a fast-moving marketplace and growing your career alongside ambitious, supportive teams, we’d love to hear from you! #LI-SW1 Diversity, Equity and Inclusion At Deliveroo, we know that a great workplace reflects the world around us and that true diversity and inclusion make us stronger, more creative, and better at what we do. We’re committed to fostering an environment where everyone can do their best work and feel they belong. We believe in equality of opportunity and welcome candidates from all backgrounds regardless of age, gender, ethnicity, disability, sexual orientation, gender identity, socio-economic background, religion, or belief. If you have a disability or long-term health condition and need support to apply for one of our roles, or require any reasonable adjustments during the recruitment process, you’ll have the opportunity to let us know once you’ve submitted your application. We’ll share details on how to request support so we can ensure you have a fair and equitable experience. If you’re excited about making a real impact in a fast-moving marketplace and growing your career alongside ambitious, supportive teams, we’d love to hear from you! Beware of recruitment scams: DASH Brands will never ask you to pay money or share sensitive financial information during hiring — learn more about DASH Brands' legitimate recruiting process at careersatdoordash.com/recruitment-scam-awareness .

Location: San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the role Anthropic's Supplier Security & Assurance (SSA) team sits within Security GRC and is responsible for assessing the security of our suppliers: evaluating whether vendors meet our security requirements, capturing the deviations, and giving the business a clear approval decision it can act on. We assess the vendor population a frontier AI lab actually depends on: SaaS and software, human data operations, compute and data center providers, hardware suppliers, and services firms. The program is designed agent-first so that people spend their time on judgment, remediation, and the vendors that matter most. As a member of the Supplier Security & Assurance team you will run supplier security assessments end to end: reviewing evidence, verifying agent-drafted evaluations, determining inherent and residual risk, and driving findings to closure with vendors and business owners. You will also carry the work that extends assurance past the approval, from contractual security terms and secure configuration baselines to continuous monitoring and reassessment, and you will help shape the tooling and requirements the program runs on. Key responsibilities Run supplier security assessments: review agent-prefilled outputs, evaluate vendor controls and evidence, determine residual risk, route to domain reviewers where deeper assessment is warranted Operate supplier issue management and risk treatment: document each finding with a severity, an owner, and a due date, drive remediation with the vendor and the business owner, record risk acceptances, and roll open issues up to the risk register Run continuous monitoring after approval: reopen an assessment on defined triggers (data classification change, new SOC 2 report, new subprocessor, vendor incident), investigate SaaS configuration, data, and use case drift signals, and queue a reassessment where the vendor's scope has moved Improve the program as you run it: identify gaps in coverage, questionnaires, requirements, and tooling that surface during assessments, propose the fix, and carry roadmap items that mature supplier security overall Tune and maintain our Claude-powered assessment platform alongside the team: prompt development, questionnaire and assessment type design, calibration against assessor decisions, and output QA Contribute to KPI and KRI reporting on coverage, cycle time, residual risk, open issues, and reassessments due Minimum qualifications Experience running supplier security assessments end to end at a technology company: scoping the engagement, determining inherent risk, reviewing controls and evidence, documenting residual risk, and driving findings to closure Working knowledge of risk fundamentals (inherent and residual risk, control effectiveness, compensating controls, risk acceptance) and the judgment to apply them when the evidence is incomplete or the answer isn't in a framework Ability to assess a vendor across security domains, and to recognize which findings you can close yourself and which need a security domain specialist Track record of driving risk treatment to closure through influence across teams with competing priorities Experience building or tuning an LLM-backed workflow, agent, or automation in a risk, compliance, or operations context, including tuning prompts and reviewing model output for accuracy Experience building or operating issue management workflows: logging issues with a clear owner and due date, tracking remediation, and escalating when treatment stalls Working technical knowledge of SaaS security configuration (SSO and SCIM, admin scoping, sharing defaults, audit log export) and of standard vendor security contract terms (DPA, incident notification, subprocessors, audit and testing rights) Ability to read a SOC 2 report or penetration test and turn it into findings: identify control exceptions and carve-outs, map complementary user entity controls, and judge what the evidence does and does not prove Preferred qualifications Experience assessing cloud infrastructure, data center, or data-pipeline vendors Experience supporting SOX, SOC 2, or ISO 27001 third party or vendor management controls Experience assessing additional, more specialized vendor cohorts from a security risk perspective: human data operations or data labeling vendors, hardware suppliers, compute providers and neoclouds, and others Experience with post-approval supplier continuous monitoring: configuration, data, and use case drift detection, shadow IT & SaaS detection, vendor incident management, or evidence-based vendor audits/site visits The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $255,000 — $270,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

О проекте: Международный проект в области AI Security, связанный с разработкой сред, которые помогают LLM-моделям проходить обучение с подкреплением для задач, связанных с кибербезопасностью. Эти среды содержат задания в различных областях кибербезопасности (пентестинг, реагирование на инциденты, эксплуатация, вредоносное ПО и т.д.), цель — создавать достаточно сложные задачи, чтобы модель допускала ошибки, но которые остаются решаемыми для профессиональных специалистов. Это не классическая позиция Pentester или Red Team Engineer. Основная задача — создавать сложные, но реалистичные и проверяемые security-сценарии, в которых LLM-модели совершают ошибки из-за недостатков в рассуждении (reasoning), а не из-за неоднозначных инструкций или ограничений среды. Задачи: — Проектировать security-сценарии для оценки и обучения LLM-моделей — Создавать environments с использованием GitHub, Slack и других инструментов, встречающихся в реальной разработке — Разрабатывать задачи, требующие сложного многошагового reasoning — Моделировать реальные offensive security-сценарии (supply chain attacks, malicious pull requests, exploitation через GitHub Actions и другие техники) — Проверять сценарии на нескольких frontier-моделях и анализировать причины ошибок — Формулировать ожидаемое поведение модели и описывать, почему ошибка считается reasoning failure — Автоматизировать создание и проверку задач с использованием Python и других инструментов Требования: — 5+ лет практического опыта в Offensive Security, Application Security или Web Penetration Testing — Глубокое понимание современных техник атак и поверхности атаки веб-приложений, API, GitHub, CI/CD и связанных экосистем — Практический опыт penetration testing и исследования безопасности приложений — Опыт разработки на Python и/или JavaScript — Навыки статического и динамического анализа кода (Python, JavaScript, Java) — Умение самостоятельно исследовать новые направления, проектировать сложные сценарии и объяснять результаты — Свободный английский язык (Upper-Intermediate / B2+) — Практический опыт работы с современными LLM-моделями — Понимание особенностей работы LLM, ограничений и типичных failure modes — Интерес к AI Security и исследованию поведения LLM Будет плюсом: — Практический опыт AI Red Teaming или LLM Security — Опыт работы с Agentic AI, AI Agents или Model Evaluation — Опыт исследований безопасности GitHub Actions, CI/CD, Supply Chain Security — Сертификаты OSWE, eWPTXv2, OWEE, OSWA или аналогичные — Публикации, write-ups, участие в Bug Bounty, HackTheBox, TryHackMe, Pwn2Own или других проектах Условия: — B2B-контракт (с ИП) — Оплата в долларах США — Part-time: ориентировочно 5–20 часов в неделю — Минимальный объем — 1–2 задачи в неделю — На выполнение одной задачи обычно требуется 5–10 часов — Локация — строго вне РФ (либо уже за пределами РФ, либо готовность к релокации) — Старт — ASAP

О проекте: Международный проект в области AI Security, связанный с разработкой сред, которые помогают LLM-моделям проходить обучение с подкреплением для задач, связанных с кибербезопасностью. Эти среды содержат задания в различных областях кибербезопасности (пентестинг, реагирование на инциденты, эксплуатация, вредоносное ПО и т.д.), цель — создавать достаточно сложные задачи, чтобы модель допускала ошибки, но которые остаются решаемыми для профессиональных специалистов. Это не классическая позиция Pentester или Red Team Engineer. Основная задача — создавать сложные, но реалистичные и проверяемые security-сценарии, в которых LLM-модели совершают ошибки из-за недостатков в рассуждении (reasoning), а не из-за неоднозначных инструкций или ограничений среды. Задачи: — Проектировать security-сценарии для оценки и обучения LLM-моделей — Создавать environments с использованием GitHub, Slack и других инструментов, встречающихся в реальной разработке — Разрабатывать задачи, требующие сложного многошагового reasoning — Моделировать реальные offensive security-сценарии (supply chain attacks, malicious pull requests, exploitation через GitHub Actions и другие техники) — Проверять сценарии на нескольких frontier-моделях и анализировать причины ошибок — Формулировать ожидаемое поведение модели и описывать, почему ошибка считается reasoning failure — Автоматизировать создание и проверку задач с использованием Python и других инструментов Требования: — 5+ лет практического опыта в Offensive Security, Application Security или Web Penetration Testing — Глубокое понимание современных техник атак и поверхности атаки веб-приложений, API, GitHub, CI/CD и связанных экосистем — Практический опыт penetration testing и исследования безопасности приложений — Опыт разработки на Python и/или JavaScript — Навыки статического и динамического анализа кода (Python, JavaScript, Java) — Умение самостоятельно исследовать новые направления, проектировать сложные сценарии и объяснять результаты — Свободный английский язык (Upper-Intermediate / B2+) — Практический опыт работы с современными LLM-моделями — Понимание особенностей работы LLM, ограничений и типичных failure modes — Интерес к AI Security и исследованию поведения LLM Будет плюсом: — Практический опыт AI Red Teaming или LLM Security — Опыт работы с Agentic AI, AI Agents или Model Evaluation — Опыт исследований безопасности GitHub Actions, CI/CD, Supply Chain Security — Сертификаты OSWE, eWPTXv2, OWEE, OSWA или аналогичные — Публикации, write-ups, участие в Bug Bounty, HackTheBox, TryHackMe, Pwn2Own или других проектах Условия: — B2B-контракт (с ИП) — Оплата в долларах США — Part-time: ориентировочно 5–20 часов в неделю — Минимальный объем — 1–2 задачи в неделю — На выполнение одной задачи обычно требуется 5–10 часов — Локация — строго вне РФ (либо уже за пределами РФ, либо готовность к релокации) — Старт — ASAP

Location: Remote Workplace: Remote Phantom https://phantom.com is on a mission to connect the world to the freedom of open markets. Tens of millions of people all over the world use Phantom to access global markets that never close, including perpetuals, prediction markets, tokenized assets, stablecoins and memes. Phantom users are able to discover the markets that matter and the cultural moments that shape them, building conviction through real-time data and the verified performance of top traders. With self-custody and access to open networks at its core, Phantom lets them control their financial moves in the same app they use to safely store or spend money worldwide. Phantom has reached #1 in Google Play's finance category and consistently ranks in the top 50 apps across all categories. Check out our Forbes Fintech 50 https://www.forbes.com/sites/ninabambysheva/2026/02/23/inside-phantoms-battle-plan-to-win-the-crypto-fueled-superapp-war/ and CNBC and Statista's World's Top Fintech Companies 2026 https://www.cnbc.com/worlds-top-fintech-companies-2026/! We are around 180 people, fully remote, backed by a $150M Series C investment from a16z, Sequoia Capital and Paradigm. Platform security is foundational to protecting Phantom and the systems our users rely on. We’re hiring a Senior Platform Security Engineer to own and improve security across our AWS and Kubernetes environments. You’ll work directly with infrastructure and engineering teams to secure the control planes, identities, workloads, and deployment systems behind our most critical products. We’re building an AI-native security team that aggressively uses AI to expand the speed, depth, and reach of our work. We’re looking for a strong security engineer with high agency who can identify the risks that matter, build practical controls, and own problems through verified remediation. This is a hands-on role for someone who is comfortable working in production systems, writing code and infrastructure, responding to incidents, and making security improvements without slowing down the teams building on the platform. This role is fully remote; however, we’re only open to candidates based in the US and Canada. RESPONSIBILITIES - AWS Security: Own and improve security across Phantom’s multi-account AWS environment, including IAM, Identity Center, networking, compute, storage, secrets, logging, and organization-level guardrails. - Kubernetes Security: Secure production Kubernetes environments running on Amazon EKS, including cluster configuration, workload identity, RBAC, admission controls, network boundaries, secrets, container security, and tenant isolation. - Identity and Access: Design least-privilege access models for engineers, services, and automation. Build scoped, auditable, and time-bound access paths for sensitive production systems. - Mission-Critical Systems: Protect the infrastructure supporting products and services that handle sensitive data and high-value operations. - Cloud Security Architecture: Lead security design for new infrastructure, platform services, and major architectural changes. - Infrastructure and Policy as Code: Build reusable security controls using tools such as Pulumi, Terraform, Kubernetes policy engines, and automated configuration validation. - CI/CD and Supply Chain Security: Harden build, deployment, and release systems, including GitHub Actions, workload federation, build runners, dependencies, artifacts, signing, provenance, and access to production environments. - Security Automation: Build tools that identify and remediate cloud and Kubernetes risks at scale. Apply AI-assisted workflows where they materially improve analysis, coverage, or response speed. - Cross-Functional Leadership: Partner closely with Infrastructure, SRE, Developer Experience, and product engineering teams. Establish practical platform-security standards and help teams adopt them. QUALIFICATIONS - 7+ years of experience in platform security, cloud security, infrastructure security, security engineering, or a closely related engineering role. - Deep, hands-on experience securing production AWS environments. You understand IAM and resource policies, workload identity, network security, secrets management, logging, organization-level controls, and the ways these systems fail in practice. - Deep experience securing Kubernetes in production, preferably Amazon EKS, including RBAC, workload identity, admission policy, network policy, pod security, secrets, and cluster hardening. - Experience designing or securing mission-critical systems where compromise, excessive privilege, or loss of availability could have significant customer or business impact. - Strong understanding of identity, authorization, least privilege, isolation, and blast-radius reduction across both human and machine access. - Experience securing CI/CD and software supply chains, including GitHub Actions or similar systems, build runners, workload federation, artifacts, and production deployment paths. - Experience writing and reviewing infrastructure as code using Pulumi, Terraform, CloudFormation, or similar tools. - Ability to write production-quality code or automation in a language such as TypeScript, Python, Go, or Rust. - High agency and ownership. You can take an ambiguous platform-security problem from initial investigation through implementation and verified remediation. - Clear communication and a strong track record of partnering with infrastructure and engineering teams while maintaining a high security bar. NICE TO HAVES - Experience with AWS Nitro Enclaves or other trusted execution environments, including attestation, isolation boundaries, secure key handling, and operational lifecycle management. - Experience securing financial, payments, wallet, custody, or other high-value transaction systems. - Familiarity with key-management infrastructure, AWS KMS, CloudHSM, cryptographic signing systems, or secrets-management platforms. - Experience operating or securing multi-region Kubernetes and AWS environments at significant scale. - Familiarity with service meshes and cloud-native networking technologies such as Istio, PrivateLink, Transit Gateway, or eBPF-based controls. - Experience with GitHub OIDC, Argo CD, Helm, Crossplane, or Kubernetes-based infrastructure delivery. - Experience using cloud-security and observability platforms such as Wiz, Datadog, GuardDuty, Security Hub, or CloudTrail. - Experience building policy-as-code, automated remediation, or security tooling used by a large engineering organization. - Familiarity with blockchain infrastructure or self-custodial wallet architecture. The target base salary for this role will range between $200,000 to $250,000 with the addition of equity and benefits. This is determined by a few factors including your skillset, prior relevant experience, quality of interviews and market factors (such as location) at the point in time of offer. Why Work With Us Phantom's journey to becoming a global trading app began with making crypto easier to use. Today, we’re building on that foundation to help people discover the markets that matter, make informed financial moves, and safely store or spend their money worldwide. Joining Phantom means helping shape that next chapter: building products that bring the freedom of open markets to more people.   - Build for global impact: Create products used by tens of millions of people, making innovative financial markets more accessible to users around the world. - Make complexity feel simple: Solve meaningful challenges across design, engineering, and user experience to make discovering markets and managing money seamless. - Put users in control: Help build a future where people have greater freedom over their assets and financial decisions, with security and self-custody at the foundation. Benefits (only available to full-time employees) - Competitive salary and equity - Comprehensive insurance (medical/dental/vision): base plan 100% covered - Flexible hours and a long-standing, supportive remote environment - Unlimited vacation: Take time when you need it (and we really mean it!) - 401(k) retirement plan - Wellness stipend - Weekly meal stipend - Learning & Development stipend - Remote / WFH set-up stipend We strongly encourage candidates of all backgrounds to apply. We believe that our work is stronger with a variety of perspectives, and we’re eager to further diversify our company. If you have a background that you feel would make an impact at Phantom, please consider applying. We’re committed to building an inclusive, supportive place for you to do the best work of your career. By submitting your resume and application materials, you acknowledge and agree that Phantom Technologies, Inc. ("Phantom") collects and processes your personal information (including application materials, interview records, and related data) to evaluate your candidacy. Phantom may use AI-powered tools and third-party service providers for transcription, note-taking, scheduling, and other administrative tasks. Phantom does not sell your information and your materials will be handled securely and in accordance with applicable data protection laws.

Задачи: — заниматься безопасностью корпоративной Wi-Fi и локальной сети; — работать с сегментацией, WPA3, гостевым трафиком и контролем подключаемых устройств; — проводить security review рабочей платформы: проверять конфигурации, открытые порты и эндпоинты, типовые уязвимости; — выполнять точечные задачи по инфраструктурной безопасности совместно с CSO. Требования: — практический опыт в сетевой безопасности; — понимание принципов защиты сетевой инфраструктуры; — готовность работать из офиса; — ответственность и умение доводить задачи до результата. Будет плюсом: — опыт web- или инфраструктурных security-аудитов; — учебные проекты / pet-projects в security; — опыт в iGaming, платежных компаниях или другой регулируемой сфере. Отдельно ценится техническая аккуратность при работе с production: важно понимать границы допустимых действий и уточнять, что именно можно тестировать в боевом контуре.

Требования: — 4+ года опыта Задачи: — Опыт работы в SOC/операциях безопасности — Активное использование AI для автоматизации и обнаружения в SOC — Практический опыт работы с SIEM — Глубокое понимание фреймворков реагирования на инциденты